cf63395.tmweb.ru
Open in
urlscan Pro
2a03:6f00:6:1::b972:f7c5
Malicious Activity!
Public Scan
Effective URL: https://cf63395.tmweb.ru/-/
Submission: On November 13 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GlobalSign GCC R3 DV TLS CA 2020 on May 5th 2022. Valid for: a year.
This is the only time cf63395.tmweb.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.197 104.244.42.197 | 13414 (TWITTER) (TWITTER) | |
4 | 2a00:1450:400... 2a00:1450:4001:830::2001 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:809::2009 | 15169 (GOOGLE) (GOOGLE) | |
6 | 2a03:6f00:6:1... 2a03:6f00:6:1::b972:f7c5 | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
1 | 195.53.82.136 195.53.82.136 | 57117 (RSI) (RSI) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:5514 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:67c:4e8:... 2001:67c:4e8:f004::9 | 62041 (TELEGRAM) (TELEGRAM) | |
22 | 10 |
ASN15169 (GOOGLE, US)
ruapiru.blogspot.com | |
blogger.googleusercontent.com |
ASN15169 (GOOGLE, US)
www.gstatic.com | |
fonts.gstatic.com |
ASN15169 (GOOGLE, US)
resources.blogblog.com | |
www.blogger.com |
ASN57117 (RSI, ES)
PTR: 136.red-195-53-82.customer.static.ccgg.telefonica.net
www.ruralvia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
tmweb.ru
cf63395.tmweb.ru |
77 KB |
3 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
36 KB |
3 |
blogspot.com
ruapiru.blogspot.com |
19 KB |
2 |
blogger.com
www.blogger.com — Cisco Umbrella Rank: 8797 |
156 KB |
1 |
telegram.org
api.telegram.org — Cisco Umbrella Rank: 47553 |
|
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 201 |
11 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 374 |
16 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 304 |
31 KB |
1 |
ruralvia.com
www.ruralvia.com |
12 KB |
1 |
blogblog.com
resources.blogblog.com — Cisco Umbrella Rank: 16283 |
46 KB |
1 |
googleusercontent.com
blogger.googleusercontent.com — Cisco Umbrella Rank: 14288 |
61 KB |
1 |
t.co
t.co — Cisco Umbrella Rank: 475 |
548 B |
22 | 12 |
Domain | Requested by | |
---|---|---|
6 | cf63395.tmweb.ru |
cf63395.tmweb.ru
|
3 | ruapiru.blogspot.com |
t.co
ruapiru.blogspot.com |
2 | www.blogger.com |
ruapiru.blogspot.com
|
2 | fonts.gstatic.com |
ruapiru.blogspot.com
|
1 | api.telegram.org |
cf63395.tmweb.ru
|
1 | cdnjs.cloudflare.com |
cf63395.tmweb.ru
|
1 | cdn.jsdelivr.net |
cf63395.tmweb.ru
|
1 | ajax.googleapis.com |
cf63395.tmweb.ru
|
1 | www.ruralvia.com |
cf63395.tmweb.ru
|
1 | resources.blogblog.com |
ruapiru.blogspot.com
|
1 | blogger.googleusercontent.com |
ruapiru.blogspot.com
|
1 | www.gstatic.com |
ruapiru.blogspot.com
|
1 | t.co | |
22 | 13 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-03-07 - 2023-03-06 |
a year | crt.sh |
misc-sni.blogspot.com GTS CA 1C3 |
2022-10-25 - 2023-01-17 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-10-25 - 2023-01-17 |
3 months | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2022-10-25 - 2023-01-17 |
3 months | crt.sh |
*.blogger.com GTS CA 1C3 |
2022-10-25 - 2023-01-17 |
3 months | crt.sh |
*.tmweb.ru GlobalSign GCC R3 DV TLS CA 2020 |
2022-05-05 - 2023-06-06 |
a year | crt.sh |
www.ruralvia.com DigiCert SHA2 Extended Validation Server CA |
2022-02-01 - 2023-02-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-10-25 - 2023-01-17 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
api.telegram.org Go Daddy Secure Certificate Authority - G2 |
2022-03-24 - 2023-04-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://cf63395.tmweb.ru/-/
Frame ID: 0B573ECB479129E6E8F13BC900E659D0
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
Acceso Clientes - ruralviaPage URL History Show full URLs
- https://t.co/KRTHDd8Rfn Page URL
- https://ruapiru.blogspot.com/ Page URL
- https://cf63395.tmweb.ru/-/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Clipboard.js (Miscellaneous) Expand
Detected patterns
- clipboard(?:-([\d.]+))?(?:\.min)?\.js
SweetAlert (JavaScript Libraries) Expand
Detected patterns
- sweet(?:-)?alert(?:\.min)?\.js
SweetAlert2 (JavaScript Libraries) Expand
Detected patterns
- sweetalert2(?:\.all)?(?:\.min)?\.js
- /npm/sweetalert2@([\d.]+)
