www.blizancatanzania.co.tz
Open in
urlscan Pro
192.185.190.176
Malicious Activity!
Public Scan
Submission: On July 18 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on June 12th 2023. Valid for: 3 months.
This is the only time www.blizancatanzania.co.tz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Butterfield Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 192.185.190.176 192.185.190.176 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
4 | 147.154.119.19 147.154.119.19 | 31898 (ORACLE-BM...) (ORACLE-BMC-31898) | |
1 | 172.217.13.138 172.217.13.138 | 15169 (GOOGLE) (GOOGLE) | |
2 | 13.65.45.30 13.65.45.30 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 142.251.40.227 142.251.40.227 | 15169 (GOOGLE) (GOOGLE) | |
10 | 6 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: miniwebs.info
www.blizancatanzania.co.tz |
ASN15169 (GOOGLE, US)
PTR: yul02s05-in-f10.1e100.net
fonts.googleapis.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
hit.uptrendsdata.com |
ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f3.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
butterfieldonline.com
bm.butterfieldonline.com — Cisco Umbrella Rank: 470802 |
468 KB |
2 |
uptrendsdata.com
hit.uptrendsdata.com — Cisco Umbrella Rank: 45604 |
18 KB |
1 |
gstatic.com
fonts.gstatic.com |
16 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 88 |
1 KB |
1 |
blizancatanzania.co.tz
www.blizancatanzania.co.tz |
33 KB |
0 |
fontawesome.com
Failed
kit.fontawesome.com Failed |
|
10 | 6 |
Domain | Requested by | |
---|---|---|
4 | bm.butterfieldonline.com |
www.blizancatanzania.co.tz
|
2 | hit.uptrendsdata.com |
www.blizancatanzania.co.tz
hit.uptrendsdata.com |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
www.blizancatanzania.co.tz
|
1 | www.blizancatanzania.co.tz | |
0 | kit.fontawesome.com Failed |
www.blizancatanzania.co.tz
|
10 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.blizancatanzania.co.tz R3 |
2023-06-12 - 2023-09-10 |
3 months | crt.sh |
butterfieldonline.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-02-23 - 2024-03-25 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
*.uptrendsdata.com Sectigo RSA Domain Validation Secure Server CA |
2023-03-28 - 2024-04-09 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.blizancatanzania.co.tz/index.php
Frame ID: F54057757D41E91B79ED77C279E171BC
Requests: 10 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
www.blizancatanzania.co.tz/ |
152 KB 33 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
obdx-font.css
bm.butterfieldonline.com/framework/css/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
oj-alta-notag-min.css
bm.butterfieldonline.com/framework/js/libs/oraclejet/12.1.0/default/css/alta/ |
742 KB 74 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
a076d05399.js
kit.fontawesome.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rum.min.js
hit.uptrendsdata.com/ |
60 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new-bg-login.jpg
bm.butterfieldonline.com/images/index/icons/ |
384 KB 385 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo_white_small.png
bm.butterfieldonline.com/images/corp/common/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
hits
hit.uptrendsdata.com/api/ |
0 85 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- kit.fontawesome.com
- URL
- https://kit.fontawesome.com/a076d05399.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Butterfield Group (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend object| _urconfig object| UTBOOMR1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.hit.uptrendsdata.com/ | Name: ARRAffinitySameSite Value: 9e4ed16610389c6dbd3f9e5ee726cf4d949e701ca11a6a6dff71b275d53f70f1 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bm.butterfieldonline.com
fonts.googleapis.com
fonts.gstatic.com
hit.uptrendsdata.com
kit.fontawesome.com
www.blizancatanzania.co.tz
kit.fontawesome.com
13.65.45.30
142.251.40.227
147.154.119.19
172.217.13.138
192.185.190.176
4ad86a6074b540e35e52274495883653ad687f434ce5b721502e3ec5a8ed76b3
7dba294a392b21769d5fd88671c426d118206423c7e9f984945ce35f4feb4363
7fc56562fdc5cd3c2713d69c9130a18ffeaa9a766953c14ab529aa854bb069f8
b92c9f60921e9a653eda7c4a282432f93515efdcf69a1a99a3ff8a8e804729a1
c0d4661237cd5bc1f51f33f866f94ec90aadcf95c42ebac3528dcf75efc6c954
c306ba9cf9fb4c4bc037ce345f175503bfa0431fa5eb688212278af2126b2740
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40dbc6da95b47d932014e5a93f35b13a341a37ea6fe7559dca041dc77271cd6
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615