grupocajaruralaccesocliento.kiwibanknz.com
Open in
urlscan Pro
203.170.84.122
Malicious Activity!
Public Scan
Effective URL: https://grupocajaruralaccesocliento.kiwibanknz.com/client/login.php
Submission: On April 10 via manual from ES — Scanned from AU
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 27th 2023. Valid for: 3 months.
This is the only time grupocajaruralaccesocliento.kiwibanknz.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 13 | 203.170.84.122 203.170.84.122 | 38719 (DREAMSCAP...) (DREAMSCAPE-AS-AP Dreamscape Networks Limited) | |
1 | 195.53.82.136 195.53.82.136 | 57117 (RSI) (RSI) | |
1 | 64.233.170.95 64.233.170.95 | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 142.251.12.97 142.251.12.97 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.253.118.94 172.253.118.94 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 74.125.24.156 74.125.24.156 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 142.251.12.103 142.251.12.103 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.251.10.94 142.251.10.94 | 15169 (GOOGLE) (GOOGLE) | |
18 | 7 |
ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: ipcbaa547a.ipv4.syd02.ds.network
grupocajaruralaccesocliento.kiwibanknz.com |
ASN57117 (RSI, ES)
PTR: 136.red-195-53-82.customer.static.ccgg.telefonica.net
www.ruralvia.com |
ASN15169 (GOOGLE, US)
PTR: se-in-f97.1e100.net
ssl.google-analytics.com |
ASN15169 (GOOGLE, US)
PTR: sf-in-f156.1e100.net
stats.g.doubleclick.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
kiwibanknz.com
1 redirects
grupocajaruralaccesocliento.kiwibanknz.com |
245 KB |
2 |
google-analytics.com
www.google-analytics.com Failed ssl.google-analytics.com — Cisco Umbrella Rank: 428 |
17 KB |
1 |
google.com.au
www.google.com.au — Cisco Umbrella Rank: 22017 |
408 B |
1 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 2 |
487 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net — Cisco Umbrella Rank: 100 |
379 B |
1 |
gstatic.com
fonts.gstatic.com |
44 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 47 |
1 KB |
1 |
ruralvia.com
www.ruralvia.com |
2 KB |
18 | 8 |
Domain | Requested by | |
---|---|---|
13 | grupocajaruralaccesocliento.kiwibanknz.com |
1 redirects
grupocajaruralaccesocliento.kiwibanknz.com
|
2 | ssl.google-analytics.com |
1 redirects
grupocajaruralaccesocliento.kiwibanknz.com
|
1 | www.google.com.au |
grupocajaruralaccesocliento.kiwibanknz.com
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
grupocajaruralaccesocliento.kiwibanknz.com
|
1 | www.ruralvia.com |
grupocajaruralaccesocliento.kiwibanknz.com
|
0 | www.google-analytics.com Failed |
grupocajaruralaccesocliento.kiwibanknz.com
|
18 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
grupocajaruralaccesocliento.kiwibanknz.com cPanel, Inc. Certification Authority |
2023-03-27 - 2023-06-25 |
3 months | crt.sh |
www.ruralvia.com DigiCert SHA2 Secure Server CA |
2023-02-01 - 2024-01-31 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-03-20 - 2023-06-12 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-03-20 - 2023-06-12 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-03-20 - 2023-06-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://grupocajaruralaccesocliento.kiwibanknz.com/client/login.php
Frame ID: DECF347486E5A77879A3BEAA6D955E20
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
Caja RuralPage URL History Show full URLs
-
https://grupocajaruralaccesocliento.kiwibanknz.com/
HTTP 302
https://grupocajaruralaccesocliento.kiwibanknz.com/client/login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://grupocajaruralaccesocliento.kiwibanknz.com/
HTTP 302
https://grupocajaruralaccesocliento.kiwibanknz.com/client/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 16- https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=2070926303&utmhn=grupocajaruralaccesocliento.kiwibanknz.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caja%20Rural&utmhid=1051472201&utmr=-&utmp=%2Fclient%2Flogin.php&utmht=1681128468161&utmac=UA-12835961-1&utmcc=__utma%3D59715451.1322670405.1681128468.1681128468.1681128468.1%3B%2B__utmz%3D59715451.1681128468.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=902941335&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-12835961-1&cid=1322670405.1681128468&jid=902941335&_v=5.7.2&z=2070926303 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=1322670405.1681128468&jid=902941335&_v=5.7.2&z=2070926303 HTTP 302