- sweetalert2@([\d.]+)/dist/sweetalert2(?:\.all)(?:\.min)\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/KRTHDd8Rfn Page URL
- https://ruapiru.blogspot.com/ Page URL
- https://cf63395.tmweb.ru/-/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
KRTHDd8Rfn
t.co/ |
242 B 548 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ruapiru.blogspot.com/ |
65 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clipboard.min.js
www.gstatic.com/external_hosted/clipboardjs/ |
12 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sprite_v1_6.css.svg
ruapiru.blogspot.com/responsive/ |
7 KB 3 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RURAL%20(4)%20(2).png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6jPd9Ge_qQ58-Je4NEehurczzPIFzYLjdxl14YBOISn7RkU-7j70W8rZr9CDzwnUoFP4SGyOsRHOSa-vMyNLmfXJPSUxUD08tnvsZaLtlWOe1PEpBjHtiCF5EGglzhDLzsZwBZHc1mARbdsRR... |
61 KB 61 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3026064950-strm_compiled.js
resources.blogblog.com/blogblog/data/res/ |
133 KB 46 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookienotice.js
ruapiru.blogspot.com/js/ |
6 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1456298461-widgets.js
www.blogger.com/static/v1/widgets/ |
153 KB 154 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
blogger_logo_round_35.png
www.blogger.com/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
cf63395.tmweb.ru/-/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cf63395.tmweb.ru/-/assets/dist/css/ |
159 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spinner.css
cf63395.tmweb.ru/-/assets/css/ |
791 B 969 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ruralvia-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
section1.png
cf63395.tmweb.ru/-/assets/section/ |
24 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
section3.png
cf63395.tmweb.ru/-/assets/section/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2.all.min.js
cdn.jsdelivr.net/npm/sweetalert2@7.26.11/dist/ |
60 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert.min.js
cdnjs.cloudflare.com/ajax/libs/sweetalert/2.1.2/ |
40 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sendMessage
api.telegram.org/bot5452902033:AAH4Yk3Brz5V4nEfugeSPc1SHCFbxUI9ce0/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log.js
cf63395.tmweb.ru/-/common/ |
1 KB 692 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal function| setImmediate function| clearImmediate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: 0881ae36-4f2c-4b18-a165-53bb1fe30d40 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.telegram.org
blogger.googleusercontent.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
cf63395.tmweb.ru
fonts.gstatic.com
resources.blogblog.com
ruapiru.blogspot.com
t.co
www.blogger.com
www.gstatic.com
www.ruralvia.com
104.244.42.197
195.53.82.136
2001:67c:4e8:f004::9
2606:4700::6810:5514
2606:4700::6811:180e
2a00:1450:4001:806::200a
2a00:1450:4001:809::2009
2a00:1450:4001:828::2003
2a00:1450:4001:830::2001
2a03:6f00:6:1::b972:f7c5
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
183923f8c8c3960dce8ad9722cf55a30d19b321b721741bd9e2ab6ae1f1ae72a
2054faf50499ca91028da280b40dedd7ed5c4b5b23526cdda192158434f640fc
29b8575294e161881afbe45e8e4309ca4dbe9b9d025cbb0aa8ae5c64db3acdec
2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b
3bcb6955d20ca5926886e93bfd1485682d57ffa645acf4ffd1fa1f986fcd8aef
6965c967fe2474e34f024a08618c84e9f995c3482a3c46e793b9eca4b00d82e2
73d16aca9b019e42dd2de3a10e5049b5606268ce0d8e3a167b05b37acb9b0e9c
7dbcd0f140ab2db5b4ae873feb974f8e426e6fc5d64dbe38631bace9667ca0cf
92e40dc4bbb485a182b796c58e6da7974cb8a6a84fdb4548ace3b85c991f0f94
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b0071cd7ccef32768966b353e2ff09d13e07ab31148944e5545803232c2341e9
c61177136e513fc062685296e7f28a9e82b1f413fc36f0c2c3d062833e08b79e
d450baef5c24c00f5336e80f465c303164d81f63c3fb4a29801a4886e095a4c6
db9d600921c6308657392026f431b5a8f31780b2f8582db38752754d2ad91762
e2099738a1c67f84e3b40831880460dee48df4dfce322d360e911779a8d699ce
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea79a3170a948d6370b76ec0640c63bd52051b1110bba34742fdb0a3e32a0c69
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d