losangelesdecharlie.es Open in urlscan Pro
185.129.249.99 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://servicios.3r-solucion.es/wp-content/plugins/mmduzdr/indo.php
Effective URL:
https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2lu...
Submission: On June 20 via api (June 20th 2022, 4:35:39 pm UTC) from CH — Scanned from ES

Summary HTTP 5 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 185.129.249.99, located in Spain and belongs to AXARNET-AS, ES. The main domain is losangelesdecharlie.es.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 1st 2022. Valid for: 3 months.

This is the only time losangelesdecharlie.es was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Unicaja Banco (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	87.98.231.18 87.98.231.18	16276 (OVH) (OVH)
1 5	185.129.249.99 185.129.249.99	50926 (AXARNET-AS) (AXARNET-AS)
5	3

1 87.98.231.18 (Spain)

ASN16276 (OVH, FR)
PTR: cluster007.ovh.net

servicios.3r-solucion.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.129.249.99 (Spain) 1 redirects

ASN50926 (AXARNET-AS, ES)
PTR: mail.seronsl.com

losangelesdecharlie.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	losangelesdecharlie.es 1 redirects losangelesdecharlie.es	2 MB
1	3r-solucion.es servicios.3r-solucion.es	323 B
5	2

	Domain	Requested by
5	losangelesdecharlie.es	1 redirects losangelesdecharlie.es
1	servicios.3r-solucion.es
5	2

This site contains no links.

Subject Issuer	Validity	Valid
maxminterm.com R3	`2022-05-19` - `2022-08-17`	3 months	crt.sh
losangelesdecharlie.es cPanel, Inc. Certification Authority	`2022-05-01` - `2022-07-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjUwMDUuMTE1IFNhZmFyaS81MzcuMzY4OS4yMzguMTc4LjM1MjAyMjpKdW46TW9u
Frame ID: 88A006E8BE343A4522CDDCCD020CECC4
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Liberbank - Login

Page URL History Show full URLs

https://servicios.3r-solucion.es/wp-content/plugins/mmduzdr/indo.php Page URL
https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/ Page URL
https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/ HTTP 302
https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRv... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

