Submitted URL: https://repa.ticdata.pt/indexba.html
Effective URL: https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
Submission: On June 30 via manual from ES

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 185.12.116.81, located in Portugal and belongs to FLESK-AS, PT. The main domain is ztronic.pt.
TLS certificate: Issued by R3 on June 5th 2021. Valid for: 3 months.
This is the only time ztronic.pt was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

IP Address AS Autonomous System
1 94.126.169.144 33876 (FLESK-AS)
2 9 185.12.116.81 33876 (FLESK-AS)
8 3
Apex Domain
Subdomains
Transfer
9 ztronic.pt
ztronic.pt
346 KB
1 ticdata.pt
repa.ticdata.pt
297 B
8 2
Domain Requested by
9 ztronic.pt 2 redirects ztronic.pt
1 repa.ticdata.pt
8 2

This site contains no links.

Subject Issuer Validity Valid
www.repa.ticdata.pt
R3
2021-06-07 -
2021-09-05
3 months crt.sh
ztronic.pt
R3
2021-06-05 -
2021-09-03
3 months crt.sh

This page contains 1 frames:

Primary Page: https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
Frame ID: D7BF198AEF133E4204C903C23EB03359
Requests: 10 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://repa.ticdata.pt/indexba.html Page URL
  2. https://ztronic.pt/html/santawa3ramoha/ HTTP 302
    https://ztronic.pt/html/santawa3ramoha/particulares/index.php?valid=true&id=30181286 HTTP 302
    https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

394 kB
Transfer

493 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://repa.ticdata.pt/indexba.html Page URL
  2. https://ztronic.pt/html/santawa3ramoha/ HTTP 302
    https://ztronic.pt/html/santawa3ramoha/particulares/index.php?valid=true&id=30181286 HTTP 302
    https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
indexba.html
repa.ticdata.pt/
170 B
297 B
Document
General
Full URL
https://repa.ticdata.pt/indexba.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
94.126.169.144 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel38.dnscpanel.com
Software
nginx /
Resource Hash
6ab1fdae9ea4360fe8d23df9dcda8b3c53f738679e87536548161cf85d505fe1

Request headers

:method
GET
:authority
repa.ticdata.pt
:scheme
https
:path
/indexba.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server
nginx
date
Wed, 30 Jun 2021 13:39:35 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Wed, 30 Jun 2021 13:11:35 GMT
x-scale
YXBvY2FzQGdpdGh1Yg==
content-encoding
gzip
Primary Request home.php
ztronic.pt/html/santawa3ramoha/particulares/
Redirect Chain
  • https://ztronic.pt/html/santawa3ramoha/
  • https://ztronic.pt/html/santawa3ramoha/particulares/index.php?valid=true&id=30181286
  • https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
3 KB
1 KB
Document
General
Full URL
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.12.116.81 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel81.dnscpanel.com
Software
nginx / PHP/7.2.34
Resource Hash
843a554efe92892bf4cb46c229f2e449423838d3e92d5d741c57a15b6d303635
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:method
GET
:authority
ztronic.pt
:scheme
https
:path
/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://repa.ticdata.pt/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
PHPSESSID=e49d0087b77031464ea6a32c73940fe1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://repa.ticdata.pt/indexba.html

Response headers

server
nginx
date
Wed, 30 Jun 2021 13:39:36 GMT
content-type
text/html; charset-UTF-8;charset=UTF-8
content-length
1054
x-powered-by
PHP/7.2.34
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
content-encoding
gzip
x-ua-compatible
IE=edge
x-content-type-options
nosniff
x-robots-tag
noindex, nofollow
x-scale
YXBvY2FzQGdpdGh1Yg==

