cajarural4.temp.swtest.ru
Open in
urlscan Pro
77.222.40.224
Malicious Activity!
Public Scan
Effective URL: http://cajarural4.temp.swtest.ru/rural/client/login.php
Submission: On March 27 via manual from ES — Scanned from ES
Summary
This is the only time cajarural4.temp.swtest.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 14 | 77.222.40.224 77.222.40.224 | 44112 (SWEB-AS) (SWEB-AS) | |
1 2 | 2a00:1450:400... 2a00:1450:4001:810::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 195.53.82.162 195.53.82.162 | 57117 (RSI) (RSI) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:831::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:400c:c07::9c | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:813::2004 | 15169 (GOOGLE) (GOOGLE) | |
17 | 5 |
ASN44112 (SWEB-AS, RU)
PTR: vh293.sweb.ru
cajarural4.temp.swtest.ru |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN57117 (RSI, ES)
PTR: 162.red-195-53-82.customer.static.ccgg.telefonica.net
www.ruralvia.com |
ASN15169 (GOOGLE, US)
fonts.gstatic.com | |
www.google.es |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
swtest.ru
2 redirects
cajarural4.temp.swtest.ru |
177 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com — Cisco Umbrella Rank: 25 |
17 KB |
1 |
google.es
www.google.es — Cisco Umbrella Rank: 22878 |
408 B |
1 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 2 |
483 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net — Cisco Umbrella Rank: 70 |
379 B |
1 |
gstatic.com
fonts.gstatic.com |
44 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
1 KB |
1 |
ruralvia.com
www.ruralvia.com |
2 KB |
17 | 8 |
Domain | Requested by | |
---|---|---|
14 | cajarural4.temp.swtest.ru |
2 redirects
cajarural4.temp.swtest.ru
|
2 | www.google-analytics.com |
1 redirects
cajarural4.temp.swtest.ru
|
1 | www.google.es |
cajarural4.temp.swtest.ru
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
cajarural4.temp.swtest.ru
|
1 | www.ruralvia.com |
cajarural4.temp.swtest.ru
|
17 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.ruralvia.com DigiCert SHA2 Secure Server CA |
2023-02-01 - 2024-01-31 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://cajarural4.temp.swtest.ru/rural/client/login.php
Frame ID: C041A462FC177A9F1630EE27079E46E8
Requests: 17 HTTP requests in this frame
Screenshot
Page Title
Caja RuralPage URL History Show full URLs
-
http://cajarural4.temp.swtest.ru/rural
HTTP 301
http://cajarural4.temp.swtest.ru/rural/ HTTP 302
http://cajarural4.temp.swtest.ru/rural/client/login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://cajarural4.temp.swtest.ru/rural
HTTP 301
http://cajarural4.temp.swtest.ru/rural/ HTTP 302
http://cajarural4.temp.swtest.ru/rural/client/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://www.google-analytics.com/ga.js HTTP 307
- https://www.google-analytics.com/ga.js
- http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=690038278&utmhn=cajarural4.temp.swtest.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caja%20Rural&utmhid=2048238999&utmr=-&utmp=%2Frural%2Fclient%2Flogin.php&utmht=1679913629983&utmac=UA-12835961-1&utmcc=__utma%3D91299720.497407682.1679913630.1679913630.1679913630.1%3B%2B__utmz%3D91299720.1679913630.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1371704182&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
- https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=690038278&utmhn=cajarural4.temp.swtest.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caja%20Rural&utmhid=2048238999&utmr=-&utmp=%2Frural%2Fclient%2Flogin.php&utmht=1679913629983&utmac=UA-12835961-1&utmcc=__utma%3D91299720.497407682.1679913630.1679913630.1679913630.1%3B%2B__utmz%3D91299720.1679913630.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1371704182&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-12835961-1&cid=497407682.1679913630&jid=1371704182&_v=5.7.2&z=690038278 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=497407682.1679913630&jid=1371704182&_v=5.7.2&z=690038278 HTTP 302
- https://www.google.es/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=497407682.1679913630&jid=1371704182&_v=5.7.2&z=690038278&slf_rd=1&random=669745442
