![](/screenshots/691a6502-417c-457a-8eb8-4865db4c152c.png)
home-30h.joomla.com
Open in
urlscan Pro
2607:1b00:93b2:e42c::bef9
Malicious Activity!
Public Scan
Submission Tags: @ipnigh
Submission: On February 21 via api from GB
Summary
TLS certificate: Issued by RapidSSL RSA CA 2018 on March 21st 2019. Valid for: a year.
This is the only time home-30h.joomla.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 2607:1b00:93b... 2607:1b00:93b2:e42c::bef9 | 54456 (CLOUDACCE...) (CLOUDACCESS-NETWORK) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81e::2003 | 15169 (GOOGLE) (GOOGLE) | |
9 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
joomla.com
home-30h.joomla.com |
79 KB |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
googleapis.com
fonts.googleapis.com |
892 B |
9 | 3 |
Domain | Requested by | |
---|---|---|
7 | home-30h.joomla.com |
home-30h.joomla.com
|
1 | fonts.gstatic.com |
home-30h.joomla.com
|
1 | fonts.googleapis.com |
home-30h.joomla.com
|
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.joomla.com RapidSSL RSA CA 2018 |
2019-03-21 - 2020-03-20 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-01-29 - 2020-04-22 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://home-30h.joomla.com/includes/fac/
Frame ID: 13C865C022AE231C6548BCD784276A1C
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/691a6502-417c-457a-8eb8-4865db4c152c.png)
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
home-30h.joomla.com/includes/fac/ |
1 KB 965 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile.css
home-30h.joomla.com/includes/fac/_styles/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
10 KB 892 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
home-30h.joomla.com/includes/fac/_jscripts/ |
86 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.mask.js
home-30h.joomla.com/includes/fac/_jscripts/ |
6 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile.js
home-30h.joomla.com/includes/fac/_jscripts/ |
7 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
id_logo.png
home-30h.joomla.com/includes/fac/_images/mobile/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0046.jpg
home-30h.joomla.com/includes/fac/img/ |
31 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| check_enter function| check_passwd_net function| check_card function| check_cpf function| check_cpf_or_operador function| check_cvv function| check_portador function| check_pscc function| check_tk_app function| check_tk_ch function| check_tk_sms function| check_fone function| checkCard function| validarCPF function| remove function| proximoCampo function| ValidaConta0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
home-30h.joomla.com
2607:1b00:93b2:e42c::bef9
2a00:1450:4001:81c::200a
2a00:1450:4001:81e::2003
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
19b6386f0a79c4c729f8bad5fead289120a11ec434bbf23d0a824f122c76e666
3b775d6e0b0f5cff98aca4daaa7f27a7c3678f39d1f5186776bb14b63cc2f625
41c3cb289e33aba7c49719040c7b410a70e458f7ce4da881d620f818935ee071
607cb97344e6f65fcf2694cdf7f5a236c79498eab364dbf9e15236f267263d9b
89ac351147aec12359e5c68d4c3bb936e658fff87ce2337f04a5050fe75719c1
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
ec449b90a12df224ff679dcc26fe6a075b8bee6575b7891ea55b96c5869d828c
f60522f1f09ff5c98438dc5dd731928385f330a4f1262fdbe51d82a5a096621c