confirmationacomoda.dns.army Open in urlscan Pro
45.147.197.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://itsssl.com/UVS0d
Effective URL:
https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c2...
Submission: On May 24 via manual (May 24th 2022, 5:59:32 pm UTC) from ES — Scanned from ES

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 45.147.197.55, located in Netherlands and belongs to ON-LINE-DATA Server location - Netherlands, Dronten, NL. The main domain is confirmationacomoda.dns.army.
TLS certificate: Issued by R3 on May 17th 2022. Valid for: 3 months.

This is the only time confirmationacomoda.dns.army was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Inter (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a06:98c1:312... 2a06:98c1:3120::a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 14	45.147.197.55 45.147.197.55	204601 (ON-LINE-D...) (ON-LINE-DATA Server location - Netherlands)
12	1

1 2a06:98c1:3120::a (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

itsssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 45.147.197.55 (Netherlands) 2 redirects

ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL)
PTR: vm3498079.1nvme.had.wf

confirmationacomoda.dns.army	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	dns.army 2 redirects confirmationacomoda.dns.army	152 KB
1	itsssl.com 1 redirects itsssl.com	737 B
12	2

	Domain	Requested by
14	confirmationacomoda.dns.army	2 redirects confirmationacomoda.dns.army
1	itsssl.com	1 redirects
12	2

This site contains no links.

Subject Issuer	Validity	Valid
confirmationacomoda.dns.army R3	`2022-05-17` - `2022-08-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd
Frame ID: 9245744E31F5C603590222FA0CC3E5BC
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Acceso clientes banca online | Bankinter

Page URL History Show full URLs

https://itsssl.com/UVS0d HTTP 301
https://confirmationacomoda.dns.army/eviona/ HTTP 302
https://confirmationacomoda.dns.army/eviona/gestion/?2bAt-WmpeZagr:G6dCC4-aSpeB8z5MjAS1w49vlKuAv9tTYG0ML7hig3eHP9... HTTP 302
https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

