dasboard2.plantagb.org Open in urlscan Pro
185.32.188.24 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://dasboard2.plantagb.org/
Effective URL:
https://dasboard2.plantagb.org/
Submission: On June 24 via manual (June 24th 2024, 1:59:39 pm UTC) from US — Scanned from PT

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 185.32.188.24, located in Portugal and belongs to PTSERVIDOR, PT. The main domain is dasboard2.plantagb.org.
TLS certificate: Issued by R11 on June 22nd 2024. Valid for: 3 months.

This is the only time dasboard2.plantagb.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: GreenState Credit Union (Financial)

Domain & IP information

	IP Address	AS Autonomous System
6	185.32.188.24 185.32.188.24	62416 (PTSERVIDOR) (PTSERVIDOR)
1	172.67.69.226 172.67.69.226	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.26.13.205 104.26.13.205	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	4

6 185.32.188.24 (Portugal)

ASN62416 (PTSERVIDOR, PT)
PTR: worf.servidorpt.pt

dasboard2.plantagb.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.69.226 (United States)

ASN13335 (CLOUDFLARENET, US)

ipapi.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.13.205 (None, )

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	plantagb.org dasboard2.plantagb.org	2 MB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2418	156 B
1	ipapi.co ipapi.co — Cisco Umbrella Rank: 18000	880 B
8	3

	Domain	Requested by
6	dasboard2.plantagb.org	dasboard2.plantagb.org
1	api.ipify.org	dasboard2.plantagb.org
1	ipapi.co	dasboard2.plantagb.org
8	3

This site contains no links.

Subject Issuer	Validity	Valid
www.dasboard2.plantagb.org R11	`2024-06-22` - `2024-09-20`	3 months	crt.sh
ipapi.co E1	`2024-05-07` - `2024-08-05`	3 months	crt.sh
ipify.org GTS CA 1P5	`2024-05-19` - `2024-08-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dasboard2.plantagb.org/
Frame ID: 8EE2459C4608F1F09F792960A78BAB0E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

access

Page URL History Show full URLs

http://dasboard2.plantagb.org/ HTTP 307
https://dasboard2.plantagb.org/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

1620 kB
Transfer

3225 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://dasboard2.plantagb.org/ HTTP 307
https://dasboard2.plantagb.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
dasboard2.plantagb.org/
Redirect Chain

http://dasboard2.plantagb.org/
https://dasboard2.plantagb.org/

660 B
413 B

172ms
50ms

Document
text/html

185.32.188.24
PTSERVIDOR

General

Check archive.org

Show headers Download Go to

Full URL: https://dasboard2.plantagb.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.32.188.24 , Portugal, ASN62416 (PTSERVIDOR, PT),
Reverse DNS: worf.servidorpt.pt
Software: nginx /
Resource Hash: 68e8f89c085e43dc4631c375a5a592c00de25009ea3a8842e5e95f3a145b1d86

Request headers

Accept-Language: pt-PT,pt;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html
date: Mon, 24 Jun 2024 13:59:31 GMT
last-modified: Fri, 21 Jun 2024 13:51:22 GMT
server: nginx
vary: Accept-Encoding

Redirect headers

Location: https://dasboard2.plantagb.org/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 chunk-vendors.2c58d79c.js Show response
dasboard2.plantagb.org/js/ 230 KB
79 KB 148ms
147ms Script
application/javascript 185.32.188.24
PTSERVIDOR

General

Check archive.org

Show headers Download Go to

Full URL: https://dasboard2.plantagb.org/js/chunk-vendors.2c58d79c.js
Requested by: Host: dasboard2.plantagb.org
URL: https://dasboard2.plantagb.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.32.188.24 , Portugal, ASN62416 (PTSERVIDOR, PT),
Reverse DNS: worf.servidorpt.pt
Software: nginx /
Resource Hash: eaa7e14195c0ddb74686b0a6d736b8f0878fe954d68fd9660b59c768d54d9163

