finance97-excepturi42.pro
188.114.96.3
Malicious Activity!
Public Scan
Open in
urlscan Pro
Effective URL: https://finance97-excepturi42.pro/?d=bF%2FjoJuTaG9aWDsYKUmRy5918lrmnDyuKi%2ByZetgtpiJMpn5QJKOqblwWa3%2FRwENzJqDyr3XTA0XAVVzUC7FxQu... 1mo old
Submission: On April 20 via api from US — Scanned from ES
Summary
TLS certificate: Issued by E8 on April 20th 2026. Valid for: 3mo.
This is the only time finance97-excepturi42.pro was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Investment Scam (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 172.67.152.194 172.67.152.194 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 16 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:818::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 | 172.217.16.195 172.217.16.195 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 3 | 2a04:4e42:400... 2a04:4e42:400::485 | 54113 (FASTLY) (FASTLY - Fastly) | |
| 1 | 151.101.65.229 151.101.65.229 | 54113 (FASTLY) (FASTLY - Fastly) | |
| 24 | 7 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| nvidiacapital.net 1mo old |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| finance97-excepturi42.pro 1mo old |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| cdnjs.cloudflare.com 13yr old |
ASN15169 (GOOGLE - Google LLC, US)
| fonts.googleapis.com 56yr old |
ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-at-in-f3.1e100.net
| fonts.gstatic.com 9yr old |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 16 |
finance97-excepturi42.pro
finance97-excepturi42.pro 1mo old |
192 KB |
| 4 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 267 13yr old |
144 KB |
| 1 |
gstatic.com
fonts.gstatic.com — Cisco Umbrella Rank: 23 9yr old |
71 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 42 56yr old |
1 KB |
| 1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 238 13yr old |
27 KB |
| 1 |
nvidiacapital.net
nvidiacapital.net 1mo old |
989 B |
| 24 | 6 |
| Domain | Requested by | |
|---|---|---|
| 16 | finance97-excepturi42.pro |
nvidiacapital.net
finance97-excepturi42.pro |
| 4 | cdn.jsdelivr.net |
finance97-excepturi42.pro
cdn.jsdelivr.net |
| 1 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | fonts.googleapis.com |
finance97-excepturi42.pro
|
| 1 | cdnjs.cloudflare.com |
finance97-excepturi42.pro
|
| 1 | nvidiacapital.net | |
| 24 | 6 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| nvidiacapital.net E8 |
2026-04-13 - 2026-07-12 |
3mo | crt.sh |
| finance97-excepturi42.pro E8 |
2026-04-20 - 2026-07-19 |
3mo | crt.sh |
| cdnjs.cloudflare.com WE1 |
2026-03-14 - 2026-06-12 |
3mo | crt.sh |
| upload.video.google.com WE2 |
2026-03-30 - 2026-06-22 |
3mo | crt.sh |
| *.gstatic.com WE2 |
2026-03-30 - 2026-06-22 |
3mo | crt.sh |
| jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2025 Q2 |
2025-06-02 - 2026-07-04 |
1yr | crt.sh |
This page contains 1 frames:
Primary Page:
https://finance97-excepturi42.pro/?d=bF%2FjoJuTaG9aWDsYKUmRy5918lrmnDyuKi%2ByZetgtpiJMpn5QJKOqblwWa3%2FRwENzJqDyr3XTA0XAVVzUC7FxQuvfQuD0qvrdMTCYLPmJH9g6CXkmoP%2FJ6LMP4kFE8y9I5CkiqjpfV1rd7%2FD8qQ3nUzyXSYk%2BLUyNEnGk2RrsSPC%2FltWRuNIsYA44Q2EY7PNhxIQEKLVugmfbSwCaiZgbhBMuZNYfvfRqVSSM1iYazi2KWwb99iedVe%2Fjsq4w1w8&on=NVIDIA+Capital
Frame ID: 91E2B184EE27E9A974A9D128C800AB39
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
NVIDIA CapitalPage URL History Show full URLs
- https://nvidiacapital.net/ Page URL
- https://finance97-excepturi42.pro/?d=bF%2FjoJuTaG9aWDsYKUmRy5918lrmnDyuKi%2ByZetgtpiJMpn5QJKOqblwWa3%2FRwENzJq... Page URL
Detected technologies
Detected patterns
- jquery
- /(\d+\.\d+\.\d+)/jquery(?!\.popupoverlay\.js)[/.-][^u]
Detected patterns
- cdn\.jsdelivr\.net
Detected patterns
- cdnjs\.cloudflare\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://nvidiacapital.net/ Page URL
- https://finance97-excepturi42.pro/?d=bF%2FjoJuTaG9aWDsYKUmRy5918lrmnDyuKi%2ByZetgtpiJMpn5QJKOqblwWa3%2FRwENzJqDyr3XTA0XAVVzUC7FxQuvfQuD0qvrdMTCYLPmJH9g6CXkmoP%2FJ6LMP4kFE8y9I5CkiqjpfV1rd7%2FD8qQ3nUzyXSYk%2BLUyNEnGk2RrsSPC%2FltWRuNIsYA44Q2EY7PNhxIQEKLVugmfbSwCaiZgbhBMuZNYfvfRqVSSM1iYazi2KWwb99iedVe%2Fjsq4w1w8&on=NVIDIA+Capital Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H3 |
/
nvidiacapital.net/ |
813 B 989 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
Primary Request
/
finance97-excepturi42.pro/ |
53 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/ |
84 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
style.css
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/css/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css2
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
logo.svg
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
9 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
