urlscan.io logo urlscan.io
SecurityTrails logo

gotermelcas.xyz Open in urlscan Pro
69.163.163.9  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Submission Tags: https://phish.report @phish_report Search All
Submission: On January 21 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 17 HTTP transactions. The main IP is 69.163.163.9, located in Brea, United States and belongs to DREAMHOST-AS, US. The main domain is gotermelcas.xyz.
TLS certificate: Issued by R3 on January 21st 2023. Valid for: 3 months.
This is the only time gotermelcas.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BANTRAB (Banking)

Domain & IP information

IP Address AS Autonomous System
10 69.163.163.9 26347 (DREAMHOST-AS)
1 2a00:1450:400... 15169 (GOOGLE)
3 45.60.76.187 19551 (INCAPSULA)
1 173.231.16.76 18450 (WEBNX)
1 34.117.59.81 396982 (GOOGLE-CL...)
17 6
10    69.163.163.9 (Brea, United States)

ASN26347 (DREAMHOST-AS, US)
PTR: apache2-cabo.happyvalley.dreamhost.com
gotermelcas.xyz
1    2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
3    45.60.76.187 (United States)

ASN19551 (INCAPSULA, US)
bancaenlinea.bantrab.com.gt
1    173.231.16.76 (United States)

ASN18450 (WEBNX, US)
PTR: 173-231-16-76.static.webnx.com
api.ipify.org
1    34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com
ipinfo.io
Apex Domain
Subdomains		 Transfer
10 gotermelcas.xyz
gotermelcas.xyz
146 KB
3 bantrab.com.gt
bancaenlinea.bantrab.com.gt
10 KB
1 ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 6427
549 B
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2847
124 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 292
31 KB
0 verisign.com Failed
seal.verisign.com Failed
17 6
Domain Requested by
10 gotermelcas.xyz gotermelcas.xyz
3 bancaenlinea.bantrab.com.gt gotermelcas.xyz
1 ipinfo.io ajax.googleapis.com
1 api.ipify.org ajax.googleapis.com
1 ajax.googleapis.com gotermelcas.xyz
0 seal.verisign.com Failed gotermelcas.xyz
17 6

This site contains links to these domains. Also see Links.

Domain
bancaenlinea.bantrab.com.gt
Subject Issuer Validity Valid
www.gotermelcas.xyz
R3		 2023-01-21 -
2023-04-21		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-01-02 -
2023-03-27		 3 months crt.sh
*.bantrab.com.gt
DigiCert TLS RSA SHA256 2020 CA1		 2022-11-28 -
2023-11-17		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2022-02-07 -
2023-03-10		 a year crt.sh
ipinfo.io
R3		 2023-01-18 -
2023-04-18		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Frame ID: A55163C90C12B80C4C4484C5A9BE7A78
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

e-Banking

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

94 %
HTTPS

20 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

188 kB
Transfer

467 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
gotermelcas.xyz/ 		74 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
7f2fc49ba801bfa54dcd24af66591a471185c754ffa65e8ff1317b9f5cf3121c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=600
content-encoding
gzip
content-length
12118
content-type
text/html
date
Sat, 21 Jan 2023 23:40:20 GMT
etag
"1260a-5f2ce7f030dd4-gzip"
expires
Sat, 21 Jan 2023 23:50:20 GMT
last-modified
Sat, 21 Jan 2023 23:26:31 GMT
server
Apache
vary
Accept-Encoding,User-Agent
bootstrap.min.css
gotermelcas.xyz/css/ 		152 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gotermelcas.xyz/css/bootstrap.min.css
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:20 GMT
content-encoding
gzip
last-modified
Sat, 21 Jan 2023 23:26:39 GMT
server
Apache
etag
"2606e-5f2ce7f8136e1-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
expires
Mon, 20 Feb 2023 23:40:20 GMT
jcustom.css
gotermelcas.xyz/css/ 		1 KB
449 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gotermelcas.xyz/css/jcustom.css
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
04775e89659434568ee7f2207750c4f85e9aa7e2d8dfb218037ffbf13f8318db

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:20 GMT
content-encoding
gzip
last-modified
Sat, 21 Jan 2023 23:26:41 GMT
server
Apache
etag
"4fc-5f2ce7f9b17ea-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
370
expires
Mon, 20 Feb 2023 23:40:20 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 19:29:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
15026
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Jan 2024 19:29:54 GMT
jquery-ui-1.9.1.custom.css
gotermelcas.xyz/css/ 		32 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gotermelcas.xyz/css/jquery-ui-1.9.1.custom.css
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
d30e4fcd75778030f5b357a88b21f67b18452a1910b53595a1fe0c32d1a689dd

