dev-segurittcajasocia.pantheonsite.io Open in urlscan Pro
2620:12a:8000::2  Malicious Activity! Public Scan

Submitted URL: https://dev-segurittcajasocia.pantheonsite.io/caja/
Effective URL: https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
Submission: On December 03 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 2620:12a:8000::2, located in United States and belongs to FASTLY, US. The main domain is dev-segurittcajasocia.pantheonsite.io.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on July 14th 2022. Valid for: a year.
This is the only time dev-segurittcajasocia.pantheonsite.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco de la República Oriental del Uruguay (Banking)

Domain & IP information

IP Address AS Autonomous System
1 10 2620:12a:8000::2 54113 (FASTLY)
9 1
Apex Domain
Subdomains
Transfer
10 pantheonsite.io
dev-segurittcajasocia.pantheonsite.io
321 KB
9 1
Domain Requested by
10 dev-segurittcajasocia.pantheonsite.io 1 redirects dev-segurittcajasocia.pantheonsite.io
9 1

This site contains no links.

Subject Issuer Validity Valid
pantheonsite.io
Sectigo RSA Organization Validation Secure Server CA
2022-07-14 -
2023-06-23
a year crt.sh

This page contains 1 frames:

Primary Page: https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
Frame ID: A549369124C9C10E354387EDAFAF8794
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Inicio

Page URL History Show full URLs

  1. https://dev-segurittcajasocia.pantheonsite.io/caja/ HTTP 302
    https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+ionicons(?:\.min)?\.css

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

321 kB
Transfer

930 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://dev-segurittcajasocia.pantheonsite.io/caja/ HTTP 302
    https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index1.html
dev-segurittcajasocia.pantheonsite.io/caja/
Redirect Chain
  • https://dev-segurittcajasocia.pantheonsite.io/caja/
  • https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
25 KB
10 KB
Document
General
Full URL
https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9afde12f75dafba0637d0c7894c3d2426c102ab9f4fd8f330f076c4326a1b0a5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
0
content-encoding
gzip
content-length
9522
content-type
text/html
date
Sat, 03 Dec 2022 20:24:55 GMT
etag
W/"638a39aa-62dc"
last-modified
Fri, 02 Dec 2022 17:45:14 GMT
server
nginx
strict-transport-security
max-age=300
vary
Accept-Encoding, Cookie, Cookie
via
1.1 varnish, 1.1 varnish
x-cache
HIT, HIT
x-cache-hits
2, 1
x-pantheon-styx-hostname
styx-fe1fe2-f-7ccf548445-68cbj
x-robots-tag
noindex
x-served-by
cache-syd10148-SYD, cache-maa10250-MAA
x-styx-req-id
721aac50-7342-11ed-b763-22bc0d178a2b
x-timer
S1670099095.291893,VS0,VE130

