revo-up.cloudns.be
Open in
urlscan Pro
209.141.47.4
Malicious Activity!
Public Scan
Effective URL: https://revo-up.cloudns.be/CAlXA/43829/index.php
Submission: On June 14 via api from US — Scanned from PT
Summary
TLS certificate: Issued by R11 on June 13th 2024. Valid for: 3 months.
This is the only time revo-up.cloudns.be was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Caixa Geral de Depósitos (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 93.184.221.165 93.184.221.165 | 15133 (EDGECAST) (EDGECAST) | |
1 18 | 209.141.47.4 209.141.47.4 | 53667 (PONYNET) (PONYNET) | |
1 | 142.250.186.106 142.250.186.106 | 15169 (GOOGLE) (GOOGLE) | |
1 | 195.234.134.176 195.234.134.176 | 25253 (CGDNET) (CGDNET) | |
3 | 185.42.168.133 185.42.168.133 | 62248 (MODIRUM) (MODIRUM) | |
24 | 6 |
ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f10.1e100.net
ajax.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
cloudns.be
1 redirects
revo-up.cloudns.be |
34 KB |
3 |
3dsecure.no
enroll.3dsecure.no |
21 KB |
1 |
cgd.pt
static.cgd.pt — Cisco Umbrella Rank: 384561 |
5 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 457 |
51 KB |
1 |
t.co
t.co — Cisco Umbrella Rank: 711 |
554 B |
24 | 5 |
Domain | Requested by | |
---|---|---|
18 | revo-up.cloudns.be |
1 redirects
t.co
revo-up.cloudns.be |
3 | enroll.3dsecure.no |
revo-up.cloudns.be
|
1 | static.cgd.pt |
revo-up.cloudns.be
|
1 | ajax.googleapis.com |
revo-up.cloudns.be
|
1 | t.co | |
24 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-05-08 - 2025-05-07 |
a year | crt.sh |
revo-up.cloudns.be R11 |
2024-06-13 - 2024-09-11 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-05-27 - 2024-08-19 |
3 months | crt.sh |
static.cgd.pt DigiCert EV RSA CA G2 |
2024-05-29 - 2025-06-29 |
a year | crt.sh |
acs.3dsecure.no GlobalSign GCC R3 DV TLS CA 2020 |
2024-03-05 - 2025-04-06 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://revo-up.cloudns.be/CAlXA/43829/index.php
Frame ID: 456145E95EB539C9255AC3D36459BDE6
Requests: 22 HTTP requests in this frame
Frame:
https://revo-up.cloudns.be/CAlXA/43829/files/saved_resource.html
Frame ID: B938678C6CD1C6D880C4A59BD7CB81F9
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Caixadirecta | Transação suspeita detectadaPage URL History Show full URLs
- https://t.co/kF0JCIQTAI Page URL
-
https://revo-up.cloudns.be/CAlXA/
HTTP 302
https://revo-up.cloudns.be/CAlXA/43829/index.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
RequireJS (JavaScript Frameworks) Expand
Detected patterns
- require.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)/jquery-ui(?:\.min)?\.js
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/kF0JCIQTAI Page URL
-
https://revo-up.cloudns.be/CAlXA/
HTTP 302
https://revo-up.cloudns.be/CAlXA/43829/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
kF0JCIQTAI
t.co/ |
255 B 554 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.php
revo-up.cloudns.be/CAlXA/43829/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
ajax.googleapis.com/ajax/libs/jqueryui/1.8.18/ |
197 KB 51 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0813f1a0eaab1800793f0b925fb73f97513d0ccb5a8081deadef7bc9b5f4a76d.js.download
revo-up.cloudns.be/CAlXA/43829/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular-busy.css
revo-up.cloudns.be/CAlXA/43829/files/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
revo-up.cloudns.be/CAlXA/43829/files/ |
156 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.css
revo-up.cloudns.be/CAlXA/43829/files/ |
33 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular-csp.css
revo-up.cloudns.be/CAlXA/43829/files/ |
309 B 404 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_CDO.gif
static.cgd.pt/staticCMS/cdo/global/img/ |
4 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.svg
enroll.3dsecure.no/nets-nemid-enroller/templates/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.svg
enroll.3dsecure.no/nets-nemid-enroller/templates/images/ |
10 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
require.js.download
revo-up.cloudns.be/CAlXA/43829/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-04.js.download
revo-up.cloudns.be/CAlXA/43829/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.7.2/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-george.svg
revo-up.cloudns.be/CAlXA/43829/img/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EnrollmentBanner.jpg
enroll.3dsecure.no/nets-nemid-enroller/templates/images/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SLSPlogo.svg
revo-up.cloudns.be/CAlXA/43829/img/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Inter-Regular.woff2
revo-up.cloudns.be/CAlXA/43829/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Inter-Bold.woff2
revo-up.cloudns.be/CAlXA/43829/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
saved_resource.html
revo-up.cloudns.be/CAlXA/43829/files/ Frame B938 |
808 B 501 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Inter-Bold.woff
revo-up.cloudns.be/CAlXA/43829/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Inter-Regular.woff
revo-up.cloudns.be/CAlXA/43829/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
revo-up.cloudns.be/error_docs/ Frame B938 |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
revo-up.cloudns.be/ |
808 B 501 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ajax.googleapis.com
- URL
- http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Caixa Geral de Depósitos (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 undefined| event object| fence object| sharedStorage2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: d397453c-428c-4d31-acdf-892bcaca2745 |
|
revo-up.cloudns.be/ | Name: PHPSESSID Value: jurpmjg8fmj8ej7j1bhdrk6jri |
12 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
enroll.3dsecure.no
revo-up.cloudns.be
static.cgd.pt
t.co
ajax.googleapis.com
142.250.186.106
185.42.168.133
195.234.134.176
209.141.47.4
93.184.221.165
15de3acd388cf461e6bdf505c13c6a8640d39b9e045605d053c52d1a7bffc09e
174b3bb7c4416bd675d599afc18ee42cfb8ee6960eaec96f1bb1c65e7c5185a6
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
6b93df5613a6b28fa3aaa6a34a9d05cdfe7382fd09f52c38b3a29a936edb786c
75f8e59348fcfa31aff82978288a064c4c75e59e665bf811ca499d99cbdbf7bb
8d8b155eca5614e7057ddfac9055b23655c31d84c12068d67900872f20f7c27a
b678b9ce232788f2d61250467886495d763c1ddf7c0da0bede71a576cb60cf5b
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
d835d1c4ec054f6f610e6776f42428f256b703f038ffe85b1e98d02659411196
dfcb7f7daf6fb12a508e661c5c1ffed9160c6ff58113fabf0d8588fe6d3e4384
e4bf411611a715a5752d6e80345cd5fa56731a8ff96e54e5212024337a1c6984
e5a37fb4377aa61107c7be4b6465bca44b4460acf182115560169dc9c8aa9211