- https://www.google.com.au/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=1322670405.1681128468&jid=902941335&_v=5.7.2&z=2070926303&slf_rd=1&random=4161313263
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
grupocajaruralaccesocliento.kiwibanknz.com/client/ Redirect Chain
|
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rviaLogin.css
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
17 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
info_psd2.svg
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
47 KB 47 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telefono.jpg
www.ruralvia.com/accesos_cms/es/contenido_tres_archivos/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
56 KB 56 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jq.js
grupocajaruralaccesocliento.kiwibanknz.com/client/res/cdns/ |
287 KB 112 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ga.js
www.google-analytics.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
16 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
ssl.google-analytics.com/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-ruralvia-mantenimiento.svg
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eye-view-mantenimiento.svg
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-mantenimiento.svg
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
964 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-info.svg
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
683 B 798 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ico-warning-mantenimiento.svg
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aviso.svg
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
contacto.svg
grupocajaruralaccesocliento.kiwibanknz.com/client/res/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.com.au/ads/ Redirect Chain
|
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.google-analytics.com
- URL
- http://www.google-analytics.com/ga.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| _gaq function| regeneracionClave function| validaAcceso undefined| iPass undefined| iNif function| changeNifVisibility function| changePassVisibility function| $ function| jQuery function| sendLogin object| _gat object| gaGlobal6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
grupocajaruralaccesocliento.kiwibanknz.com/ | Name: PHPSESSID Value: 1d626f35ce360e897ce61bffac0b549d |
|
.grupocajaruralaccesocliento.kiwibanknz.com/ | Name: __utma Value: 59715451.1322670405.1681128468.1681128468.1681128468.1 |
|
.grupocajaruralaccesocliento.kiwibanknz.com/ | Name: __utmc Value: 59715451 |
|
.grupocajaruralaccesocliento.kiwibanknz.com/ | Name: __utmz Value: 59715451.1681128468.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.grupocajaruralaccesocliento.kiwibanknz.com/ | Name: __utmt Value: 1 |
|
.grupocajaruralaccesocliento.kiwibanknz.com/ | Name: __utmb Value: 59715451.1.10.1681128468 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
grupocajaruralaccesocliento.kiwibanknz.com
ssl.google-analytics.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.com.au
www.ruralvia.com
www.google-analytics.com
142.251.10.94
142.251.12.103
142.251.12.97
172.253.118.94
195.53.82.136
203.170.84.122
64.233.170.95
74.125.24.156
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
246c037026a7a16b204b4688fbcf320b35d95b17423082d9cee36b312a0c368b
509805421bb51434ceb54f81e2210cff4968a8c4140587cc70264e15d45e6696
5819e059aaa02db4ba199f883386b688eaaf1c71c50666d881947b618ae2c8b6
7945d38f7854f4302e0e2914b064a5392a0b16ca617a0e70599a229b73ef058b
804059be177f745bf8b6ab1aa52106fd39c772da4df5067817cfae8a29cfeab0
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
923e03262d1069a5e8a5071a04359e6e356756d5116c4ed3a496861095c894da
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
a7437ba825edd317914a9d7e90bf9425dd7e90e8a56dee13fe2e1b2ac394927f
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b7f5a8431ee4a984e1590927d7c1069ca86cf4852074c26846e1a8b21a49c95c
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e6356f8b5072cd803d7dbd4fd05fa6e1a9fbc7b37847c91869a363f8947bb86e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efd58aa5b4452397c0cfcf811359ec8eb80ccab3b8a0b31ec2a681e0e3afd6ab
f143f88d3952e78a275a6bbe19574c90508dc1e74c10e0b51ed8f0f9f9bb34c4