mynotifitacionweb-ba5288.ingress-baronn.ewp.live
Open in
urlscan Pro
63.250.43.10
Malicious Activity!
Public Scan
Effective URL: https://mynotifitacionweb-ba5288.ingress-baronn.ewp.live/wp-admin/network/Officina/es/
Submission: On August 31 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 24th 2022. Valid for: a year.
This is the only time mynotifitacionweb-ba5288.ingress-baronn.ewp.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.226.132.161 35.226.132.161 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 1 | 35.241.186.140 35.241.186.140 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 63.250.43.10 63.250.43.10 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
12 | 195.53.82.136 195.53.82.136 | 57117 (RSI) (RSI) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::200a | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 2a00:1450:400... 2a00:1450:4001:828::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:830::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:400c:c08::9c | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:810::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::2003 | 15169 (GOOGLE) (GOOGLE) | |
18 | 7 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 161.132.226.35.bc.googleusercontent.com
l.linklyhq.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 140.186.241.35.bc.googleusercontent.com
0xni4.mjt.lu |
ASN22612 (NAMECHEAP-NET, US)
PTR: ingress-baronn.easywp.com
mynotifitacionweb-ba5288.ingress-baronn.ewp.live |
ASN57117 (RSI, ES)
PTR: 136.red-195-53-82.customer.static.ccgg.telefonica.net
www.ruralvia.com |
ASN15169 (GOOGLE, US)
ssl.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
ruralvia.com
www.ruralvia.com |
89 KB |
2 |
google-analytics.com
1 redirects
ssl.google-analytics.com — Cisco Umbrella Rank: 294 |
17 KB |
1 |
google.de
www.google.de — Cisco Umbrella Rank: 6487 |
501 B |
1 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 2 |
578 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net — Cisco Umbrella Rank: 85 |
473 B |
1 |
gstatic.com
fonts.gstatic.com |
44 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 43 |
1 KB |
1 |
ewp.live
mynotifitacionweb-ba5288.ingress-baronn.ewp.live |
6 KB |
1 |
mjt.lu
1 redirects
0xni4.mjt.lu |
218 B |
1 |
linklyhq.com
1 redirects
l.linklyhq.com — Cisco Umbrella Rank: 626170 |
392 B |
18 | 10 |
Domain | Requested by | |
---|---|---|
12 | www.ruralvia.com |
mynotifitacionweb-ba5288.ingress-baronn.ewp.live
www.ruralvia.com |
2 | ssl.google-analytics.com |
1 redirects
mynotifitacionweb-ba5288.ingress-baronn.ewp.live
|
1 | www.google.de |
mynotifitacionweb-ba5288.ingress-baronn.ewp.live
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
www.ruralvia.com
|
1 | mynotifitacionweb-ba5288.ingress-baronn.ewp.live | |
1 | 0xni4.mjt.lu | 1 redirects |
1 | l.linklyhq.com | 1 redirects |
18 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.ingress-baronn.ewp.live Sectigo RSA Domain Validation Secure Server CA |
2022-05-24 - 2023-05-24 |
a year | crt.sh |
www.ruralvia.com DigiCert SHA2 Extended Validation Server CA |
2022-02-01 - 2023-02-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-08-15 - 2022-11-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mynotifitacionweb-ba5288.ingress-baronn.ewp.live/wp-admin/network/Officina/es/
Frame ID: F3719371E1E49A237B18DFC1541129CF
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
Caja RuralPage URL History Show full URLs
-
https://l.linklyhq.com/l/1Rygs
HTTP 302
http://0xni4.mjt.lu/lnk/AMYAAIjc_aoAAAAAAAAAABIwuxAAAAAA00QAAAAAABl01gBjDxeiZiZONtF6TBW7qr1xi5rW... HTTP 302
https://mynotifitacionweb-ba5288.ingress-baronn.ewp.live/wp-admin/network/Officina/es/ Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://l.linklyhq.com/l/1Rygs
HTTP 302
http://0xni4.mjt.lu/lnk/AMYAAIjc_aoAAAAAAAAAABIwuxAAAAAA00QAAAAAABl01gBjDxeiZiZONtF6TBW7qr1xi5rW4AAYuA8/1/MbHimGGIGeJUX-fo084j8Q/aHR0cHM6Ly9teW5vdGlmaXRhY2lvbndlYi1iYTUyODguaW5ncmVzcy1iYXJvbm4uZXdwLmxpdmUvd3AtYWRtaW4vbmV0d29yay9PZmZpY2luYS9lcy8 HTTP 302
https://mynotifitacionweb-ba5288.ingress-baronn.ewp.live/wp-admin/network/Officina/es/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 16- https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=287928328&utmhn=mynotifitacionweb-ba5288.ingress-baronn.ewp.live&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caja%20Rural&utmhid=1524499864&utmr=-&utmp=%2Fwp-admin%2Fnetwork%2FOfficina%2Fes%2F&utmht=1661952394255&utmac=UA-12835961-1&utmcc=__utma%3D191164726.1533587681.1661952394.1661952394.1661952394.1%3B%2B__utmz%3D191164726.1661952394.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1340786817&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-12835961-1&cid=1533587681.1661952394&jid=1340786817&_v=5.7.2&z=287928328 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=1533587681.1661952394&jid=1340786817&_v=5.7.2&z=287928328 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=1533587681.1661952394&jid=1340786817&_v=5.7.2&z=287928328&slf_rd=1&random=3744740244
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
mynotifitacionweb-ba5288.ingress-baronn.ewp.live/wp-admin/network/Officina/es/ Redirect Chain
|
20 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rviaLogin.css
www.ruralvia.com/estilos_prtl/css_acceso/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
checkUsuPass.js
www.ruralvia.com/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
acceso.js
