grupocajarural-ruralvia.es.swtest.ru
Open in
urlscan Pro
77.222.40.105
Malicious Activity!
Public Scan
Effective URL: http://grupocajarural-ruralvia.es.swtest.ru/client/login.php
Submission: On March 13 via api from US — Scanned from US
Summary
This is the only time grupocajarural-ruralvia.es.swtest.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 13 | 77.222.40.105 77.222.40.105 | 44112 (SWEB-AS) (SWEB-AS) | |
1 2 | 2607:f8b0:400... 2607:f8b0:4006:80a::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 195.53.82.136 195.53.82.136 | 57117 (RSI) (RSI) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81f::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:822::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2607:f8b0:400... 2607:f8b0:4004:c0b::9b | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:820::2004 | 15169 (GOOGLE) (GOOGLE) | |
17 | 6 |
ASN44112 (SWEB-AS, RU)
PTR: vh297.sweb.ru
grupocajarural-ruralvia.es.swtest.ru |
ASN57117 (RSI, ES)
PTR: 136.red-195-53-82.customer.static.ccgg.telefonica.net
www.ruralvia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
swtest.ru
1 redirects
grupocajarural-ruralvia.es.swtest.ru |
177 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com — Cisco Umbrella Rank: 25 |
17 KB |
1 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
408 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net — Cisco Umbrella Rank: 76 |
379 B |
1 |
gstatic.com
fonts.gstatic.com |
44 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34 |
1 KB |
1 |
ruralvia.com
www.ruralvia.com |
2 KB |
17 | 7 |
Domain | Requested by | |
---|---|---|
13 | grupocajarural-ruralvia.es.swtest.ru |
1 redirects
grupocajarural-ruralvia.es.swtest.ru
|
2 | www.google-analytics.com |
1 redirects
grupocajarural-ruralvia.es.swtest.ru
|
1 | www.google.com |
grupocajarural-ruralvia.es.swtest.ru
|
1 | stats.g.doubleclick.net | 1 redirects |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
grupocajarural-ruralvia.es.swtest.ru
|
1 | www.ruralvia.com |
grupocajarural-ruralvia.es.swtest.ru
|
17 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.ruralvia.com DigiCert SHA2 Secure Server CA |
2023-02-01 - 2024-01-31 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-02-20 - 2023-05-15 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-02-20 - 2023-05-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://grupocajarural-ruralvia.es.swtest.ru/client/login.php
Frame ID: AA9E303550D093320A8FF2F1B85A1197
Requests: 17 HTTP requests in this frame
Screenshot
Page Title
Caja RuralPage URL History Show full URLs
-
http://grupocajarural-ruralvia.es.swtest.ru/
HTTP 302
http://grupocajarural-ruralvia.es.swtest.ru/client/login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://grupocajarural-ruralvia.es.swtest.ru/
HTTP 302
http://grupocajarural-ruralvia.es.swtest.ru/client/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://www.google-analytics.com/ga.js HTTP 307
- https://www.google-analytics.com/ga.js
- http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=468419408&utmhn=grupocajarural-ruralvia.es.swtest.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caja%20Rural&utmhid=2033944624&utmr=-&utmp=%2Fclient%2Flogin.php&utmht=1678720324076&utmac=UA-12835961-1&utmcc=__utma%3D64431353.522419623.1678720324.1678720324.1678720324.1%3B%2B__utmz%3D64431353.1678720324.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1158459230&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
- https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=468419408&utmhn=grupocajarural-ruralvia.es.swtest.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caja%20Rural&utmhid=2033944624&utmr=-&utmp=%2Fclient%2Flogin.php&utmht=1678720324076&utmac=UA-12835961-1&utmcc=__utma%3D64431353.522419623.1678720324.1678720324.1678720324.1%3B%2B__utmz%3D64431353.1678720324.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1158459230&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-12835961-1&cid=522419623.1678720324&jid=1158459230&_v=5.7.2&z=468419408 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=522419623.1678720324&jid=1158459230&_v=5.7.2&z=468419408
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
grupocajarural-ruralvia.es.swtest.ru/client/ Redirect Chain
|
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rviaLogin.css
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
www.google-analytics.com/ Redirect Chain
|
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info_psd2.svg
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
47 KB 16 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telefono.jpg
www.ruralvia.com/accesos_cms/es/contenido_tres_archivos/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading.gif
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
56 KB 56 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jq.js
grupocajarural-ruralvia.es.swtest.ru/client/res/cdns/ |
287 KB 85 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
16 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ruralvia-mantenimiento.svg
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
12 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.com/ads/ Redirect Chain
|
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye-view-mantenimiento.svg
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow-mantenimiento.svg
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
964 B 872 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-info.svg
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
683 B 690 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico-warning-mantenimiento.svg
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aviso.svg
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
contacto.svg
grupocajarural-ruralvia.es.swtest.ru/client/res/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| _gat object| _gaq object| gaGlobal function| regeneracionClave function| validaAcceso undefined| iPass undefined| iNif function| changeNifVisibility function| changePassVisibility function| $ function| jQuery function| sendLogin6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
grupocajarural-ruralvia.es.swtest.ru/ | Name: PHPSESSID Value: eb762d0a9d3094899fac232cac52c1b1 |
|
.grupocajarural-ruralvia.es.swtest.ru/ | Name: __utma Value: 64431353.522419623.1678720324.1678720324.1678720324.1 |
|
.grupocajarural-ruralvia.es.swtest.ru/ | Name: __utmc Value: 64431353 |
|
.grupocajarural-ruralvia.es.swtest.ru/ | Name: __utmz Value: 64431353.1678720324.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.grupocajarural-ruralvia.es.swtest.ru/ | Name: __utmt Value: 1 |
|
.grupocajarural-ruralvia.es.swtest.ru/ | Name: __utmb Value: 64431353.1.10.1678720324 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
grupocajarural-ruralvia.es.swtest.ru
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.ruralvia.com
195.53.82.136
2607:f8b0:4004:c0b::9b
2607:f8b0:4006:80a::200e
2607:f8b0:4006:81f::200a
2607:f8b0:4006:820::2004
2607:f8b0:4006:822::2003
77.222.40.105
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1beb6ea2b2dbb353f047d419e2803459012d14a80c51a53bfa36112666eff19c
246c037026a7a16b204b4688fbcf320b35d95b17423082d9cee36b312a0c368b
509805421bb51434ceb54f81e2210cff4968a8c4140587cc70264e15d45e6696
5819e059aaa02db4ba199f883386b688eaaf1c71c50666d881947b618ae2c8b6
7945d38f7854f4302e0e2914b064a5392a0b16ca617a0e70599a229b73ef058b
804059be177f745bf8b6ab1aa52106fd39c772da4df5067817cfae8a29cfeab0
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
923e03262d1069a5e8a5071a04359e6e356756d5116c4ed3a496861095c894da
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
a125f56731750f15001719ac3c2b9ee3beec5bc37c3c21b46eef08c53c7fa07f
a7437ba825edd317914a9d7e90bf9425dd7e90e8a56dee13fe2e1b2ac394927f
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b7f5a8431ee4a984e1590927d7c1069ca86cf4852074c26846e1a8b21a49c95c
e6356f8b5072cd803d7dbd4fd05fa6e1a9fbc7b37847c91869a363f8947bb86e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f143f88d3952e78a275a6bbe19574c90508dc1e74c10e0b51ed8f0f9f9bb34c4