cuenta-accesso-b91551.ingress-earth.ewp.live
Open in
urlscan Pro
63.250.43.129
Malicious Activity!
Public Scan
Effective URL: https://cuenta-accesso-b91551.ingress-earth.ewp.live/wp-admin/network/Client/esp/Rvia/
Submission: On August 27 via manual from ES — Scanned from ES
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 24th 2022. Valid for: a year.
This is the only time cuenta-accesso-b91551.ingress-earth.ewp.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.226.132.161 35.226.132.161 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 1 | 35.241.186.140 35.241.186.140 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 63.250.43.129 63.250.43.129 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
12 | 195.53.82.136 195.53.82.136 | 57117 (RSI) (RSI) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:828::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:400c:c06::9a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::2003 | 15169 (GOOGLE) (GOOGLE) | |
21 | 9 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 161.132.226.35.bc.googleusercontent.com
l.linklyhq.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 140.186.241.35.bc.googleusercontent.com
0xni4.mjt.lu |
ASN22612 (NAMECHEAP-NET, US)
PTR: ingress-earth.easywp.com
cuenta-accesso-b91551.ingress-earth.ewp.live |
ASN57117 (RSI, ES)
PTR: 136.red-195-53-82.customer.static.ccgg.telefonica.net
www.ruralvia.com |
ASN15169 (GOOGLE, US)
ssl.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
ruralvia.com
www.ruralvia.com |
89 KB |
2 |
google-analytics.com
ssl.google-analytics.com — Cisco Umbrella Rank: 334 |
17 KB |
1 |
google.es
www.google.es — Cisco Umbrella Rank: 20352 |
501 B |
1 |
google.com
www.google.com — Cisco Umbrella Rank: 9 |
501 B |
1 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 108 |
462 B |
1 |
gstatic.com
fonts.gstatic.com |
39 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 54 |
1 KB |
1 |
ewp.live
cuenta-accesso-b91551.ingress-earth.ewp.live |
6 KB |
1 |
mjt.lu
1 redirects
0xni4.mjt.lu |
218 B |
1 |
linklyhq.com
1 redirects
l.linklyhq.com — Cisco Umbrella Rank: 531642 |
396 B |
21 | 10 |
Domain | Requested by | |
---|---|---|
12 | www.ruralvia.com |
cuenta-accesso-b91551.ingress-earth.ewp.live
www.ruralvia.com |
2 | ssl.google-analytics.com |
cuenta-accesso-b91551.ingress-earth.ewp.live
ssl.google-analytics.com |
1 | www.google.es | |
1 | www.google.com | |
1 | stats.g.doubleclick.net |
ssl.google-analytics.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
www.ruralvia.com
|
1 | cuenta-accesso-b91551.ingress-earth.ewp.live | |
1 | 0xni4.mjt.lu | 1 redirects |
1 | l.linklyhq.com | 1 redirects |
21 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.ingress-earth.ewp.live Sectigo RSA Domain Validation Secure Server CA |
2022-05-24 - 2023-05-24 |
a year | crt.sh |
www.ruralvia.com DigiCert SHA2 Extended Validation Server CA |
2022-02-01 - 2023-02-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
*.google.es GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cuenta-accesso-b91551.ingress-earth.ewp.live/wp-admin/network/Client/esp/Rvia/
Frame ID: 3C9C798F068F4DA58106ECD2320F86DD
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
Caja RuralPage URL History Show full URLs
-
https://l.linklyhq.com/l/1RafC
HTTP 302
http://0xni4.mjt.lu/lnk/AMAAAM5CT_YAAAAAAAAAABIwuxAAAAAA00QAAAAAABl01gBjCGHwKOdLXpGyRVONSzabcr0G... HTTP 302
https://cuenta-accesso-b91551.ingress-earth.ewp.live/wp-admin/network/Client/esp/Rvia/ Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://l.linklyhq.com/l/1RafC
HTTP 302
http://0xni4.mjt.lu/lnk/AMAAAM5CT_YAAAAAAAAAABIwuxAAAAAA00QAAAAAABl01gBjCGHwKOdLXpGyRVONSzabcr0G1wAYuA8/1/TNJ5mRl0LMnBOXOtwwGepA/aHR0cHM6Ly9jdWVudGEtYWNjZXNzby1iOTE1NTEuaW5ncmVzcy1lYXJ0aC5ld3AubGl2ZS93cC1hZG1pbi9uZXR3b3JrL0NsaWVudC9lc3AvUnZpYS8 HTTP 302
https://cuenta-accesso-b91551.ingress-earth.ewp.live/wp-admin/network/Client/esp/Rvia/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
cuenta-accesso-b91551.ingress-earth.ewp.live/wp-admin/network/Client/esp/Rvia/ Redirect Chain
|
20 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rviaLogin.css
www.ruralvia.com/estilos_prtl/css_acceso/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
checkUsuPass.js
www.ruralvia.com/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
acceso.js
www.ruralvia.com/javascripts_portal/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
keyboard.js
www.ruralvia.com/javascripts_portal/es_ES/js_portal/ |
24 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info_psd2.svg
www.ruralvia.com/accesos_cms/es/contenido_dos_archivos/ |
47 KB 47 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telefono.jpg
www.ruralvia.com/accesos_cms/es/contenido_tres_archivos/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
16 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
ssl.google-analytics.com/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ruralvia-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye-view-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
964 B 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
