cielotravels.com
Open in
urlscan Pro
192.185.190.187
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On July 18 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 12th 2023. Valid for: 3 months.
This is the only time cielotravels.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Butterfield Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 192.185.190.187 192.185.190.187 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
4 | 192.29.61.251 192.29.61.251 | 31898 (ORACLE-BM...) (ORACLE-BMC-31898) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 104.40.217.175 104.40.217.175 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::2003 | 15169 (GOOGLE) (GOOGLE) | |
10 | 6 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 192-185-190-187.unifiedlayer.com
cielotravels.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
hit.uptrendsdata.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
butterfieldonline.com
bm.butterfieldonline.com — Cisco Umbrella Rank: 470802 |
468 KB |
2 |
uptrendsdata.com
hit.uptrendsdata.com — Cisco Umbrella Rank: 45604 |
18 KB |
1 |
gstatic.com
fonts.gstatic.com |
16 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 88 |
1 KB |
1 |
cielotravels.com
cielotravels.com |
33 KB |
0 |
fontawesome.com
Failed
kit.fontawesome.com Failed |
|
10 | 6 |
Domain | Requested by | |
---|---|---|
4 | bm.butterfieldonline.com |
cielotravels.com
|
2 | hit.uptrendsdata.com |
cielotravels.com
hit.uptrendsdata.com |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
cielotravels.com
|
1 | cielotravels.com | |
0 | kit.fontawesome.com Failed |
cielotravels.com
|
10 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cielotravels.com R3 |
2023-06-12 - 2023-09-10 |
3 months | crt.sh |
butterfieldonline.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-02-23 - 2024-03-25 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-07-03 - 2023-09-25 |
3 months | crt.sh |
*.uptrendsdata.com Sectigo RSA Domain Validation Secure Server CA |
2023-03-28 - 2024-04-09 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-07-03 - 2023-09-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cielotravels.com/punc/index.php
Frame ID: DDD48B9B01AEC94617A0F28A354FA946
Requests: 10 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
cielotravels.com/punc/ |
152 KB 33 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
obdx-font.css
bm.butterfieldonline.com/framework/css/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
oj-alta-notag-min.css
bm.butterfieldonline.com/framework/js/libs/oraclejet/12.1.0/default/css/alta/ |
742 KB 74 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
a076d05399.js
kit.fontawesome.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rum.min.js
hit.uptrendsdata.com/ |
60 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new-bg-login.jpg
bm.butterfieldonline.com/images/index/icons/ |
384 KB 385 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo_white_small.png
bm.butterfieldonline.com/images/corp/common/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
hits
hit.uptrendsdata.com/api/ |
0 75 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- kit.fontawesome.com
- URL
- https://kit.fontawesome.com/a076d05399.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Butterfield Group (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend object| _urconfig object| UTBOOMR1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.hit.uptrendsdata.com/ | Name: ARRAffinitySameSite Value: 9680dc53c4ddf210a76411c38aca0aab883bfdeddb19e6eb7a32b36704d08b06 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bm.butterfieldonline.com
cielotravels.com
fonts.googleapis.com
fonts.gstatic.com
hit.uptrendsdata.com
kit.fontawesome.com
kit.fontawesome.com
104.40.217.175
192.185.190.187
192.29.61.251
2a00:1450:4001:829::200a
2a00:1450:4001:831::2003
4ad86a6074b540e35e52274495883653ad687f434ce5b721502e3ec5a8ed76b3
7dba294a392b21769d5fd88671c426d118206423c7e9f984945ce35f4feb4363
7fc56562fdc5cd3c2713d69c9130a18ffeaa9a766953c14ab529aa854bb069f8
b92c9f60921e9a653eda7c4a282432f93515efdcf69a1a99a3ff8a8e804729a1
c0d4661237cd5bc1f51f33f866f94ec90aadcf95c42ebac3528dcf75efc6c954
c306ba9cf9fb4c4bc037ce345f175503bfa0431fa5eb688212278af2126b2740
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40dbc6da95b47d932014e5a93f35b13a341a37ea6fe7559dca041dc77271cd6
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615