www.bradbevill.com Open in urlscan Pro
148.72.31.236 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://safetylocksmithservice.com/nad/
Effective URL:
https://www.bradbevill.com/doc/caixa/particular/login.php
Submission: On June 20 via manual (June 20th 2022, 3:15:23 pm UTC) from ES — Scanned from ES

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 13 HTTP transactions. The main IP is 148.72.31.236, located in Ashburn, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is www.bradbevill.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on February 3rd 2022. Valid for: a year.

This is the only time www.bradbevill.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Caixabank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	107.180.44.148 107.180.44.148	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1 8	148.72.31.236 148.72.31.236	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	5

1 107.180.44.148 (Ashburn, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-44-148.ip.secureserver.net

safetylocksmithservice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 148.72.31.236 (Ashburn, United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-148-72-31-236.ip.secureserver.net

www.bradbevill.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	bradbevill.com 1 redirects www.bradbevill.com	1 MB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 246	25 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 793	32 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 329	31 KB
1	safetylocksmithservice.com safetylocksmithservice.com	559 B
13	5

	Domain	Requested by
8	www.bradbevill.com	1 redirects safetylocksmithservice.com www.bradbevill.com
2	cdnjs.cloudflare.com	www.bradbevill.com cdnjs.cloudflare.com
2	maxcdn.bootstrapcdn.com	www.bradbevill.com
1	ajax.googleapis.com	www.bradbevill.com
1	safetylocksmithservice.com
13	5

This site contains no links.

Subject Issuer	Validity	Valid
safetylocksmithservice.com cPanel, Inc. Certification Authority	`2022-04-06` - `2022-07-05`	3 months	crt.sh
bradbevill.com Go Daddy Secure Certificate Authority - G2	`2022-02-03` - `2023-03-07`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-30` - `2022-08-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.bradbevill.com/doc/caixa/particular/login.php
Frame ID: 957DB6647EDADD886FAD7B41E9E52712
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log In

Page URL History Show full URLs

https://safetylocksmithservice.com/nad/ Page URL
https://www.bradbevill.com/doc/caixa/ HTTP 302
https://www.bradbevill.com/doc/caixa/particular/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

1165 kB
Transfer

2020 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://safetylocksmithservice.com/nad/ Page URL
https://www.bradbevill.com/doc/caixa/ HTTP 302
https://www.bradbevill.com/doc/caixa/particular/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
safetylocksmithservice.com/nad/ 1 KB
559 B 916ms
136ms Document
text/html 107.180.44.148
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://safetylocksmithservice.com/nad/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.180.44.148 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-107-180-44-148.ip.secureserver.net
Software: Apache /
Resource Hash: 2a8e2d12b99fd773de84414d8c2d32dfeb591bc5c7c11d2ee2fca4bcd9499d68

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

accept-ranges: bytes
content-encoding: br
content-length: 419
content-type: text/html
date: Mon, 20 Jun 2022 15:15:18 GMT
etag: "3ee05b1-4c8-5e1e136a18700-br"
last-modified: Mon, 20 Jun 2022 13:38:04 GMT
server: Apache
vary: Accept-Encoding

GET
H2

200

Primary Request login.php Show response
www.bradbevill.com/doc/caixa/particular/
Redirect Chain

https://www.bradbevill.com/doc/caixa/
https://www.bradbevill.com/doc/caixa/particular/login.php

5 KB
2 KB

464ms
464ms

Document
text/html

148.72.31.236
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bradbevill.com/doc/caixa/particular/login.php
Requested by: Host: safetylocksmithservice.com
URL: https://safetylocksmithservice.com/nad/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.72.31.236 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-148-72-31-236.ip.secureserver.net
Software: Apache / PHP/7.0.33
Resource Hash: 36412ea33dfa11322f3efe6312c2daa4a838928185ea634446bbb940e04ef6f3

