cf63395.tmweb.ru
Open in
urlscan Pro
2a03:6f00:6:1::b972:f7c5
Malicious Activity!
Public Scan
Submission: On November 14 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by GlobalSign GCC R3 DV TLS CA 2020 on May 5th 2022. Valid for: a year.
This is the only time cf63395.tmweb.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 2a03:6f00:6:1... 2a03:6f00:6:1::b972:f7c5 | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
1 | 195.53.82.136 195.53.82.136 | 57117 (RSI) (RSI) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:5714 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:67c:4e8:... 2001:67c:4e8:f004::9 | 62041 (TELEGRAM) (TELEGRAM) | |
11 | 6 |
ASN57117 (RSI, ES)
PTR: 136.red-195-53-82.customer.static.ccgg.telefonica.net
www.ruralvia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
tmweb.ru
cf63395.tmweb.ru |
77 KB |
1 |
telegram.org
api.telegram.org — Cisco Umbrella Rank: 47553 |
|
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 201 |
11 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 374 |
16 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 304 |
31 KB |
1 |
ruralvia.com
www.ruralvia.com |
12 KB |
11 | 6 |
Domain | Requested by | |
---|---|---|
6 | cf63395.tmweb.ru |
cf63395.tmweb.ru
|
1 | api.telegram.org |
cf63395.tmweb.ru
|
1 | cdnjs.cloudflare.com |
cf63395.tmweb.ru
|
1 | cdn.jsdelivr.net |
cf63395.tmweb.ru
|
1 | ajax.googleapis.com |
cf63395.tmweb.ru
|
1 | www.ruralvia.com |
cf63395.tmweb.ru
|
11 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.tmweb.ru GlobalSign GCC R3 DV TLS CA 2020 |
2022-05-05 - 2023-06-06 |
a year | crt.sh |
www.ruralvia.com DigiCert SHA2 Extended Validation Server CA |
2022-02-01 - 2023-02-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-10-25 - 2023-01-17 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
api.telegram.org Go Daddy Secure Certificate Authority - G2 |
2022-03-24 - 2023-04-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://cf63395.tmweb.ru/-/
Frame ID: C3CA6B38B83776BF965DB1D44830B07F
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Acceso Clientes - ruralviaDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
SweetAlert (JavaScript Libraries) Expand
Detected patterns
- sweet(?:-)?alert(?:\.min)?\.js
SweetAlert2 (JavaScript Libraries) Expand
Detected patterns
- sweetalert2(?:\.all)?(?:\.min)?\.js
- /npm/sweetalert2@([\d.]+)
- sweetalert2@([\d.]+)/dist/sweetalert2(?:\.all)(?:\.min)\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
cf63395.tmweb.ru/-/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cf63395.tmweb.ru/-/assets/dist/css/ |
159 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spinner.css
cf63395.tmweb.ru/-/assets/css/ |
791 B 969 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ruralvia-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
section1.png
cf63395.tmweb.ru/-/assets/section/ |
24 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
section3.png
cf63395.tmweb.ru/-/assets/section/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2.all.min.js
cdn.jsdelivr.net/npm/sweetalert2@7.26.11/dist/ |
60 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert.min.js
cdnjs.cloudflare.com/ajax/libs/sweetalert/2.1.2/ |
40 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sendMessage
api.telegram.org/bot5452902033:AAH4Yk3Brz5V4nEfugeSPc1SHCFbxUI9ce0/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log.js
cf63395.tmweb.ru/-/common/ |
1 KB 692 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal function| setImmediate function| clearImmediate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.telegram.org
cdn.jsdelivr.net
cdnjs.cloudflare.com
cf63395.tmweb.ru
www.ruralvia.com
195.53.82.136
2001:67c:4e8:f004::9
2606:4700::6810:5714
2606:4700::6811:180e
2a00:1450:4001:812::200a
2a03:6f00:6:1::b972:f7c5
29b8575294e161881afbe45e8e4309ca4dbe9b9d025cbb0aa8ae5c64db3acdec
2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b
3bcb6955d20ca5926886e93bfd1485682d57ffa645acf4ffd1fa1f986fcd8aef
6965c967fe2474e34f024a08618c84e9f995c3482a3c46e793b9eca4b00d82e2
7dbcd0f140ab2db5b4ae873feb974f8e426e6fc5d64dbe38631bace9667ca0cf
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b0071cd7ccef32768966b353e2ff09d13e07ab31148944e5545803232c2341e9
c61177136e513fc062685296e7f28a9e82b1f413fc36f0c2c3d062833e08b79e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea79a3170a948d6370b76ec0640c63bd52051b1110bba34742fdb0a3e32a0c69
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d