152 kB
Transfer

301 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://itsssl.com/UVS0d HTTP 301
https://confirmationacomoda.dns.army/eviona/ HTTP 302
https://confirmationacomoda.dns.army/eviona/gestion/?2bAt-WmpeZagr:G6dCC4-aSpeB8z5MjAS1w49vlKuAv9tTYG0ML7hig3eHP92gP5Clommrt HTTP 302
https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response confirmationacomoda.dns.army/eviona/gestion/ Redirect Chain https://itsssl.com/UVS0d https://confirmationacomoda.dns.army/eviona/ https://confirmationacomoda.dns.army/eviona/gestion/?2bAt-WmpeZagr:G6dCC4-aSpeB8z5MjAS1w49vlKuAv9tTYG0ML7hig3eHP92gP5Clommrt https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd	21 KB 5 KB	301ms 301ms	Document text/html	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Full URL https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `d51908583315c437e33f09e26ad7b242d0b55a56742349725dac6830472936db` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language es-ES,es;q=0.9 Response headers content-encoding br content-type text/html; charset=UTF-8 date Tue, 24 May 2022 17:59:27 GMT server ddos-guard vary Accept-Encoding Redirect headers content-encoding br content-type text/html; charset=UTF-8 date Tue, 24 May 2022 17:59:27 GMT location login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd server ddos-guard vary Accept-Encoding
GET H2	200	base-login.css confirmationacomoda.dns.army/eviona/gestion/CSS/	136 KB 21 KB	83ms 82ms	Stylesheet text/css	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `5ec81f68d7e73cf3fe31428b42b9091a9fb7ee72c57eb30baa87b7a9f4b75b49` Request headers accept-language es-ES,es;q=0.9 Referer https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 17:59:28 GMT content-encoding br last-modified Wed, 08 Jul 2020 17:00:34 GMT server ddos-guard age 0 vary Accept-Encoding content-type text/css ddg-cache-status MISS accept-ranges bytes
GET H2	200	logo_bk.svg confirmationacomoda.dns.army/eviona/gestion/CSS/	2 KB 1 KB	87ms 87ms	Image image/svg+xml	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Show image Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/logo_bk.svg Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `3a7fd6380291e497f671cf205631cf10578ec51645685ef8b9c3903b6556293d` Request headers accept-language es-ES,es;q=0.9 Referer https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 17:59:28 GMT content-encoding br last-modified Fri, 08 Jan 2021 19:27:04 GMT server ddos-guard age 0 vary Accept-Encoding content-type image/svg+xml ddg-cache-status MISS accept-ranges bytes
GET H2	200	logo_BK_NW_min.svg confirmationacomoda.dns.army/eviona/gestion/CSS/	881 B 572 B	90ms 90ms	Image image/svg+xml	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Show image Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/logo_BK_NW_min.svg Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `5c093613d9a5f94febe246d6d1e24f9c0119d1cec2d986c9f785726121a85044` Request headers accept-language es-ES,es;q=0.9 Referer https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 17:59:28 GMT content-encoding br last-modified Tue, 07 Jul 2020 02:10:50 GMT server ddos-guard age 0 vary Accept-Encoding content-type image/svg+xml ddg-cache-status MISS accept-ranges bytes
GET H2	200	logo_BK_NW_min_white.svg confirmationacomoda.dns.army/eviona/gestion/CSS/	881 B 582 B	86ms 86ms	Image image/svg+xml	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Show image Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/logo_BK_NW_min_white.svg Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `e29c589912904ca6f8dcf0c3035b1285e883a2f62ca942ef909192acbabe9aee` Request headers accept-language es-ES,es;q=0.9 Referer https://confirmationacomoda.dns.army/eviona/gestion/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=65&id=396053623659c275dc2e97dd3b896ed4ff2b82a8fd59c275dc2e97dd3b896ed4ff2b82a8fd User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 17:59:28 GMT content-encoding br last-modified Tue, 07 Jul 2020 02:11:24 GMT server ddos-guard age 0 vary Accept-Encoding content-type image/svg+xml ddg-cache-status MISS accept-ranges bytes
GET H2	200	logo_bk_white.svg confirmationacomoda.dns.army/eviona/gestion/CSS/	2 KB 1 KB	68ms 67ms	Image image/svg+xml	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Show image Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/logo_bk_white.svg Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `04bdea34b0fdf02001ef0f69d03e55e0ed99f7ac48a9a3e300588a8256ff4342` Request headers accept-language es-ES,es;q=0.9 Referer https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 17:59:28 GMT content-encoding br last-modified Wed, 08 Jul 2020 17:00:00 GMT server ddos-guard age 0 vary Accept-Encoding content-type image/svg+xml ddg-cache-status MISS accept-ranges bytes
GET H2	404	sourcesanspro-regular.woff confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/	0 0	67ms 66ms	Font text/html	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/sourcesanspro-regular.woff Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash Request headers Referer https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Origin https://confirmationacomoda.dns.army accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers ddg-cache-status MISS date Tue, 24 May 2022 17:59:28 GMT content-encoding br server ddos-guard age 0 vary Accept-Encoding content-type text/html; charset=iso-8859-1
GET H2	200	bankintersans-bol.woff confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/	35 KB 35 KB	75ms 74ms	Font font/woff	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/bankintersans-bol.woff Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `5fd7be9f37684677240404090dce4e7e73bada9fc889bb3ec195bdbd9c707cf3` Request headers Referer https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Origin https://confirmationacomoda.dns.army accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 17:59:28 GMT content-encoding gzip last-modified Tue, 07 Jul 2020 02:01:00 GMT server ddos-guard age 0 vary Accept-Encoding content-type font/woff ddg-cache-status MISS accept-ranges bytes
GET H2	200	bankinter_ico_DSL_complete.ttf confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/	39 KB 23 KB	132ms 131ms	Font font/ttf	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/bankinter_ico_DSL_complete.ttf?owuryb Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `d0fa72512b2797c6af236e9c95d7e2ffe428a140d648a8ca6f3e54c2f643b82b` Request headers Referer https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Origin https://confirmationacomoda.dns.army accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 17:59:28 GMT content-encoding gzip last-modified Tue, 07 Jul 2020 01:46:22 GMT server ddos-guard age 0 vary Accept-Encoding content-type font/ttf ddg-cache-status MISS accept-ranges bytes
GET H2	200	bankintersans-reg.woff confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/	35 KB 35 KB	147ms 147ms	Font font/woff	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/bankintersans-reg.woff Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `264d7f7ef09dd61b3d8e2236cfd55b833da5221dab21bdac5b6aad0b8e9b15c9` Request headers Referer https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Origin https://confirmationacomoda.dns.army accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 17:59:28 GMT content-encoding gzip last-modified Tue, 07 Jul 2020 02:01:00 GMT server ddos-guard age 0 vary Accept-Encoding content-type font/woff ddg-cache-status MISS accept-ranges bytes
GET H2	200	bankintertext-regular.woff confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/	30 KB 30 KB	137ms 136ms	Font font/woff	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/bankintertext-regular.woff Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash `910d800bef70078a507d7d4866385bc925bca3e2f725133e2a7707d125a9247f` Request headers Referer https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Origin https://confirmationacomoda.dns.army accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 17:59:28 GMT content-encoding gzip last-modified Tue, 07 Jul 2020 02:00:54 GMT server ddos-guard age 0 vary Accept-Encoding content-type font/woff ddg-cache-status MISS accept-ranges bytes
GET H2	404	sourcesanspro-regular.ttf confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/	0 0	127ms 127ms	Font text/html	45.147.197.55 Netherlands
General Check archive.org Show headers Download Go to Full URL https://confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/sourcesanspro-regular.ttf Requested by Host: confirmationacomoda.dns.army URL: https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.147.197.55 , Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL), Reverse DNS vm3498079.1nvme.had.wf Software ddos-guard / Resource Hash Request headers Referer https://confirmationacomoda.dns.army/eviona/gestion/CSS/base-login.css Origin https://confirmationacomoda.dns.army accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers ddg-cache-status MISS date Tue, 24 May 2022 17:59:28 GMT content-encoding br server ddos-guard age 0 vary Accept-Encoding content-type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Inter (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
itsssl.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0o4a9tohgloi8rrmaemsbt4543
itsssl.com/	1970-01-20 03:16:56	Name: short_UVS0d Value: 1
.dns.army/	1970-01-20 12:02:31	Name: __ddg1_ Value: nZIz87l9Bu6U2CnB1Gz2