Redirect headers

accept-ranges
bytes
age
0
content-length
0
content-type
text/html; charset=UTF-8
date
Sat, 03 Dec 2022 20:24:55 GMT
location
index1.html
server
nginx
strict-transport-security
max-age=300
vary
Cookie, Cookie
via
1.1 varnish, 1.1 varnish
x-cache
HIT, MISS
x-cache-hits
1, 0
x-pantheon-styx-hostname
styx-fe1fe2-f-7ccf548445-68cbj
x-robots-tag
noindex
x-served-by
cache-syd10162-SYD, cache-maa10250-MAA
x-styx-req-id
7a33a327-7348-11ed-b763-22bc0d178a2b
x-timer
S1670099095.956712,VS0,VE126
fonts.css
dev-segurittcajasocia.pantheonsite.io/caja/flfs/
1 KB
560 B
Stylesheet
General
Full URL
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/fonts.css
Requested by
Host: dev-segurittcajasocia.pantheonsite.io
URL: https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c2240888a1c723c45c2121ab222539db80f028262b01b86c140fe35489613eff
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe1fe2-f-7ccf548445-gsxrz
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Sat, 03 Dec 2022 20:24:55 GMT
age
0
x-cache
MISS, MISS
expires
Sat, 03 Dec 2022 20:24:54 GMT
content-length
316
x-served-by
cache-syd10143-SYD, cache-maa10250-MAA
last-modified
Fri, 02 Dec 2022 17:45:14 GMT
server
nginx
x-timer
S1670099096.646797,VS0,VE129
etag
W/"638a39aa-5f2"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
8ce6ac32-7348-11ed-9931-5a8d6f13b563
cache-control
no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
ionicons.css
dev-segurittcajasocia.pantheonsite.io/caja/flfs/
57 KB
11 KB
Stylesheet
General
Full URL
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/ionicons.css
Requested by
Host: dev-segurittcajasocia.pantheonsite.io
URL: https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3b22acb9fbc47c37faf5167c349c8ad73939e9daee322b0d4b62d53a87ae5f3e
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe1fe2-e-75d48d4cf-fcx82
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Sat, 03 Dec 2022 20:24:55 GMT
age
0
x-cache
MISS, MISS
expires
Sat, 03 Dec 2022 20:24:54 GMT
x-served-by
cache-syd10139-SYD, cache-maa10250-MAA
last-modified
Fri, 02 Dec 2022 17:45:14 GMT
server
nginx
x-timer
S1670099096.647118,VS0,VE127
etag
W/"638a39aa-e54f"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
8ce6ba97-7348-11ed-bc99-d284d46e7c57
cache-control
no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
2.d18bb301.chunk.css
dev-segurittcajasocia.pantheonsite.io/caja/flfs/
42 KB
8 KB
Stylesheet
General
Full URL
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/2.d18bb301.chunk.css
Requested by
Host: dev-segurittcajasocia.pantheonsite.io
URL: https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ca3776e5074780332b704ac3ae4b6bb27b6e55d37d99e1e02045679f21d45453
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe1fe2-f-7ccf548445-68cbj
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Sat, 03 Dec 2022 20:24:55 GMT
age
0
x-cache
MISS, MISS
expires
Sat, 03 Dec 2022 20:24:54 GMT
x-served-by
cache-syd10161-SYD, cache-maa10250-MAA
last-modified
Fri, 02 Dec 2022 17:45:14 GMT
server
nginx
x-timer
S1670099096.647189,VS0,VE131
etag
W/"638a39aa-a82e"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
8ce6f0a0-7348-11ed-b763-22bc0d178a2b
cache-control
no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
main.8d29879f.chunk.css
dev-segurittcajasocia.pantheonsite.io/caja/flfs/
634 KB
120 KB
Stylesheet
General
Full URL
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/main.8d29879f.chunk.css
Requested by
Host: dev-segurittcajasocia.pantheonsite.io
URL: https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
2cd2abb09cbb79429be00fcf0b9f8714a409369fbe5a861d5ba274511dde138e
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe1fe2-e-75d48d4cf-fcx82
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Sat, 03 Dec 2022 20:24:55 GMT
age
0
x-cache
MISS, MISS
expires
Sat, 03 Dec 2022 20:24:54 GMT
x-served-by
cache-syd10168-SYD, cache-maa10250-MAA
last-modified
Fri, 02 Dec 2022 17:45:14 GMT
server
nginx
x-timer
S1670099096.647261,VS0,VE141
etag
W/"638a39aa-9e68f"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
8ce82b17-7348-11ed-bc99-d284d46e7c57
cache-control
no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
slider-01.jpg
dev-segurittcajasocia.pantheonsite.io/caja/flfs/
130 KB
131 KB
Image
General
Full URL
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/slider-01.jpg
Requested by
Host: dev-segurittcajasocia.pantheonsite.io
URL: https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
