www.hadavar.co.il
Open in
urlscan Pro
199.203.232.2
Malicious Activity!
Public Scan
Effective URL: https://www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/
Submission: On November 22 via automatic, source phishtank
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on October 20th 2020. Valid for: 3 months.
This is the only time www.hadavar.co.il was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Raiffeisen Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3033::6818:6205 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 9 | 199.203.232.2 199.203.232.2 | 1680 (NV-ASN CE...) (NV-ASN CELLCOM ltd.) | |
11 | 62.168.6.72 62.168.6.72 | 5588 (GTSCE GTS...) (GTSCE GTS Central Europe / Antel Germany) | |
19 | 3 |
ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ)
online.rb.cz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
rb.cz
online.rb.cz |
382 KB |
9 |
hadavar.co.il
2 redirects
www.hadavar.co.il |
13 KB |
1 |
dekasseguiempregos.com
dekasseguiempregos.com |
854 B |
19 | 3 |
Domain | Requested by | |
---|---|---|
11 | online.rb.cz |
www.hadavar.co.il
online.rb.cz |
9 | www.hadavar.co.il |
2 redirects
dekasseguiempregos.com
www.hadavar.co.il |
1 | dekasseguiempregos.com | |
19 | 3 |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-07 - 2021-07-07 |
a year | crt.sh |
hadavar.co.il Let's Encrypt Authority X3 |
2020-10-20 - 2021-01-18 |
3 months | crt.sh |
online.rb.cz DigiCert SHA2 Extended Validation Server CA |
2020-09-21 - 2021-10-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/
Frame ID: ECC02F68C283AEBCCF3076A6CB6AAF43
Requests: 19 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://dekasseguiempregos.com/wp-content/message.php Page URL
-
https://www.hadavar.co.il/wix/raiffcz/
HTTP 302
https://www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed HTTP 301
https://www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/ Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Angular (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+ ng-version="([\d.]+)"/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
Dynatrace (Analytics) Expand
Detected patterns
- script /dtagent.*\.js/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Kontakty
Search URL Search Domain Scan URL
Title: Bezpečnost
Search URL Search Domain Scan URL
Title: Nápověda
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://dekasseguiempregos.com/wp-content/message.php Page URL
-
https://www.hadavar.co.il/wix/raiffcz/
HTTP 302
https://www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed HTTP 301
https://www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
message.php
dekasseguiempregos.com/wp-content/ |
89 B 854 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/ Redirect Chain
|
13 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dtagent_ICA23STVbgjpqrvx_7000200141014.js
www.hadavar.co.il/dt/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.3864caecf327e470640d.css
online.rb.cz/gaas/authorize/login/ |
352 KB 61 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gib-fragments.css
online.rb.cz/app/gib/ |
138 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runtime.4b3e0924272f3f1cd5b3.js
www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfills.a032d72b2e443c1a0dcc.js
www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scripts.541c83bb9cb6c140515c.js
www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.8befbc06ed70e2861191.js
www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.c87dea3a4da0b73c1d09.js
www.hadavar.co.il/wix/raiffcz/672eb2346a8323a6576b634e7e3301ed/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-background.cf19ccff4c94cf3a2c16.png
online.rb.cz/gaas/authorize/login/ |
86 KB 87 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.9ce9d86f5636d8765042.png
online.rb.cz/gaas/authorize/login/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-sms-normal.a1ed23ce8a792dba46ea.png
online.rb.cz/gaas/authorize/login/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-phone-footer.8ec7664941533cb9438d.png
online.rb.cz/gaas/authorize/login/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-mail-info-footer.82d1ba035d285b0df64c.png
online.rb.cz/gaas/authorize/login/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
futuraTEE.587a70c97ad419538b01.woff
online.rb.cz/gaas/authorize/login/ |
27 KB 27 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
futuraTEEBold.35773772d311b90d2553.woff
online.rb.cz/gaas/authorize/login/ |
27 KB 27 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ionicons.e9f4c425fc377740601b.ttf
online.rb.cz/gaas/authorize/login/ |
184 KB 108 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FuturaTOT-Demi.6ad65ef59592bd4999f1.woff
online.rb.cz/gaas/authorize/login/ |
19 KB 20 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Raiffeisen Bank (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dekasseguiempregos.com
online.rb.cz
www.hadavar.co.il
199.203.232.2
2606:4700:3033::6818:6205
62.168.6.72
0679c87b2cfcf6ce33093fa7ee14fa86a839f3f926a986e1b8b1d962ef3f0efa
0ee076fb765d7807b041a3a2685e7f052697c8a98db482ad12cd2a3135a3caaa
2e26447e2542225b252aa996afdd91c4b967001a9a3043d88ecfd131800b2a3f
38f3f95d6c82518adac7d170e9508c62bb68da94e0d51b90a192fb63d81a99a5
5e700835ec05293a3d0f9e354e7d038319d34521cd279e782198dff6d1dd58f2
719f26fb69aac9f34d13884d48f71111087e07b6e1d353664c51a0aa4fe629b2
9d5379dfed235eb573009946f5d416d1468b624003fccf6e51daacb7c6fec08c
abc9ebbeedf0999677259492736ed26cd3cc45055c9dc2868d1301d17fcbf7b4
c810e91dc2a17c90f0a4c421ac99b6bc5c9bcb209fde13da08c6b9f12a60a1d5
c9b82a008c17eb547ed2993d77b1ae642f4c7743f85b6b5f1fb897996182a888
f7c9b9e3268768128bcc27bff0af10777b1b8e2539b39d572629ee1adec71a60
fc80a2fa4ff49793f5243bb5a6a0a2b2c3ded73a4681b8294fc080645936b963
fe7c86efca3c58748cc556871ecf13f680d7157e1706112fa43ad283c8aa05df