Request headers

Referer: https://safetylocksmithservice.com/nad/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 1621
content-type: text/html; charset=UTF-8
date: Mon, 20 Jun 2022 15:15:19 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/7.0.33

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 8
content-type: text/html; charset=UTF-8
date: Mon, 20 Jun 2022 15:15:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: particular/login.php
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/7.0.33

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/ 119 KB
20 KB 128ms
60ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css

Requested by

Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 617, 617
age: 5047615
cdn-cachedat: 2021-04-22 20:59:39
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: a996236f35a2cd5b2eb25f56f7365bcd
cf-ray: 71e575947a9cd689-MAD
cdn-requestcountrycode: ES
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 186ms
59ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 673
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 20 Jun 2023 15:04:07 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/ 39 KB
12 KB 116ms
48ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js

Requested by

Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 602, 617, 617
age: 24218406
cdn-cachedat: 2021-06-08 20:48:53
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 9fdab06a1e46b6f8a66de8901e0b24af
cf-ray: 71e575947a9fd689-MAD
cdn-requestcountrycode: ES
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/ 57 KB
11 KB 110ms
42ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css

Requested by

Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 913012
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10301
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-e4d2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RkuHZFbusJGFG0AdXqs2ju0u0FtQ1GAKGOhVHqwlMGI4x91NyV10hu3AnXpBPAga6oRupHtHwsCy9BGYwR4B%2FYLO2HjhuI1VBaegbLoa%2Fwt7kRHg4wt2JchJSYwzI5TP1CPXpTfZv%2BCeDK8fvo%2FaJvL%2B"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71e575947e27d681-MAD
expires: Sat, 10 Jun 2023 15:15:20 GMT

GET
H2 200 jquery.min.js Show response
www.bradbevill.com/doc/caixa/assets/js/ 86 KB
30 KB 547ms
546ms Script
application/javascript 148.72.31.236
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bradbevill.com/doc/caixa/assets/js/jquery.min.js
Requested by: Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.72.31.236 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-148-72-31-236.ip.secureserver.net
Software: Apache /
Resource Hash: 2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/doc/caixa/particular/login.php
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
content-encoding: br
last-modified: Wed, 11 Sep 2019 19:52:54 GMT
server: Apache
etag: "3032ba-15851-5924c5de4d180-br"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 30085

GET
H2 200 popper.min.js Show response
www.bradbevill.com/doc/caixa/assets/js/ 20 KB
7 KB 251ms
250ms Script
application/javascript 148.72.31.236
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bradbevill.com/doc/caixa/assets/js/popper.min.js
Requested by: Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.72.31.236 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-148-72-31-236.ip.secureserver.net
Software: Apache /
Resource Hash: 315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/doc/caixa/particular/login.php
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
content-encoding: br
last-modified: Sun, 25 Nov 2018 17:02:46 GMT
server: Apache
etag: "3032bd-4f74-57b802f785980-br"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 6967

GET
H2 200 bootstrap.min.js Show response
www.bradbevill.com/doc/caixa/assets/js/ 133 KB
23 KB 546ms
546ms Script
application/javascript 148.72.31.236
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bradbevill.com/doc/caixa/assets/js/bootstrap.min.js
Requested by: Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.72.31.236 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-148-72-31-236.ip.secureserver.net
Software: Apache /
Resource Hash: 2caa6404ddb0de2b9d191b1e2c8b5c35c68ca48f2a9521140bbf83b27c063700

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/doc/caixa/particular/login.php
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
content-encoding: br
last-modified: Mon, 13 Apr 2020 17:31:18 GMT
server: Apache
etag: "3032b8-21388-5a32f735fc580-br"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 23500