fonts.gstatic.com/s/opensans/v34/ |
38 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-info.svg
www.ruralvia.com/estilos_prtl/css/html5/css/images/icons/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico-warning-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aviso.svg
www.ruralvia.com/estilos_prtl/css_acceso/images/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
contacto.svg
www.ruralvia.com/estilos_prtl/css_acceso/images/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
__utm.gif
ssl.google-analytics.com/j/ |
2 B 227 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
4 B 462 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.com/ads/ |
42 B 501 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.es/ads/ |
42 B 501 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.ruralvia.com
- URL
- https://www.ruralvia.com/estilos_prtl/css/html5/css/images/icons/icon-info.svg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)92 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| iAlphanumeric string| iAlphanumericVB string| iDocument string| iAlphanumericOrEmail boolean| defaultEmptyOK string| whitespace function| isLetter function| isAsciiCharPermited function| isDigit function| isLetterOrDigit function| isEmpty function| isAlphanumericVB function| isAlphanumeric function| isEmail function| checkAlphanumeric function| checkAlphanumericVB function| warnInvalid function| isWhitespace function| checkDocumento function| showError function| comprobarAcceso undefined| win2 string| CODAPP number| longCadena string| entidad object| filtro function| sanitize function| VKI_attach function| VKI_close function| VKI_buildKeyboardInputs function| VKI_findPos function| VKI_innerDimensions function| VKI_scrollDist function| VKI_getStyle function| VKI_disableSelection function| Conectando function| ConectandoIur number| pulsada object| fActual function| volverTemporizado number| timerPPub function| mandar function| mandarIur function| posicion function| pulsarTecla boolean| ie4tecla object| _gaq function| regeneracionClave function| validaAcceso undefined| iPass undefined| iNif function| changeNifVisibility function| changePassVisibility object| _gat object| gaGlobal boolean| VKI_visible boolean| VKI_target boolean| VKI_dead boolean| VKI_capslock boolean| VKI_shift boolean| VKI_deadkeysOn string| VKI_kt boolean| VKI_clearPasswords string| VKI_imageURI boolean| VKI_clickless number| VKI_clicklessDelay number| VKI_keyCenter boolean| VKI_isIE boolean| VKI_isIE6 boolean| VKI_isIElt8 boolean| VKI_isIE9 boolean| VKI_isIE10 boolean| VKI_isMoz boolean| VKI_isWebKit object| VKI_layout object| VKI_layoutDDK object| VKI_deadkey function| VKI_attachKeyboard object| VKI_keyboard function| VKI_buildKeys function| VKI_modify function| VKI_insert function| VKI_show_focus function| VKI_position5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.cuenta-accesso-b91551.ingress-earth.ewp.live/ | Name: __utma Value: 253136667.577797616.1661611188.1661611188.1661611188.1 |
|
.cuenta-accesso-b91551.ingress-earth.ewp.live/ | Name: __utmc Value: 253136667 |
|
.cuenta-accesso-b91551.ingress-earth.ewp.live/ | Name: __utmz Value: 253136667.1661611188.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.cuenta-accesso-b91551.ingress-earth.ewp.live/ | Name: __utmt Value: 1 |
|
.cuenta-accesso-b91551.ingress-earth.ewp.live/ | Name: __utmb Value: 253136667.1.10.1661611188 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=15768000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
0xni4.mjt.lu
cuenta-accesso-b91551.ingress-earth.ewp.live
fonts.googleapis.com
fonts.gstatic.com
l.linklyhq.com
ssl.google-analytics.com
stats.g.doubleclick.net
www.google.com
www.google.es
www.ruralvia.com
www.ruralvia.com
195.53.82.136
2a00:1450:4001:809::2003
2a00:1450:4001:812::200a
2a00:1450:4001:828::2008
2a00:1450:4001:829::2003
2a00:1450:4001:829::2004
2a00:1450:400c:c06::9a
35.226.132.161
35.241.186.140
63.250.43.129
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
36ec8a2c1c3a936316b64f686261db7eb0d1bc301f1d779cd844db268a933978
3aa4c7972f9b400d68eba8aaa350840ce00a14d8678612d8bbeea7266b8dc99f
509805421bb51434ceb54f81e2210cff4968a8c4140587cc70264e15d45e6696
5819e059aaa02db4ba199f883386b688eaaf1c71c50666d881947b618ae2c8b6
5dcfcba5605a3d22a34cc3f99054c035836d410bc90f1936b9af0e279882dfea
69951dde4b5dbc60793065b821ab8c9e8cfa50df2ee950fae653e611e8fdf81b
7945d38f7854f4302e0e2914b064a5392a0b16ca617a0e70599a229b73ef058b
804059be177f745bf8b6ab1aa52106fd39c772da4df5067817cfae8a29cfeab0
92b0c012b34ea951e730d0452dce78cf13aa209c90279035f0600af911227126
94dcf5556e059d9e35d347a9fdd7c295ec5d8001d8c00693dfc2a7d18f9fb0f3
9a372731395507366ae8a382f8655bb09ca8b25d67fe7dcea44a810270fe00a3
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b7f5a8431ee4a984e1590927d7c1069ca86cf4852074c26846e1a8b21a49c95c
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e6356f8b5072cd803d7dbd4fd05fa6e1a9fbc7b37847c91869a363f8947bb86e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7a66367f41d107004fde2b2c46083eef1946e3cbae11892e5d152bd262437b7
fbeb296c1ecc216a17bda77bf65e833cc0410cfbe1908e121f7a4549cc390675