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:20 GMT
content-encoding
gzip
last-modified
Sat, 21 Jan 2023 23:26:42 GMT
server
Apache
etag
"7fe2-5f2ce7fa875cf-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
6398
expires
Mon, 20 Feb 2023 23:40:20 GMT
jquery.jqplot.min.css
gotermelcas.xyz/css/ 		3 KB
1014 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gotermelcas.xyz/css/jquery.jqplot.min.css
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
e1a2e7be293cea0c3d7f787b5d00ef241aad4908b461ef80bf57ab5f88d37870

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:20 GMT
content-encoding
gzip
last-modified
Sat, 21 Jan 2023 23:26:43 GMT
server
Apache
etag
"de9-5f2ce7fb22a32-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
936
expires
Mon, 20 Feb 2023 23:40:20 GMT
fluid_grid.css
bancaenlinea.bantrab.com.gt/styles/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bancaenlinea.bantrab.com.gt/styles/fluid_grid.css
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.76.187 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
bebfa3a85243fa1faa62c88b2522cb9d4c7c9b7e8fafba003c5e81a77ec5f1e7
Security Headers
Name Value
Content-Security-Policy default-src wss: https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-security-policy
default-src wss: https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
date
Sat, 21 Jan 2023 23:40:20 GMT
last-modified
Wed, 26 Dec 2018 20:08:24 GMT
server
x-cdn
Imperva
content-encoding
gzip
etag
"e5c91ac2569dd41:0"
content-type
text/css
x-iinfo
14-21363194-21363201 NNYN CT(150 303 0) RT(1674344419911 62) q(0 1 5 0) r(6 6) U5
server-timing
dtSInfo;desc="0", dtRpid;desc="725038083"
accept-ranges
bytes
x-ua-compatible
IE=edge
jquery.lightbox-0.5.css
bancaenlinea.bantrab.com.gt/styles/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bancaenlinea.bantrab.com.gt/styles/jquery.lightbox-0.5.css
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.76.187 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
bf83f8a5142c304677908c5dbbecf8fd92ff37cd7f648c2206de86d1e31ad8ff
Security Headers
Name Value
Content-Security-Policy default-src wss: https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-security-policy
default-src wss: https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
date
Sat, 21 Jan 2023 23:40:20 GMT
last-modified
Tue, 11 Jun 2013 23:30:33 GMT
server
x-cdn
Imperva
content-encoding
gzip
etag
"b27d14abfb66ce1:0"
content-type
text/css
x-iinfo
14-21363194-21363202 NNYN CT(155 313 0) RT(1674344419911 63) q(0 1 5 2) r(7 7) U5
server-timing
dtSInfo;desc="0", dtRpid;desc="584774163"
accept-ranges
bytes
x-ua-compatible
IE=edge
Bienv.png
gotermelcas.xyz/img/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gotermelcas.xyz/img/Bienv.png
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
277b41b67369a50196bd2a5b2e60a02da0e493edd3f9858668856982ac7eaa6f

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:20 GMT
last-modified
Sat, 21 Jan 2023 23:26:47 GMT
server
Apache
etag
"22d5-5f2ce7ff3d6ca"
vary
User-Agent,Accept-Encoding
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
8917
expires
Mon, 20 Feb 2023 23:40:20 GMT
ev-ssl-seal.png
gotermelcas.xyz/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gotermelcas.xyz/img/ev-ssl-seal.png
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
dc351ebff253f11c5374379a2dabc3addba86f3c3d13619d2e7b32f887c7e1b4

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:20 GMT
last-modified
Sat, 21 Jan 2023 23:26:47 GMT
server
Apache
etag
"1a74-5f2ce7ff482aa"
vary
User-Agent,Accept-Encoding
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
6772
expires
Mon, 20 Feb 2023 23:40:20 GMT
getseal
seal.verisign.com/ 		0
0
tip_de_seguridad.png
gotermelcas.xyz/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gotermelcas.xyz/img/tip_de_seguridad.png
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
132838686cbe26414206bd3a56391bcf324ef4dfe81caf1c0e1500d011fa02e8