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://dasboard2.plantagb.org/
Accept-Language: pt-PT,pt;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 24 Jun 2024 13:59:31 GMT
content-encoding: br
last-modified: Fri, 21 Jun 2024 13:51:22 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 app.3461c12e.js Show response
dasboard2.plantagb.org/js/ 2 MB
1 MB 209ms
209ms Script
application/javascript 185.32.188.24
PTSERVIDOR

General

Check archive.org

Show headers Download Go to

Full URL: https://dasboard2.plantagb.org/js/app.3461c12e.js
Requested by: Host: dasboard2.plantagb.org
URL: https://dasboard2.plantagb.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.32.188.24 , Portugal, ASN62416 (PTSERVIDOR, PT),
Reverse DNS: worf.servidorpt.pt
Software: nginx /
Resource Hash: b73ab71b19eda07bea0b1889eb81177192793477474c6d54818b9d06d014ef4f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://dasboard2.plantagb.org/
Accept-Language: pt-PT,pt;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 24 Jun 2024 13:59:31 GMT
content-encoding: br
last-modified: Sat, 22 Jun 2024 09:34:26 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 chunk-vendors.269fb860.css
dasboard2.plantagb.org/css/ 257 KB
32 KB 71ms
71ms Stylesheet
text/css 185.32.188.24
PTSERVIDOR

General

Check archive.org

Show headers Download Go to

Full URL: https://dasboard2.plantagb.org/css/chunk-vendors.269fb860.css
Requested by: Host: dasboard2.plantagb.org
URL: https://dasboard2.plantagb.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.32.188.24 , Portugal, ASN62416 (PTSERVIDOR, PT),
Reverse DNS: worf.servidorpt.pt
Software: nginx /
Resource Hash: f7217dbbb757246366eaae3088041d8ded454c0703ed1e86e6a5710e2e4eca25

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://dasboard2.plantagb.org/
Accept-Language: pt-PT,pt;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 24 Jun 2024 13:59:31 GMT
content-encoding: br
last-modified: Fri, 21 Jun 2024 13:51:22 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css

GET
H2 200 app.df9c39b8.css
dasboard2.plantagb.org/css/ 44 KB
9 KB 127ms
127ms Stylesheet
text/css 185.32.188.24
PTSERVIDOR

General

Check archive.org

Show headers Download Go to

Full URL: https://dasboard2.plantagb.org/css/app.df9c39b8.css
Requested by: Host: dasboard2.plantagb.org
URL: https://dasboard2.plantagb.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.32.188.24 , Portugal, ASN62416 (PTSERVIDOR, PT),
Reverse DNS: worf.servidorpt.pt
Software: nginx /
Resource Hash: 85315a5eb274b5c9eb3b709499e4bf2e9bfd4328f44d0711867490b77b15d8b7

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://dasboard2.plantagb.org/
Accept-Language: pt-PT,pt;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 24 Jun 2024 13:59:31 GMT
content-encoding: br
last-modified: Fri, 21 Jun 2024 13:51:22 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css

GET
H2 200 / Show response
ipapi.co/json/ 744 B
880 B 420ms
257ms Fetch
application/json 172.67.69.226
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ipapi.co/json/

Requested by

Host: dasboard2.plantagb.org
URL: https://dasboard2.plantagb.org/js/app.3461c12e.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

172.67.69.226 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7855bda9262d3ec1738269ce199452db8e1891a0b6dc25213085fab40fbcc8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://dasboard2.plantagb.org/
Accept-Language: pt-PT,pt;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 24 Jun 2024 13:59:34 GMT
content-encoding: br
x-content-type-options: nosniff
referrer-policy: same-origin
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Host, origin
allow: OPTIONS, POST, GET, OPTIONS, HEAD
content-type: application/json
access-control-allow-origin: https://dasboard2.plantagb.org
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4acIC%2BmXFtFzKhZAx2bFEzQJtMhQkCqTA8X4l0HcmP83I7dRzORnz9yfQ6%2FxWtdq4NVUUk0tA6%2FvWGnk0rrKdDvHZI%2FxV4JwVsQiP%2B%2FmIzA7fGV3nkDE0AbV"}],"group":"cf-nel","max_age":604800}
x-frame-options: DENY
cf-ray: 898d3d382c7099e1-CDG

