![](/screenshots/c36ba134-d48e-4a12-9372-eb1f065c7811.png)
vps50076.lws-hosting.com
Open in
urlscan Pro
31.207.36.29
Malicious Activity!
Public Scan
Effective URL: http://vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/MTIyZmY2YTAwYWQ3MmZkOWI1OWZhNWU2MzA0ZThmODU=/welcome.php?id=login&Re...
Submission: On May 02 via manual from ES
Summary
This is the only time vps50076.lws-hosting.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Santander (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.69 104.244.42.69 | 13414 (TWITTER) (TWITTER - Twitter Inc.) | |
1 1 | 104.236.48.227 104.236.48.227 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
1 1 | 159.203.160.179 159.203.160.179 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
1 1 | 46.41.57.8 46.41.57.8 | 15987 (PORTUNITY-AS) (PORTUNITY-AS) | |
1 5 | 31.207.36.29 31.207.36.29 | 16347 (RMI-FITECH) (RMI-FITECH) | |
1 | 172.217.22.40 172.217.22.40 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 195.149.208.251 195.149.208.251 | 2134 (GSVNET-AS...) (GSVNET-AS GS Virtual Network Produban) | |
2 | 172.217.22.46 172.217.22.46 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
10 | 5 |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: gateway-tinycc.com
sant.serv.xn--t-hga.cc |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: tinycc.com
tinycc.com |
ASN16347 (RMI-FITECH, FR)
PTR: vps50076.lws-hosting.com
vps50076.lws-hosting.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f8.1e100.net
www.googletagmanager.com |
ASN2134 (GSVNET-AS GS Virtual Network Produban, ES)
PTR: particulares.gruposantander.es
particulares.gruposantander.es |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f14.1e100.net
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
lws-hosting.com
1 redirects
vps50076.lws-hosting.com |
65 KB |
2 |
google-analytics.com
www.google-analytics.com |
14 KB |
2 |
gruposantander.es
particulares.gruposantander.es |
3 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
22 KB |
1 |
1st-bay.de
1 redirects
www.1st-bay.de |
443 B |
1 |
tinycc.com
1 redirects
tinycc.com |
613 B |
1 |
xn--t-hga.cc
1 redirects
sant.serv.xn--t-hga.cc |
239 B |
1 |
t.co
t.co |
450 B |
10 | 8 |
Domain | Requested by | |
---|---|---|
5 | vps50076.lws-hosting.com |
1 redirects
vps50076.lws-hosting.com
|
2 | www.google-analytics.com |
www.googletagmanager.com
vps50076.lws-hosting.com |
2 | particulares.gruposantander.es |
vps50076.lws-hosting.com
|
1 | www.googletagmanager.com |
vps50076.lws-hosting.com
|
1 | www.1st-bay.de | 1 redirects |
1 | tinycc.com | 1 redirects |
1 | sant.serv.xn--t-hga.cc | 1 redirects |
1 | t.co | |
10 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert SHA2 Extended Validation Server CA |
2017-07-25 - 2018-11-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/MTIyZmY2YTAwYWQ3MmZkOWI1OWZhNWU2MzA0ZThmODU=/welcome.php?id=login&Requests=8e1ca38c3f2691a7b7d83e811efc592d&dispatch=ZDA5MmUyYTliNGQzNDdhYWE1Y2RhNzVkZWNlZDk5ZGY=
Frame ID: 8263A78B07ED4F1DE9B1932C9A7E565B
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/c36ba134-d48e-4a12-9372-eb1f065c7811.png)
Page URL History Show full URLs
- https://t.co/OXB4FRZ1Ng Page URL
-
http://sant.serv.xn--t-hga.cc/d
HTTP 301
https://tinycc.com/tiny/custom_domain_redirect/sant.serv.xn--t-hga.cc/d HTTP 303
http://www.1st-bay.de/includes/redirect.php?url=http://vps50076.lws-hosting.com/~seystemsezntnnde/... HTTP 301
http://vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/ HTTP 302
http://vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/MTIyZmY2YTAwYWQ3MmZkOWI1OWZhNWU2MzA0ZThmODU=/wel... Page URL
Detected technologies
Detected patterns
- env /^gaGlobal$/i