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/sourcesanspro-regular.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://confirmationacomoda.dns.army/eviona/gestion/CSS/fonts/sourcesanspro-regular.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

confirmationacomoda.dns.army
itsssl.com
2a06:98c1:3120::a
45.147.197.55
04bdea34b0fdf02001ef0f69d03e55e0ed99f7ac48a9a3e300588a8256ff4342
264d7f7ef09dd61b3d8e2236cfd55b833da5221dab21bdac5b6aad0b8e9b15c9
3a7fd6380291e497f671cf205631cf10578ec51645685ef8b9c3903b6556293d
5c093613d9a5f94febe246d6d1e24f9c0119d1cec2d986c9f785726121a85044
5ec81f68d7e73cf3fe31428b42b9091a9fb7ee72c57eb30baa87b7a9f4b75b49
5fd7be9f37684677240404090dce4e7e73bada9fc889bb3ec195bdbd9c707cf3
910d800bef70078a507d7d4866385bc925bca3e2f725133e2a7707d125a9247f
d0fa72512b2797c6af236e9c95d7e2ffe428a140d648a8ca6f3e54c2f643b82b
d51908583315c437e33f09e26ad7b242d0b55a56742349725dac6830472936db
e29c589912904ca6f8dcf0c3035b1285e883a2f62ca942ef909192acbabe9aee

confirmationacomoda.dns.army Open in urlscan Pro 45.147.197.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

152 kBTransfer

301 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

3 Cookies

2 Console Messages

Indicators

confirmationacomoda.dns.army Open in urlscan Pro
45.147.197.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

152 kB
Transfer

301 kB
Size

3
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!