GET
H2 200 / Show response
api.ipify.org/ 22 B
156 B 1045ms
881ms XHR
application/json 104.26.13.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: dasboard2.plantagb.org
URL: https://dasboard2.plantagb.org/js/chunk-vendors.2c58d79c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13f8fa4b9742b1b7cba499def40d279f6683e069ca7aa8415fc80eb910f40f76

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/json, text/plain, */*
Referer: https://dasboard2.plantagb.org/
Accept-Language: pt-PT,pt;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 24 Jun 2024 13:59:35 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: application/json
access-control-allow-origin: *
cf-ray: 898d3d3828510481-CDG
content-length: 22

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e0553d5e1f49291bd1730745a95e155e6951aebb077378914eb2816b059a6448

Request headers

Accept-Language: pt-PT,pt;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 671 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2bbd452a1e3d3ced0139ba8095e6985854c5c3593389fff97dad2a0eda0a9b42

Request headers

Accept-Language: pt-PT,pt;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 lg.5d78e955.png
dasboard2.plantagb.org/img/ 8 KB
8 KB 85ms
85ms Image
image/png 185.32.188.24
PTSERVIDOR

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dasboard2.plantagb.org/img/lg.5d78e955.png
Requested by: Host: dasboard2.plantagb.org
URL: https://dasboard2.plantagb.org/css/app.df9c39b8.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.32.188.24 , Portugal, ASN62416 (PTSERVIDOR, PT),
Reverse DNS: worf.servidorpt.pt
Software: nginx /
Resource Hash: 1115d3e33ae69278f947e775a579dca3030369e2d2d8089c4fe3c6ba808a0200

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://dasboard2.plantagb.org/css/app.df9c39b8.css
Accept-Language: pt-PT,pt;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 24 Jun 2024 13:59:32 GMT
last-modified: Fri, 21 Jun 2024 13:51:22 GMT
server: nginx
accept-ranges: bytes
content-length: 8366
content-type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: GreenState Credit Union (Financial)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
dasboard2.plantagb.org
ipapi.co
104.26.13.205
172.67.69.226
185.32.188.24
1115d3e33ae69278f947e775a579dca3030369e2d2d8089c4fe3c6ba808a0200
13f8fa4b9742b1b7cba499def40d279f6683e069ca7aa8415fc80eb910f40f76
2bbd452a1e3d3ced0139ba8095e6985854c5c3593389fff97dad2a0eda0a9b42
68e8f89c085e43dc4631c375a5a592c00de25009ea3a8842e5e95f3a145b1d86
85315a5eb274b5c9eb3b709499e4bf2e9bfd4328f44d0711867490b77b15d8b7
b73ab71b19eda07bea0b1889eb81177192793477474c6d54818b9d06d014ef4f
d7855bda9262d3ec1738269ce199452db8e1891a0b6dc25213085fab40fbcc8f
e0553d5e1f49291bd1730745a95e155e6951aebb077378914eb2816b059a6448
eaa7e14195c0ddb74686b0a6d736b8f0878fe954d68fd9660b59c768d54d9163
f7217dbbb757246366eaae3088041d8ded454c0703ed1e86e6a5710e2e4eca25

dasboard2.plantagb.org Open in urlscan Pro 185.32.188.24 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

1620 kBTransfer

3225 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

dasboard2.plantagb.org Open in urlscan Pro
185.32.188.24 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

1620 kB
Transfer

3225 kB
Size

0
Cookies

8 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!