Redirect headers

server
nginx
date
Wed, 30 Jun 2021 13:39:36 GMT
content-type
text/html; charset-UTF-8;charset=UTF-8
location
./home.php?web=succes&local=_&id=88783646
x-powered-by
PHP/7.2.34
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
x-ua-compatible
IE=edge
x-content-type-options
nosniff
x-robots-tag
noindex, nofollow
x-scale
YXBvY2FzQGdpdGh1Yg==
style.css
ztronic.pt/html/santawa3ramoha/particulares/layout/css/
22 KB
4 KB
Stylesheet
General
Full URL
https://ztronic.pt/html/santawa3ramoha/particulares/layout/css/style.css
Requested by
Host: ztronic.pt
URL: https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.12.116.81 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel81.dnscpanel.com
Software
nginx /
Resource Hash
4a3ef8ddedacc4d90434553b9f3b83abc2a19cfdc32ec175dd302265785ee26e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/html/santawa3ramoha/particulares/layout/css/style.css
pragma
no-cache
cookie
PHPSESSID=e49d0087b77031464ea6a32c73940fe1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ztronic.pt
referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-type
static
date
Wed, 30 Jun 2021 13:39:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 28 Dec 2018 23:28:30 GMT
server
nginx
vary
Accept-Encoding
x-cache
EXPIRED
content-type
text/css; charset=utf-8
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
4022
expires
Thu, 30 Jun 2022 13:39:36 GMT
normalize.css
ztronic.pt/html/santawa3ramoha/particulares/layout/css/
274 KB
197 KB
Stylesheet
General
Full URL
https://ztronic.pt/html/santawa3ramoha/particulares/layout/css/normalize.css
Requested by
Host: ztronic.pt
URL: https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.12.116.81 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel81.dnscpanel.com
Software
nginx /
Resource Hash
93c3131e836d8fd636608abf98b8f63afe8f5953d1f8374bd0ce464acda3dac1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/html/santawa3ramoha/particulares/layout/css/normalize.css
pragma
no-cache
cookie
PHPSESSID=e49d0087b77031464ea6a32c73940fe1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ztronic.pt
referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-type
static
date
Wed, 30 Jun 2021 13:39:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 28 Dec 2018 23:28:30 GMT
server
nginx
vary
Accept-Encoding
x-cache
EXPIRED
content-type
text/css; charset=utf-8
cache-control
max-age=31536000
x-robots-tag
noindex, nofollow
expires
Thu, 30 Jun 2022 13:39:36 GMT
lg.svg
ztronic.pt/html/santawa3ramoha/particulares/layout/img/
4 KB
2 KB
Image
General
Full URL
https://ztronic.pt/html/santawa3ramoha/particulares/layout/img/lg.svg
Requested by
Host: ztronic.pt
URL: https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.12.116.81 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel81.dnscpanel.com
Software
nginx /
Resource Hash
d8a1150c9d307b48c2c8481a3c534f2ebf147598a4f8abcf7811097327ff2154
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/html/santawa3ramoha/particulares/layout/img/lg.svg
pragma
no-cache
cookie
PHPSESSID=e49d0087b77031464ea6a32c73940fe1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ztronic.pt
referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 30 Jun 2021 13:39:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 28 Dec 2018 23:28:30 GMT
server
nginx
x-robots-tag
noindex, nofollow
vary
Accept-Encoding
x-scale
YXBvY2FzQGdpdGh1Yg==
cache-control
max-age=2592000
accept-ranges
bytes
content-type
image/svg+xml
content-length
1887
expires
Fri, 30 Jul 2021 13:39:36 GMT
stifham.svg
ztronic.pt/html/santawa3ramoha/particulares/layout/img/
2 KB
1 KB
Image
General
Full URL
https://ztronic.pt/html/santawa3ramoha/particulares/layout/img/stifham.svg
Requested by
Host: ztronic.pt
URL: https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.12.116.81 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel81.dnscpanel.com
Software
nginx /
Resource Hash
f578be5ab22ef9e3d5e63bf490d7862a2fdec4c459495cfefa4f8747732dcd89
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/html/santawa3ramoha/particulares/layout/img/stifham.svg
pragma
no-cache
cookie
PHPSESSID=e49d0087b77031464ea6a32c73940fe1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ztronic.pt
referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 30 Jun 2021 13:39:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 28 Dec 2018 23:28:30 GMT
server
nginx
x-robots-tag
noindex, nofollow
vary
Accept-Encoding
x-scale
YXBvY2FzQGdpdGh1Yg==
cache-control
max-age=2592000
accept-ranges
bytes
content-type
image/svg+xml
content-length
861
expires
Fri, 30 Jul 2021 13:39:36 GMT
box.svg
ztronic.pt/html/santawa3ramoha/particulares/layout/img/
774 B
777 B
Image
General
Full URL
https://ztronic.pt/html/santawa3ramoha/particulares/layout/img/box.svg
Requested by
Host: ztronic.pt
URL: https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.12.116.81 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel81.dnscpanel.com
Software
nginx /
Resource Hash
afb25233666b221dd353b71c1e0c89f6daf3654eaa2df617e7b05cd8ead1a558
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/html/santawa3ramoha/particulares/layout/img/box.svg
pragma
no-cache
cookie
PHPSESSID=e49d0087b77031464ea6a32c73940fe1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ztronic.pt
referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ztronic.pt/html/santawa3ramoha/particulares/home.php?web=succes&local=_&id=88783646
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 30 Jun 2021 13:39:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 28 Dec 2018 23:28:30 GMT
server
nginx
x-robots-tag
noindex, nofollow
vary
Accept-Encoding
x-scale
YXBvY2FzQGdpdGh1Yg==
cache-control
max-age=2592000
accept-ranges
bytes
content-type
image/svg+xml
content-length
498
expires
Fri, 30 Jul 2021 13:39:36 GMT
bg1.jpg
ztronic.pt/html/santawa3ramoha/particulares/layout/img/
138 KB
138 KB
Image
General
Full URL
https://ztronic.pt/html/santawa3ramoha/particulares/layout/img/bg1.jpg
Requested by
Host: ztronic.pt
URL: https://ztronic.pt/html/santawa3ramoha/particulares/layout/css/style.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.12.116.81 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel81.dnscpanel.com
Software
nginx /
Resource Hash
5727bc5d5d6c55a37f6cfb16cf058b023c6bd7ae0d786e1abb1b01133c90e4ee
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/html/santawa3ramoha/particulares/layout/img/bg1.jpg
pragma
no-cache
cookie
PHPSESSID=e49d0087b77031464ea6a32c73940fe1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ztronic.pt
referer
https://ztronic.pt/html/santawa3ramoha/particulares/layout/css/style.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ztronic.pt/html/santawa3ramoha/particulares/layout/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-type
static
date
Wed, 30 Jun 2021 13:39:37 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Dec 2018 23:28:30 GMT
server
nginx
x-cache
EXPIRED
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
141083
expires
Fri, 30 Jul 2021 13:39:37 GMT
truncated
/
47 KB
47 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
30653592a2c98c1fd17f1c76ba7be5f8a41575d118262c98a1162fc0cf6279e7

Request headers

Origin
https://ztronic.pt
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/font-woff2;charset=utf-8
truncated
/
2 KB
2 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a6730cd5a916013a4efaa2441f429ac9e33d54785db5641e2f94625cad540fd4

Request headers

Origin
https://ztronic.pt
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/font-woff2;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Domain/Path Name / Value
ztronic.pt/ Name: PHPSESSID
Value: e49d0087b77031464ea6a32c73940fe1