pic-1.webp
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
15 KB 15 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
pic-2.webp
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
35 KB 35 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
pic-3.webp
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
19 KB 19 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
pic-4.webp
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
20 KB 20 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
pic-5.webp
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
7 KB 8 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
ava-1.webp
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
1 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
ava-2.webp
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
ava-3.webp
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
1 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
script.js
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/js/ |
857 B 994 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
UcCo3FwrK3iLTcviYwY.woff2
fonts.gstatic.com/s/inter/v20/ |
71 KB 71 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
Manrope-Medium.woff2
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/fonts/ |
30 KB 30 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
Manrope-SemiBold.woff2
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/fonts/ |
30 KB 31 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
loader.js
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/app/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
intlTelInput.min.js
cdn.jsdelivr.net/npm/intl-tel-input@23.1.0/build/js/ |
29 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
intlTelInput.css
cdn.jsdelivr.net/npm/intl-tel-input@23.1.0/build/css/ |
20 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
flags.png
cdn.jsdelivr.net/npm/intl-tel-input@23.1.0/build/img/ |
69 KB 69 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
utils.js
cdn.jsdelivr.net/npm/intl-tel-input@23.1.0/build/js/ |
253 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
favicon.ico
finance97-excepturi42.pro/landings/WNoOyD9MYT4x/assets/img/ |
15 KB 3 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Investment Scam (Online)18 JavaScript Window variables
These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| updateTimer function| normalizePhoneNumber function| buttonSend function| addLoaderScript function| addIntlTelInput function| initIntlTelInput function| validateFormPhoneInputs function| addAttributeToButton function| getPhoneValidationError function| resetTelInputError function| showPhoneValidationError function| hidePhoneValidationErrors function| getPhoneErrorNode function| addFormScript function| intlTelInput object| loader2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| nvidiacapital.net/ | Name: cf-c Value: 66647e28-690f-18 |
|
| finance97-excepturi42.pro/ | Name: __cf_clicked Value: 66647e28-690f-18 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
finance97-excepturi42.pro
fonts.googleapis.com
fonts.gstatic.com
nvidiacapital.net
104.17.25.14
151.101.65.229
172.217.16.195
172.67.152.194
188.114.96.3
2a00:1450:4001:818::200a
2a04:4e42:400::485
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0a59565c5d4f3234c826ec37adbb1af67f8581998bc4029c738a963e718d9048
0e8c04f24bb2d19ab91bfc659c08f05f12ee6d42ad412f4846805a2c386f4f21
2c295d99e26dcf357d4d01bcf270fd6924b600c9a13dd8c363ef114f4c6976fa
3092c30df95bf18ec2e6f4e144a1759b666e49c51f1f19440fa9b695ee3f0872
31db5f18534e87667287495da88ffd0a77d5d429579558472b594b37df61ce79
416c16a616d4408f61ba6a51e36add7c979465ee7d172bc8e5a807735d622412
465db316c23377fcb8fb433083ef373d8c8871236e6cea0b4eb6532788ab5801
4f5eb800eb152630be3427ccda713afca90dd265e975d32148bc55b681f29663
50dbbd429a2ec6f7f8ee58f731844abfca4e2e37acd4be96d1fc98bed31e36df
54dc5bc49fbe41359681fa0af8add039fa1383a4f4eade34f7a0a5a257dd1caa
56b2343615288990d7a5233cdc8d31a4eebe12bfe4d4d0a17ecd84d2ea90109b
57e5eee4946c851fbb2910c66418425ca58461adaeeec7c356f1f9190133f21e
79cfc7af5d53bb69d9ee2bf5e2295b10728fa2d777a81a1430cef428d91bc694
8f70331d5ae99ad80c4f091bc5d35fc0e4924c1c77e92460303401b8011ca335
a4000409a897003b1c5a8e1f9f32e18a11b022452151cc47c17ecdcb76d5223b
ac6f3383a41bfd84239e65eaa8721cac0e8554d27af478cece53a1a98ada025e
ad467bd0459771e8fb4d8473af98292c7fec5c3386a2891633eb7a98ff792265
b4427eb9b43cfe55e64cce11f5717e0a3ce1bbe76e94654e1682546da0ebb718
bdf8fc0ca61a8c5e4157d07d465bda7d449894c313588e81c2e4a075279104c9
c00b4286882d98d75ca753320fcc4f57f228084facba37d50a8de1ba1e0f1407
def1a0f6d2bd2a01f1f842475b7e7da7f2596f2783fd8872c37624ae406425af
eeeb6339602af5f5028d20981a44eb89025c06585347c16a216b9800b50e509c