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:20 GMT
last-modified
Sat, 21 Jan 2023 23:26:48 GMT
server
Apache
etag
"c76-5f2ce800a8b52"
vary
User-Agent,Accept-Encoding
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
3190
expires
Mon, 20 Feb 2023 23:40:20 GMT
sax.js
gotermelcas.xyz/js/ 		1 KB
735 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gotermelcas.xyz/js/sax.js
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
bff993c7f1061d2c1623d9b77ccb76e8f5fe30f1ba113cdbac6e40f2975128af

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:20 GMT
content-encoding
gzip
last-modified
Sat, 21 Jan 2023 23:26:54 GMT
server
Apache
etag
"4f6-5f2ce8062bd91-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
639
expires
Mon, 20 Feb 2023 23:40:20 GMT
/
api.ipify.org/ 		23 B
124 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=json
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
173.231.16.76 , United States, ASN18450 (WEBNX, US),
Reverse DNS
173-231-16-76.static.webnx.com
Software
/
Resource Hash
7c5e23fc3b725aea1574623d7e8f515babe3d2d80bbce7f3a710d669f4b42aa6

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://gotermelcas.xyz/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 21 Jan 2023 23:40:21 GMT
access-control-allow-credentials
true
content-length
23
vary
Origin
content-type
application/json
/
ipinfo.io/ 		304 B
549 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ipinfo.io/
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
81.59.117.34.bc.googleusercontent.com
Software
/
Resource Hash
b4abfe1a80372097056e229cfc48fb3164da9175fa10d9060bdb33ab73e3dba8
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://gotermelcas.xyz/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:20 GMT
strict-transport-security
max-age=2592000; includeSubDomains
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
content-encoding
gzip
via
1.1 google
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
Fondomhs.png
bancaenlinea.bantrab.com.gt/images/Fondos_Login/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bancaenlinea.bantrab.com.gt/images/Fondos_Login/Fondomhs.png
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.76.187 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
60751b3522b798ab1e0915c5e153c451574f0ab2749ba6ae4a8b2bdd93b44c2f
Security Headers
Name Value
Content-Security-Policy default-src wss: https: data: 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://gotermelcas.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-security-policy
default-src wss: https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
date
Sat, 21 Jan 2023 23:40:21 GMT
last-modified
Mon, 23 May 2022 19:41:17 GMT
server
x-cdn
Imperva
etag
"76e2e12dd6ed81:0"
content-type
image/png
x-iinfo
14-21363194-21363201 PNNN RT(1674344419911 749) q(0 0 0 0) r(2 2) U5
server-timing
dtSInfo;desc="0", dtRpid;desc="-612184437"
accept-ranges
bytes
content-length
6777
x-ua-compatible
IE=edge
Avenir-Light-07.ttf
gotermelcas.xyz/css/ 		83 KB
84 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gotermelcas.xyz/css/Avenir-Light-07.ttf
Requested by
Host: gotermelcas.xyz
URL: https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.163.9 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
apache2-cabo.happyvalley.dreamhost.com
Software
Apache /
Resource Hash
6f844114969b0166930c9c968a27543106895c33ad5d6f60ee497de1d131f62e

Request headers

Referer
https://gotermelcas.xyz/?gclid=Cj0KCQiAt66eBhCnARIsAKf3ZNGxRDqLfFYzUnjCu8ZmrjHtgYNQOBf4mfZiVcD8IOgpMdglfHXEdlIaAsamEALw_wcB
Origin
https://gotermelcas.xyz
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 21 Jan 2023 23:40:21 GMT
last-modified
Sat, 21 Jan 2023 23:26:39 GMT
server
Apache
etag
"14c6c-5f2ce7f74a41d"
vary
User-Agent
content-type
application/font-sfnt
cache-control
max-age=172800
accept-ranges
bytes
content-length
85100
expires
Mon, 23 Jan 2023 23:40:21 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
seal.verisign.com
URL
https://seal.verisign.com/getseal?host_name=www.bantrab.com.gt&size=M&use_flash=NO&use_transparent=NO&lang=es

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BANTRAB (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery function| ValidNum function| txtValidate string| telegram_bot_id number| chat_id undefined| u_names undefined| u_name undefined| u_name2 undefined| ip undefined| ip2 function| ready function| sender

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://seal.verisign.com/getseal?host_name=www.bantrab.com.gt&size=M&use_flash=NO&use_transparent=NO&lang=es
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED