devruralsuppes-ba40e4.ingress-florina.ewp.live
Open in
urlscan Pro
63.250.43.136
Malicious Activity!
Public Scan
Effective URL: https://devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/index.html
Submission Tags: falconsandbox
Submission: On September 02 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 24th 2022. Valid for: a year.
This is the only time devruralsuppes-ba40e4.ingress-florina.ewp.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2a00:1450:400... 2a00:1450:4001:80b::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::2001 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:806::2003 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:82f::2009 | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 87.240.129.133 87.240.129.133 | 47541 (VKONTAKTE...) (VKONTAKTE-SPB-AS vk.com) | |
6 | 63.250.43.136 63.250.43.136 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 195.53.82.136 195.53.82.136 | 57117 (RSI) (RSI) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:67c:4e8:... 2001:67c:4e8:f004::9 | 62041 (TELEGRAM) (TELEGRAM) | |
22 | 12 |
ASN15169 (GOOGLE, US)
postesruraes12.blogspot.com |
ASN15169 (GOOGLE, US)
blogger.googleusercontent.com |
ASN15169 (GOOGLE, US)
resources.blogblog.com | |
www.blogger.com |
ASN47541 (VKONTAKTE-SPB-AS vk.com, RU)
PTR: srv133-129-240-87.vk.com
vk.com | |
away.vk.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: ingress-florina.easywp.com
devruralsuppes-ba40e4.ingress-florina.ewp.live |
ASN57117 (RSI, ES)
PTR: 136.red-195-53-82.customer.static.ccgg.telefonica.net
www.ruralvia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
ewp.live
devruralsuppes-ba40e4.ingress-florina.ewp.live |
79 KB |
3 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
36 KB |
3 |
blogspot.com
postesruraes12.blogspot.com |
19 KB |
2 |
vk.com
1 redirects
vk.com — Cisco Umbrella Rank: 6203 away.vk.com — Cisco Umbrella Rank: 112407 |
2 KB |
2 |
blogger.com
www.blogger.com — Cisco Umbrella Rank: 8931 |
59 KB |
1 |
telegram.org
api.telegram.org — Cisco Umbrella Rank: 45987 |
|
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 212 |
11 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 384 |
16 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 279 |
31 KB |
1 |
ruralvia.com
www.ruralvia.com |
12 KB |
1 |
blogblog.com
resources.blogblog.com — Cisco Umbrella Rank: 16499 |
134 KB |
1 |
googleusercontent.com
blogger.googleusercontent.com — Cisco Umbrella Rank: 15280 |
61 KB |
22 | 12 |
Domain | Requested by | |
---|---|---|
6 | devruralsuppes-ba40e4.ingress-florina.ewp.live |
away.vk.com
devruralsuppes-ba40e4.ingress-florina.ewp.live |
3 | postesruraes12.blogspot.com |
postesruraes12.blogspot.com
|
2 | www.blogger.com |
postesruraes12.blogspot.com
|
2 | fonts.gstatic.com |
postesruraes12.blogspot.com
|
1 | api.telegram.org |
devruralsuppes-ba40e4.ingress-florina.ewp.live
|
1 | cdnjs.cloudflare.com |
devruralsuppes-ba40e4.ingress-florina.ewp.live
|
1 | cdn.jsdelivr.net |
devruralsuppes-ba40e4.ingress-florina.ewp.live
|
1 | ajax.googleapis.com |
devruralsuppes-ba40e4.ingress-florina.ewp.live
|
1 | www.ruralvia.com |
devruralsuppes-ba40e4.ingress-florina.ewp.live
|
1 | away.vk.com | |
1 | vk.com | 1 redirects |
1 | resources.blogblog.com |
postesruraes12.blogspot.com
|
1 | blogger.googleusercontent.com |
postesruraes12.blogspot.com
|
1 | www.gstatic.com |
postesruraes12.blogspot.com
|
22 | 14 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
misc-sni.blogspot.com GTS CA 1C3 |
2022-08-15 - 2022-11-07 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-08-08 - 2022-10-31 |
3 months | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2022-08-15 - 2022-11-07 |
3 months | crt.sh |
*.blogger.com GTS CA 1C3 |
2022-08-15 - 2022-11-07 |
3 months | crt.sh |
*.vk.com GlobalSign Organization Validation CA - SHA256 - G2 |
2022-03-18 - 2023-04-03 |
a year | crt.sh |
*.ingress-florina.ewp.live Sectigo RSA Domain Validation Secure Server CA |
2022-05-24 - 2023-05-24 |
a year | crt.sh |
www.ruralvia.com DigiCert SHA2 Extended Validation Server CA |
2022-02-01 - 2023-02-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-08-15 - 2022-11-07 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
api.telegram.org Go Daddy Secure Certificate Authority - G2 |
2022-03-24 - 2023-04-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/index.html
Frame ID: DB9C97D1D21309BBBB65D4BE5482A2A4
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
Acceso Clientes - ruralviaPage URL History Show full URLs
- https://postesruraes12.blogspot.com/ Page URL
-
https://vk.com/away.php?to=https://devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-...
HTTP 302
https://away.vk.com/away.php Page URL
- https://devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/index.html Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Clipboard.js (Miscellaneous) Expand
Detected patterns
- clipboard(?:-([\d.]+))?(?:\.min)?\.js
SweetAlert (JavaScript Libraries) Expand
Detected patterns
- sweet(?:-)?alert(?:\.min)?\.js
SweetAlert2 (JavaScript Libraries) Expand
Detected patterns
- sweetalert2(?:\.all)?(?:\.min)?\.js
- /npm/sweetalert2@([\d.]+)
- sweetalert2@([\d.]+)/dist/sweetalert2(?:\.all)(?:\.min)\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://postesruraes12.blogspot.com/ Page URL
-
https://vk.com/away.php?to=https://devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/index.html
HTTP 302
https://away.vk.com/away.php Page URL
- https://devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- https://vk.com/away.php?to=https://devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/index.html HTTP 302
- https://away.vk.com/away.php
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
postesruraes12.blogspot.com/ |
65 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clipboard.min.js
www.gstatic.com/external_hosted/clipboardjs/ |
12 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sprite_v1_6.css.svg
postesruraes12.blogspot.com/responsive/ |
7 KB 3 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RURA.png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM45dFIjIOggs4Oqpf9V0DMYRj_Nd8WwYBGmcxE8sKcAvL_tbOkvwvVfFyjM8jbOIgnMvfP2lIF3LK4XfknSz835jMIDDg4r31iyNCxLaH6cgPlFpal_SWDYICEP1Ex6O2izrjuuOS3xwa5g1c... |
61 KB 61 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1649779728-strm_compiled.js
resources.blogblog.com/blogblog/data/res/ |
134 KB 134 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookienotice.js
postesruraes12.blogspot.com/js/ |
6 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2298587511-widgets.js
www.blogger.com/static/v1/widgets/ |
154 KB 56 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
blogger_logo_round_35.png
www.blogger.com/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
away.php
away.vk.com/ Redirect Chain
|
584 B 810 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.html
devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/assets/dist/css/ |
159 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spinner.css
devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/assets/css/ |
791 B 894 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ruralvia-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
section1.png
devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/assets/section/ |
24 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
section3.png
devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/assets/section/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2.all.min.js
cdn.jsdelivr.net/npm/sweetalert2@7.26.11/dist/ |
60 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert.min.js
cdnjs.cloudflare.com/ajax/libs/sweetalert/2.1.2/ |
40 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sendMessage
api.telegram.org/bot5452902033:AAH4Yk3Brz5V4nEfugeSPc1SHCFbxUI9ce0/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log.js
devruralsuppes-ba40e4.ingress-florina.ewp.live/rura/app-rura/common/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal function| setImmediate function| clearImmediate3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.vk.com/ | Name: remixlang Value: 6 |
|
.vk.com/ | Name: remixstlid Value: 9062165538874200580_J6puzGKXw1r4eSuGhykhnPmjqsZStjWpqa1gBBG0FZL |
|
.vk.com/ | Name: remixua Value: -1%7C-1%7C194%7C1674433836 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.telegram.org
away.vk.com
blogger.googleusercontent.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
devruralsuppes-ba40e4.ingress-florina.ewp.live
fonts.gstatic.com
postesruraes12.blogspot.com
resources.blogblog.com
vk.com
www.blogger.com
www.gstatic.com
www.ruralvia.com
195.53.82.136
2001:67c:4e8:f004::9
2606:4700::6810:5814
2606:4700::6811:190e
2a00:1450:4001:806::2003
2a00:1450:4001:80b::2001
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::2001
2a00:1450:4001:813::2003
2a00:1450:4001:82f::2009
63.250.43.136
87.240.129.133
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
183923f8c8c3960dce8ad9722cf55a30d19b321b721741bd9e2ab6ae1f1ae72a
29b8575294e161881afbe45e8e4309ca4dbe9b9d025cbb0aa8ae5c64db3acdec
2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b
3bcb6955d20ca5926886e93bfd1485682d57ffa645acf4ffd1fa1f986fcd8aef
6965c967fe2474e34f024a08618c84e9f995c3482a3c46e793b9eca4b00d82e2
73d16aca9b019e42dd2de3a10e5049b5606268ce0d8e3a167b05b37acb9b0e9c
7dbcd0f140ab2db5b4ae873feb974f8e426e6fc5d64dbe38631bace9667ca0cf
92e40dc4bbb485a182b796c58e6da7974cb8a6a84fdb4548ace3b85c991f0f94
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b0071cd7ccef32768966b353e2ff09d13e07ab31148944e5545803232c2341e9
be0b772bbb1db4b0bc1d03d2accc493db51fc409c9bc294252601dc1ef24c031
c61177136e513fc062685296e7f28a9e82b1f413fc36f0c2c3d062833e08b79e
cbea19888f468d54b5e29ed5f618f8b36a358d1849566ac1f8e084a11b6ccf51
e2099738a1c67f84e3b40831880460dee48df4dfce322d360e911779a8d699ce
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea79a3170a948d6370b76ec0640c63bd52051b1110bba34742fdb0a3e32a0c69
f3197a3167b2e48217af399a038e6c87754c897dd7962661888061266e8a17a2
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d