www.formalav.com
Open in
urlscan Pro
31.11.33.239
Malicious Activity!
Public Scan
Submission: On September 30 via manual from LV — Scanned from IT
Summary
TLS certificate: Issued by Actalis Domain Validation Server CA G3 on March 3rd 2022. Valid for: a year.
This is the only time www.formalav.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banka Citadele (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 31.11.33.239 31.11.33.239 | 31034 (ARUBA-ASN) (ARUBA-ASN) | |
1 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
formalav.com
www.formalav.com |
475 KB |
1 | 1 |
Domain | Requested by | |
---|---|---|
1 | www.formalav.com | |
1 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
online.citadele.lv |
www.citadele.lv |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.formalav.com Actalis Domain Validation Server CA G3 |
2022-03-03 - 2023-03-03 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.formalav.com/wp-content/ibbf/Citadele.internetbanka.php?lv_lv?s=&r=
Frame ID: 26B169D1A9282BC30EDAB3715ED7CE4F
Requests: 6 HTTP requests in this frame
Frame:
data://truncated
Frame ID: DC1E635E3FB636002B97819D63357A94
Requests: 1 HTTP requests in this frame
8 Outgoing links
These are links going to different origins than the main page.
Title: RU
Search URL Search Domain Scan URL
Title: EN
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Aizmirsāt paroli?
Search URL Search Domain Scan URL
Title: Palīdzība
Search URL Search Domain Scan URL
Title: Informācija par Internetbanku
Search URL Search Domain Scan URL
Title: Internetbankas droša lietošana
Search URL Search Domain Scan URL
Title: www.citadele.lv
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
1 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Citadele.internetbanka.php
www.formalav.com/wp-content/ibbf/ |
474 KB 475 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
38 KB 38 KB |
Font
application/x-font-otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
37 KB 37 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
39 KB 39 KB |
Font
application/x-font-otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
39 KB 39 KB |
Font
application/x-font-otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame DC1E |
81 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banka Citadele (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| savepage_ShadowLoader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.formalav.com
31.11.33.239
13fd62d756b9664625f44592ba89493b4fc7ef70a8249b947136e8b7f54c7b98
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
c3ccd8bd926647c99b4bb5436ed01b330f633d1464b50d189e4a5367751d6055
d51609cb4e7b43c4383b62590a77afde105e6320a448d0473fb647531bd62582
e8eea96e29a7c0a72612ab85ca3229979666467a28349642c2176e7189a1a39c
f6ea8147a796c7dd400044088cd0f3f9802f2e59df4640ac47c90124468be062
f7a392ec9263fb7c4723cd2b3dd727ecb7abb08080d737fb51d5e2ba59a49e3d