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
cajarural4.temp.swtest.ru/rural/client/ Redirect Chain
|
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rviaLogin.css
cajarural4.temp.swtest.ru/rural/client/res/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
www.google-analytics.com/ Redirect Chain
|
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info_psd2.svg
cajarural4.temp.swtest.ru/rural/client/res/ |
47 KB 16 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telefono.jpg
www.ruralvia.com/accesos_cms/es/contenido_tres_archivos/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading.gif
cajarural4.temp.swtest.ru/rural/client/res/ |
56 KB 56 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jq.js
cajarural4.temp.swtest.ru/rural/client/res/cdns/ |
287 KB 85 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
16 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ruralvia-mantenimiento.svg
cajarural4.temp.swtest.ru/rural/client/res/ |
12 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.es/ads/ Redirect Chain
|
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye-view-mantenimiento.svg
cajarural4.temp.swtest.ru/rural/client/res/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow-mantenimiento.svg
cajarural4.temp.swtest.ru/rural/client/res/ |
964 B 872 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-info.svg
cajarural4.temp.swtest.ru/rural/client/res/ |
683 B 690 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico-warning-mantenimiento.svg
cajarural4.temp.swtest.ru/rural/client/res/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aviso.svg
cajarural4.temp.swtest.ru/rural/client/res/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
contacto.svg
cajarural4.temp.swtest.ru/rural/client/res/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| _gat object| _gaq object| gaGlobal function| regeneracionClave function| validaAcceso undefined| iPass undefined| iNif function| changeNifVisibility function| changePassVisibility function| $ function| jQuery function| sendLogin6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cajarural4.temp.swtest.ru/ | Name: PHPSESSID Value: fbdcb97cbe30cb827bd96d4bcfd01286 |
|
.cajarural4.temp.swtest.ru/ | Name: __utma Value: 91299720.497407682.1679913630.1679913630.1679913630.1 |
|
.cajarural4.temp.swtest.ru/ | Name: __utmc Value: 91299720 |
|
.cajarural4.temp.swtest.ru/ | Name: __utmz Value: 91299720.1679913630.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.cajarural4.temp.swtest.ru/ | Name: __utmt Value: 1 |
|
.cajarural4.temp.swtest.ru/ | Name: __utmb Value: 91299720.1.10.1679913630 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cajarural4.temp.swtest.ru
fonts.googleapis.com
fonts.gstatic.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.es
www.ruralvia.com
195.53.82.162
2a00:1450:4001:808::200a
2a00:1450:4001:810::200e
2a00:1450:4001:813::2004
2a00:1450:4001:831::2003
2a00:1450:400c:c07::9c
77.222.40.224
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
246c037026a7a16b204b4688fbcf320b35d95b17423082d9cee36b312a0c368b
509805421bb51434ceb54f81e2210cff4968a8c4140587cc70264e15d45e6696
5819e059aaa02db4ba199f883386b688eaaf1c71c50666d881947b618ae2c8b6
7945d38f7854f4302e0e2914b064a5392a0b16ca617a0e70599a229b73ef058b
804059be177f745bf8b6ab1aa52106fd39c772da4df5067817cfae8a29cfeab0
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
923e03262d1069a5e8a5071a04359e6e356756d5116c4ed3a496861095c894da
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
a125f56731750f15001719ac3c2b9ee3beec5bc37c3c21b46eef08c53c7fa07f
a7437ba825edd317914a9d7e90bf9425dd7e90e8a56dee13fe2e1b2ac394927f
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b7f5a8431ee4a984e1590927d7c1069ca86cf4852074c26846e1a8b21a49c95c
e6356f8b5072cd803d7dbd4fd05fa6e1a9fbc7b37847c91869a363f8947bb86e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f143f88d3952e78a275a6bbe19574c90508dc1e74c10e0b51ed8f0f9f9bb34c4
f5a54c6f8b958819b5eeeff7283c506f2c632e2c6b5359d9f1977ccdb7ad2c71