GET
H2 200 fontawesome.min.js
www.bradbevill.com/doc/caixa/assets/js/ 448 KB
0 1288ms
1287ms Script
application/javascript 148.72.31.236
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bradbevill.com/doc/caixa/assets/js/fontawesome.min.js
Requested by: Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.72.31.236 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-148-72-31-236.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/doc/caixa/particular/login.php
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
content-encoding: br
last-modified: Sun, 25 Nov 2018 20:03:18 GMT
server: Apache
etag: "3032b9-10314e-57b82b51b8d80-br"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 main.js Show response
www.bradbevill.com/doc/caixa/assets/js/ 2 KB
616 B 182ms
181ms Script
application/javascript 148.72.31.236
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bradbevill.com/doc/caixa/assets/js/main.js
Requested by: Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.72.31.236 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-148-72-31-236.ip.secureserver.net
Software: Apache /
Resource Hash: f460a0198dd83df619dbe5089458bb63b80f63dcdf8e7fbdf8ac648e03bdc23a

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/doc/caixa/particular/login.php
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
content-encoding: br
last-modified: Thu, 28 May 2020 04:56:16 GMT
server: Apache
etag: "3032bc-7a4-5a6ae2605fc00-br"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 491

GET
H2 200 background5.png
www.bradbevill.com/doc/caixa/particular/image/ 1010 KB
1015 KB 276ms
276ms Image
image/png 148.72.31.236
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bradbevill.com/doc/caixa/particular/image/background5.png
Requested by: Host: www.bradbevill.com
URL: https://www.bradbevill.com/doc/caixa/particular/login.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.72.31.236 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-148-72-31-236.ip.secureserver.net
Software: Apache /
Resource Hash: 4d403e36797cc0135f0a79ebd2436ad0d537125825c2ec28977e88593cd63ff8

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.bradbevill.com/doc/caixa/particular/login.php
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
last-modified: Tue, 29 Jun 2021 22:06:12 GMT
server: Apache
accept-ranges: bytes
etag: "3032e5-fc62f-5c5eed059fd00"
content-length: 1033775
content-type: image/png

GET
H3 200 fa-regular-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/ 13 KB
14 KB 74ms
39ms Font
application/octet-stream 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/fa-regular-400.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

343321b35bae9531b1d1220cf6edbf6435e610d67aede8faca2ad395063b71e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css
Origin: https://www.bradbevill.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Mon, 20 Jun 2022 15:15:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 6464210
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13584
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-3510"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qG%2BK6MzKxGRpyy%2BXY4Oz5ABCVk6btxaMucYRT7pishfxKe0cAWmxHB601mVWGpixoiPpRqsDUi0yj1hscgimQiAeKF%2BUaMZ94TfKw49CJpH5CyUG7aopsTWEA12dHy09mMcM1ucGdzqUZqN%2FUDtmErJR"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71e57595ff858684-MAD
expires: Sat, 10 Jun 2023 15:15:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Caixabank (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.bradbevill.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: gp7kl59sl9naaljn3p2ft9i296

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
safetylocksmithservice.com
www.bradbevill.com
107.180.44.148
148.72.31.236
2606:4700::6811:190e
2606:4700::6812:bcf
2a00:1450:4001:830::200a
2a8e2d12b99fd773de84414d8c2d32dfeb591bc5c7c11d2ee2fca4bcd9499d68
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
2caa6404ddb0de2b9d191b1e2c8b5c35c68ca48f2a9521140bbf83b27c063700
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
343321b35bae9531b1d1220cf6edbf6435e610d67aede8faca2ad395063b71e7
36412ea33dfa11322f3efe6312c2daa4a838928185ea634446bbb940e04ef6f3
4d403e36797cc0135f0a79ebd2436ad0d537125825c2ec28977e88593cd63ff8
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe
f460a0198dd83df619dbe5089458bb63b80f63dcdf8e7fbdf8ac648e03bdc23a
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

www.bradbevill.com Open in urlscan Pro 148.72.31.236 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

1165 kBTransfer

2020 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

www.bradbevill.com Open in urlscan Pro
148.72.31.236 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

1165 kB
Transfer

2020 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!