54.210.51.67
Open in
urlscan Pro
54.210.51.67
Malicious Activity!
Public Scan
Submission Tags: https://phish.report @phish_report Search All
Submission: On January 29 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on January 27th 2023. Valid for: 3 months.
This is the only time 54.210.51.67 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Macro (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 54.210.51.67 54.210.51.67 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:80b::2003 | 15169 (GOOGLE) (GOOGLE) | |
9 | 4 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-210-51-67.compute-1.amazonaws.com
54.210.51.67 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
gstatic.com
fonts.gstatic.com |
26 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 359 |
132 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34 |
1 KB |
9 | 3 |
Domain | Requested by | |
---|---|---|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | cdn.jsdelivr.net |
54.210.51.67
cdn.jsdelivr.net |
1 | fonts.googleapis.com |
54.210.51.67
|
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
macroningreso.online ZeroSSL RSA Domain Secure Site CA |
2023-01-27 - 2023-04-27 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-01-09 - 2023-04-03 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-01-09 - 2023-04-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://54.210.51.67/
Frame ID: 1CAD5F503E8673ACD188201B71B6CFF0
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Inicio de sesiĆ³nDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
54.210.51.67/ |
6 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/ |
93 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
15 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mkro.png
54.210.51.67/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logicon.png
54.210.51.67/imagns/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
moci.jpg
54.210.51.67/imagns/ |
463 KB 463 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
o-0IIpQlx3QUlC5A4PNr5TRA.woff2
fonts.gstatic.com/s/notosans/v27/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/fonts/ |
118 KB 119 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
o-0NIpQlx3QUlC5A4PNjXhFVZNyB.woff2
fonts.gstatic.com/s/notosans/v27/ |
12 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Macro (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange object| tpeInp object| helperUser string| displayHelper object| labelColor object| seePassword0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
2a00:1450:4001:80b::2003
2a00:1450:4001:82f::200a
2a04:4e42::485
54.210.51.67
1e26eb2549b5211e806bd4e4c70b96b8501928c815e6ece436a97077985d8f8c
7fa24fd4650ace47a2d92d30b46943851356304b2c8396145b618fdeb331b937
8484b328fc04f3cdc671c631a70b06f24aa895b1b84811cee8f5c3831adba791
88f00438d26021a325247c4427898f7c778a22976df9f1a9d9876429778bf265
8d0f1da7133db362a89c93d9895a0275687cdd2c5ccae1d5fae9525545de6116
966620f9e3bec428663687f9e8d67a6b8e35d79adebf6fb204e9b139eada7599
9cfbb1016726985e0f8d87762a9e9990df349457caf62c91226486cb5b8cc479
c1c30918a861cb6a985ab55d54ad7e861682354197f164cb3b7194f20eed67ac
e1172d3a0a208cf01dc066f0abeaf17f00264a966159a69f71947d6edcd4935f