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- env /^google_tag_manager$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/OXB4FRZ1Ng Page URL
-
http://sant.serv.xn--t-hga.cc/d
HTTP 301
https://tinycc.com/tiny/custom_domain_redirect/sant.serv.xn--t-hga.cc/d HTTP 303
http://www.1st-bay.de/includes/redirect.php?url=http://vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/ HTTP 301
http://vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/ HTTP 302
http://vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/MTIyZmY2YTAwYWQ3MmZkOWI1OWZhNWU2MzA0ZThmODU=/welcome.php?id=login&Requests=8e1ca38c3f2691a7b7d83e811efc592d&dispatch=ZDA5MmUyYTliNGQzNDdhYWE1Y2RhNzVkZWNlZDk5ZGY= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
OXB4FRZ1Ng
t.co/ |
287 B 450 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
welcome.php
vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/MTIyZmY2YTAwYWQ3MmZkOWI1OWZhNWU2MzA0ZThmODU=/ Redirect Chain
|
49 KB 49 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
js
www.googletagmanager.com/gtag/ |
64 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
11111.gif
vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/MTIyZmY2YTAwYWQ3MmZkOWI1OWZhNWU2MzA0ZThmODU=/img/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
IcoSeguridad[1].gif
vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/MTIyZmY2YTAwYWQ3MmZkOWI1OWZhNWU2MzA0ZThmODU=/img/ |
800 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
side.PNG
vps50076.lws-hosting.com/~seystemsezntnnde/confirmar/img/ |
10 KB 10 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
barraCTIayuda.gif
particulares.gruposantander.es/SUPFPA_ENS/Estatico/Globales/V60/Images/ |
652 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
IcoDNI.gif
particulares.gruposantander.es/Estatico/Globales/V180/Styles/CustomTags/Images/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
analytics.js
www.google-analytics.com/ |
34 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
collect
www.google-analytics.com/r/ |
35 B 111 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Santander (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| gtag object| dataLayer function| myFunction function| mySlice function| myMini function| myMaju function| myTipo object| google_tag_manager string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.lws-hosting.com/ | Name: _gat_gtag_UA_69832564_1 Value: 1 |
|
.lws-hosting.com/ | Name: _gid Value: GA1.2.396484519.1525267999 |
|
.lws-hosting.com/ | Name: _ga Value: GA1.2.2108410687.1525267999 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | referrer always; |
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 1; mode=block; report=https://twitter.com/i/xss_report |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
particulares.gruposantander.es
sant.serv.xn--t-hga.cc
t.co
tinycc.com
vps50076.lws-hosting.com
www.1st-bay.de
www.google-analytics.com
www.googletagmanager.com
104.236.48.227
104.244.42.69
159.203.160.179
172.217.22.40
172.217.22.46
195.149.208.251
31.207.36.29
46.41.57.8
0df7aac93b15fa2403d4f518686263b4587bf84cd2c8529e21c4f5c91b256fd4
0f0b2ff19d7745a2e5a50f35aeb514a8001f36f1ae5e4913eeea84b33174b313
112890acfaaba84a86a48e092b03e250618b767b9403adff1b314e57e18015d7
2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675
36e5a7e5574d0873d25045607c506ce269818957214c32b675227926b43dcdb3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
845407d0da1b8cd27c3559e3d0febc03a243a1d06b49c5de2d50fa5d0886be9b
8bcd65166304f71e1ffef80c3d79e6eb76dd8de7e40fc724c0e5ff3b3fa69d5c
dccbdbd05d266b1eabd49f0a61cd1dd5c396dd390b11bb14004a5ac49fe92de8
e5898eb9d3aeb512c9428dda32a494c0c62bca797ad205947c201925fd7b002a