3910 kB
Transfer

3909 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://servicios.3r-solucion.es/wp-content/plugins/mmduzdr/indo.php Page URL
https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/ Page URL
https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/ HTTP 302
https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjUwMDUuMTE1IFNhZmFyaS81MzcuMzY4OS4yMzguMTc4LjM1MjAyMjpKdW46TW9u Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	indo.php Show response servicios.3r-solucion.es/wp-content/plugins/mmduzdr/	230 B 323 B	204ms 93ms	Document text/html	87.98.231.18 OVH
General Check archive.org Show headers Download Go to Full URL https://servicios.3r-solucion.es/wp-content/plugins/mmduzdr/indo.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 87.98.231.18 , Spain, ASN16276 (OVH, FR), Reverse DNS cluster007.ovh.net Software Apache / PHP/7.3 Resource Hash `ca21a59c9d61bd469afb00b849eccaa56248e79ae5ac6971d4f10b05d1f3dfc1` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 accept-language es-ES,es;q=0.9 Response headers content-encoding gzip content-length 179 content-type text/html; charset=UTF-8 date Mon, 20 Jun 2022 16:35:32 GMT server Apache vary Accept-Encoding x-powered-by PHP/7.3
GET H/1.1	200 OK	/ Show response losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/	104 B 311 B	282ms 119ms	Document text/html	185.129.249.99 AXARNET-AS
General Check archive.org Show headers Download Go to Full URL https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.129.249.99 , Spain, ASN50926 (AXARNET-AS, ES), Reverse DNS mail.seronsl.com Software Apache / Resource Hash `0efae8927c3a86e353d09d08ec7f30d5e18260295b589d68c66a24dff5ba944a` Request headers Referer https://servicios.3r-solucion.es/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 accept-language es-ES,es;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 20 Jun 2022 16:35:37 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	Primary Request LB-log.php Show response losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/ Redirect Chain https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/ https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb2...	24 KB 25 KB	130ms 129ms	Document text/html	185.129.249.99 AXARNET-AS
General Check archive.org Show headers Download Go to Full URL https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjUwMDUuMTE1IFNhZmFyaS81MzcuMzY4OS4yMzguMTc4LjM1MjAyMjpKdW46TW9u Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.129.249.99 , Spain, ASN50926 (AXARNET-AS, ES), Reverse DNS mail.seronsl.com Software Apache / Resource Hash `4fcea0426f3250792d3a0aae0cc32ec60bd8f81f041f8668da5ab2bbf25dbd6d` Request headers Referer https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 accept-language es-ES,es;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 20 Jun 2022 16:35:38 GMT Keep-Alive timeout=5, max=98 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 20 Jun 2022 16:35:37 GMT Keep-Alive timeout=5, max=99 Server Apache Transfer-Encoding chunked location LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjUwMDUuMTE1IFNhZmFyaS81MzcuMzY4OS4yMzguMTc4LjM1MjAyMjpKdW46TW9u
GET H/1.1	200 OK	style.css losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-files/	2 MB 2 MB	55ms 55ms	Stylesheet text/css	185.129.249.99 AXARNET-AS
General Check archive.org Show headers Download Go to Full URL https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-files/style.css Requested by Host: losangelesdecharlie.es URL: https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjUwMDUuMTE1IFNhZmFyaS81MzcuMzY4OS4yMzguMTc4LjM1MjAyMjpKdW46TW9u Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.129.249.99 , Spain, ASN50926 (AXARNET-AS, ES), Reverse DNS mail.seronsl.com Software Apache / Resource Hash `6a5c205a8f91d3daa4e447d8007dd7adfa4056c3828a55b39efb9fdab3f9c67d` Request headers accept-language es-ES,es;q=0.9 Referer https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjUwMDUuMTE1IFNhZmFyaS81MzcuMzY4OS4yMzguMTc4LjM1MjAyMjpKdW46TW9u User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Mon, 20 Jun 2022 16:35:38 GMT Last-Modified Thu, 06 Jan 2022 16:23:36 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 2344148
GET H/1.1	200 OK	jquery.min.js Show response losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-files/	86 KB 86 KB	125ms 53ms	Script application/javascript	185.129.249.99 AXARNET-AS
General Check archive.org Show headers Download Go to Full URL https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-files/jquery.min.js Requested by Host: losangelesdecharlie.es URL: https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjUwMDUuMTE1IFNhZmFyaS81MzcuMzY4OS4yMzguMTc4LjM1MjAyMjpKdW46TW9u Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.129.249.99 , Spain, ASN50926 (AXARNET-AS, ES), Reverse DNS mail.seronsl.com Software Apache / Resource Hash `2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a` Request headers accept-language es-ES,es;q=0.9 Referer https://losangelesdecharlie.es/temp/LWorkUNIbrasc/LWork/LBes/home/LB-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjUwMDUuMTE1IFNhZmFyaS81MzcuMzY4OS4yMzguMTc4LjM1MjAyMjpKdW46TW9u User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Mon, 20 Jun 2022 16:35:38 GMT Last-Modified Thu, 06 Jan 2022 16:23:36 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 88145
GET DATA	200 OK	truncated /	446 KB 446 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8f1a0cc24e6bb3bf2ed3f80167a1ecda6ea45f516f5cfb59a1912e619b1d3c9f` Request headers Referer Origin https://losangelesdecharlie.es accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	219 KB 219 KB		Font application/font-sfnt
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1b43de2449d39b65ff6f63315d4afda585f72fbbec2e3d9a56f59de6c75149d3` Request headers Referer Origin https://losangelesdecharlie.es accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Content-Type application/font-sfnt
GET DATA	200 OK	truncated /	216 KB 216 KB		Font application/font-sfnt
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b4c2050b25d3d296d5cf58589ca00816dc72df42262c2f629d5c6a984a161aa4` Request headers Referer Origin https://losangelesdecharlie.es accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Content-Type application/font-sfnt
GET DATA	200 OK	truncated /	212 KB 212 KB		Font application/font-sfnt
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8` Request headers Referer Origin https://losangelesdecharlie.es accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Content-Type application/font-sfnt
GET DATA	200 OK	truncated /	208 KB 208 KB		Font application/font-sfnt
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a8f2af8e79f46686b1cfcfb3a1fd53e94e88308d7c6ee7f85c733f4796fcc3a0` Request headers Referer Origin https://losangelesdecharlie.es accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Content-Type application/font-sfnt
GET DATA	200 OK	truncated /	208 KB 208 KB		Font application/font-sfnt
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6cb918a707a06c4f98221d09344af4b98c9cb6184b13309a579caf0418d5eb74` Request headers Referer Origin https://losangelesdecharlie.es accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Content-Type application/font-sfnt

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Unicaja Banco (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

losangelesdecharlie.es
servicios.3r-solucion.es
185.129.249.99
87.98.231.18
0efae8927c3a86e353d09d08ec7f30d5e18260295b589d68c66a24dff5ba944a
13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8
1b43de2449d39b65ff6f63315d4afda585f72fbbec2e3d9a56f59de6c75149d3
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
4fcea0426f3250792d3a0aae0cc32ec60bd8f81f041f8668da5ab2bbf25dbd6d
6a5c205a8f91d3daa4e447d8007dd7adfa4056c3828a55b39efb9fdab3f9c67d
6cb918a707a06c4f98221d09344af4b98c9cb6184b13309a579caf0418d5eb74
8f1a0cc24e6bb3bf2ed3f80167a1ecda6ea45f516f5cfb59a1912e619b1d3c9f
a8f2af8e79f46686b1cfcfb3a1fd53e94e88308d7c6ee7f85c733f4796fcc3a0
b4c2050b25d3d296d5cf58589ca00816dc72df42262c2f629d5c6a984a161aa4
ca21a59c9d61bd469afb00b849eccaa56248e79ae5ac6971d4f10b05d1f3dfc1

losangelesdecharlie.es Open in urlscan Pro 185.129.249.99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

3910 kBTransfer

3909 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

losangelesdecharlie.es Open in urlscan Pro
185.129.249.99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

3910 kB
Transfer

3909 kB
Size

0
Cookies

5 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!