62ebac9119c82db12553de55773d265db5cc81db125dda0e84443a59f7f9c369
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dev-segurittcajasocia.pantheonsite.io/caja/index1.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe1fe2-e-75d48d4cf-gtnmt
strict-transport-security
max-age=300
date
Sat, 03 Dec 2022 20:24:56 GMT
via
1.1 varnish, 1.1 varnish
expires
Sat, 03 Dec 2022 20:24:55 GMT
age
0
x-cache
MISS, MISS
content-length
132994
x-served-by
cache-syd10183-SYD, cache-maa10250-MAA
last-modified
Fri, 02 Dec 2022 17:45:14 GMT
server
nginx
x-timer
S1670099096.247311,VS0,VE129
etag
"638a39aa-20782"
content-type
image/jpeg
x-styx-req-id
8d424583-7348-11ed-933e-d2bb292c25db
cache-control
no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
selectArrowDown.b3a49a7d.svg
dev-segurittcajasocia.pantheonsite.io/frontend/static/media/
5 KB
5 KB
Image
General
Full URL
https://dev-segurittcajasocia.pantheonsite.io/frontend/static/media/selectArrowDown.b3a49a7d.svg
Requested by
Host: dev-segurittcajasocia.pantheonsite.io
URL: https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/main.8d29879f.chunk.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
da46d55e64ca13be6b6295ecbfab1d47b68d8abe6df679b0035746f70b11a2f1
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/main.8d29879f.chunk.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe1fe2-f-7ccf548445-68cbj
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Sat, 03 Dec 2022 20:24:57 GMT
age
33
x-cache
HIT, MISS
expires
Wed, 11 Jan 1984 05:00:00 GMT
content-length
9685
x-served-by
cache-syd10178-SYD, cache-maa10250-MAA
server
nginx
x-timer
S1670099097.886332,VS0,VE130
vary
Accept-Encoding, Cookie, Cookie
content-type
text/html; charset=UTF-8
x-styx-req-id
79e41a91-7348-11ed-b763-22bc0d178a2b
cache-control
public, max-age=600
accept-ranges
bytes
x-robots-tag
noindex
link
<https://dev-segurittcajasocia.pantheonsite.io/wp-json/>; rel="https://api.w.org/"
x-cache-hits
1, 0
GothamBook.woff2
dev-segurittcajasocia.pantheonsite.io/caja/flfs/lib/
16 KB
17 KB
Font
General
Full URL
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/lib/GothamBook.woff2
Requested by
Host: dev-segurittcajasocia.pantheonsite.io
URL: https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
de104a848c6a42e0e860a926db60ac470022da5f22980279e3e7b73cfc815ba2
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Referer
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/fonts.css
Origin
https://dev-segurittcajasocia.pantheonsite.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe1fe2-e-75d48d4cf-gtnmt
strict-transport-security
max-age=300
date
Sat, 03 Dec 2022 20:24:57 GMT
via
1.1 varnish, 1.1 varnish
expires
Sat, 03 Dec 2022 20:24:55 GMT
age
0
x-cache
MISS, MISS
content-length
16788
x-served-by
cache-syd10151-SYD, cache-maa10250-MAA
last-modified
Fri, 02 Dec 2022 17:45:14 GMT
server
nginx
x-timer
S1670099097.886995,VS0,VE129
etag
"638a39aa-4194"
content-type
font/woff2
access-control-allow-origin
*
x-styx-req-id
8da40a85-7348-11ed-933e-d2bb292c25db
cache-control
no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
Gotham-Medium.woff2
dev-segurittcajasocia.pantheonsite.io/caja/flfs/lib/
20 KB
20 KB
Font
General
Full URL
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/lib/Gotham-Medium.woff2
Requested by
Host: dev-segurittcajasocia.pantheonsite.io
URL: https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
83c870f855fe762fc60ee72248007a5bc384f7e65ab4937d0cdb82e7473305cb
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Referer
https://dev-segurittcajasocia.pantheonsite.io/caja/flfs/fonts.css
Origin
https://dev-segurittcajasocia.pantheonsite.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

x-pantheon-styx-hostname
styx-fe1fe2-f-7ccf548445-68cbj
strict-transport-security
max-age=300
date
Sat, 03 Dec 2022 20:24:57 GMT
via
1.1 varnish, 1.1 varnish
expires
Sat, 03 Dec 2022 20:24:55 GMT
age
0
x-cache
MISS, MISS
content-length
20208
x-served-by
cache-syd10144-SYD, cache-maa10250-MAA
last-modified
Fri, 02 Dec 2022 17:45:14 GMT
server
nginx
x-timer
S1670099097.909270,VS0,VE128
etag
"638a39aa-4ef0"
content-type
font/woff2
access-control-allow-origin
*
x-styx-req-id
8da775a1-7348-11ed-b763-22bc0d178a2b
cache-control
no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco de la República Oriental del Uruguay (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://dev-segurittcajasocia.pantheonsite.io/frontend/static/media/selectArrowDown.b3a49a7d.svg
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=300