www.ruralvia.com/javascripts_portal/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
keyboard.js
www.ruralvia.com/javascripts_portal/es_ES/js_portal/ |
24 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info_psd2.svg
www.ruralvia.com/accesos_cms/es/contenido_dos_archivos/ |
47 KB 47 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telefono.jpg
www.ruralvia.com/accesos_cms/es/contenido_tres_archivos/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
16 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
ssl.google-analytics.com/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ruralvia-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye-view-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
964 B 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-info.svg
www.ruralvia.com/estilos_prtl/css/html5/css/images/icons/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico-warning-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aviso.svg
www.ruralvia.com/estilos_prtl/css_acceso/images/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
contacto.svg
www.ruralvia.com/estilos_prtl/css_acceso/images/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 501 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.ruralvia.com
- URL
- https://www.ruralvia.com/estilos_prtl/css/html5/css/images/icons/icon-info.svg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)93 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| iAlphanumeric string| iAlphanumericVB string| iDocument string| iAlphanumericOrEmail boolean| defaultEmptyOK string| whitespace function| isLetter function| isAsciiCharPermited function| isDigit function| isLetterOrDigit function| isEmpty function| isAlphanumericVB function| isAlphanumeric function| isEmail function| checkAlphanumeric function| checkAlphanumericVB function| warnInvalid function| isWhitespace function| checkDocumento function| showError function| comprobarAcceso undefined| win2 string| CODAPP number| longCadena string| entidad object| filtro function| sanitize function| VKI_attach function| VKI_close function| VKI_buildKeyboardInputs function| VKI_findPos function| VKI_innerDimensions function| VKI_scrollDist function| VKI_getStyle function| VKI_disableSelection function| Conectando function| ConectandoIur number| pulsada object| fActual function| volverTemporizado number| timerPPub function| mandar function| mandarIur function| posicion function| pulsarTecla boolean| ie4tecla object| _gaq function| regeneracionClave function| validaAcceso undefined| iPass undefined| iNif function| changeNifVisibility function| changePassVisibility object| _gat object| gaGlobal boolean| VKI_visible boolean| VKI_target boolean| VKI_dead boolean| VKI_capslock boolean| VKI_shift boolean| VKI_deadkeysOn string| VKI_kt boolean| VKI_clearPasswords string| VKI_imageURI boolean| VKI_clickless number| VKI_clicklessDelay number| VKI_keyCenter boolean| VKI_isIE boolean| VKI_isIE6 boolean| VKI_isIElt8 boolean| VKI_isIE9 boolean| VKI_isIE10 boolean| VKI_isMoz boolean| VKI_isWebKit object| VKI_layout object| VKI_layoutDDK object| VKI_deadkey function| VKI_attachKeyboard object| VKI_keyboard function| VKI_buildKeys function| VKI_modify function| VKI_insert function| VKI_show_focus function| VKI_position5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.mynotifitacionweb-ba5288.ingress-baronn.ewp.live/ | Name: __utma Value: 191164726.1533587681.1661952394.1661952394.1661952394.1 |
|
.mynotifitacionweb-ba5288.ingress-baronn.ewp.live/ | Name: __utmc Value: 191164726 |
|
.mynotifitacionweb-ba5288.ingress-baronn.ewp.live/ | Name: __utmz Value: 191164726.1661952394.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.mynotifitacionweb-ba5288.ingress-baronn.ewp.live/ | Name: __utmt Value: 1 |
|
.mynotifitacionweb-ba5288.ingress-baronn.ewp.live/ | Name: __utmb Value: 191164726.1.10.1661952394 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=15768000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
0xni4.mjt.lu
fonts.googleapis.com
fonts.gstatic.com
l.linklyhq.com
mynotifitacionweb-ba5288.ingress-baronn.ewp.live
ssl.google-analytics.com
stats.g.doubleclick.net
www.google.com
www.google.de
www.ruralvia.com
www.ruralvia.com
195.53.82.136
2a00:1450:4001:810::2003
2a00:1450:4001:810::2004
2a00:1450:4001:813::200a
2a00:1450:4001:828::2008
2a00:1450:4001:830::2003
2a00:1450:400c:c08::9c
35.226.132.161
35.241.186.140
63.250.43.10
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
36ec8a2c1c3a936316b64f686261db7eb0d1bc301f1d779cd844db268a933978
3aa4c7972f9b400d68eba8aaa350840ce00a14d8678612d8bbeea7266b8dc99f
509805421bb51434ceb54f81e2210cff4968a8c4140587cc70264e15d45e6696
5819e059aaa02db4ba199f883386b688eaaf1c71c50666d881947b618ae2c8b6
5dcfcba5605a3d22a34cc3f99054c035836d410bc90f1936b9af0e279882dfea
69951dde4b5dbc60793065b821ab8c9e8cfa50df2ee950fae653e611e8fdf81b
7945d38f7854f4302e0e2914b064a5392a0b16ca617a0e70599a229b73ef058b
804059be177f745bf8b6ab1aa52106fd39c772da4df5067817cfae8a29cfeab0
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
92b0c012b34ea951e730d0452dce78cf13aa209c90279035f0600af911227126
9a372731395507366ae8a382f8655bb09ca8b25d67fe7dcea44a810270fe00a3
a125f56731750f15001719ac3c2b9ee3beec5bc37c3c21b46eef08c53c7fa07f
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b7f5a8431ee4a984e1590927d7c1069ca86cf4852074c26846e1a8b21a49c95c
e6356f8b5072cd803d7dbd4fd05fa6e1a9fbc7b37847c91869a363f8947bb86e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629