cajamar-assistant-poc.ibm-client-engineering-pegaso.com
Open in
urlscan Pro
158.177.19.148
Malicious Activity!
Public Scan
URL:
https://cajamar-assistant-poc.ibm-client-engineering-pegaso.com/
Submission: On May 31 via automatic, source certstream-suspicious — Scanned from DE
Submission: On May 31 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 4 IPs
in 2 countries
across 3 domains to perform 13 HTTP transactions.
The main IP is 158.177.19.148, located in
United States and
belongs to SOFTLAYER, US.
The main domain is cajamar-assistant-poc.ibm-client-engineering-pegaso.com.
TLS certificate: Issued by R3 on May 31st 2023. Valid for: 3 months.
This is the only time cajamar-assistant-poc.ibm-client-engineering-pegaso.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on May 31st 2023. Valid for: 3 months.
This is the only time cajamar-assistant-poc.ibm-client-engineering-pegaso.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cajamar (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 158.177.19.148 158.177.19.148 | 36351 (SOFTLAYER) (SOFTLAYER) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:810::200a | 15169 (GOOGLE) (GOOGLE) | |
| 3 | 2a00:1450:400... 2a00:1450:4001:82b::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 13 | 4 |
9
158.177.19.148
(United States)
ASN36351 (SOFTLAYER, US)
PTR: 94.13.b19e.ip4.static.sl-reverse.com
ASN36351 (SOFTLAYER, US)
PTR: 94.13.b19e.ip4.static.sl-reverse.com
| cajamar-assistant-poc.ibm-client-engineering-pegaso.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
ibm-client-engineering-pegaso.com
cajamar-assistant-poc.ibm-client-engineering-pegaso.com |
1 MB |
| 3 |
gstatic.com
fonts.gstatic.com |
47 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35 |
2 KB |
| 13 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | cajamar-assistant-poc.ibm-client-engineering-pegaso.com |
cajamar-assistant-poc.ibm-client-engineering-pegaso.com
|
| 3 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | fonts.googleapis.com |
cajamar-assistant-poc.ibm-client-engineering-pegaso.com
|
| 13 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| cajamar-assistant-poc.ibm-client-engineering-pegaso.com R3 |
2023-05-31 - 2023-08-29 |
3 months | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
| *.gstatic.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cajamar-assistant-poc.ibm-client-engineering-pegaso.com/
Frame ID: A1E3EF0618D8A54AB1117ADCDCE53A23
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
CajamarDetected technologies
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
cajamar-assistant-poc.ibm-client-engineering-pegaso.com/ |
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css2
fonts.googleapis.com/ |
20 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.f0819575.js
cajamar-assistant-poc.ibm-client-engineering-pegaso.com/static/js/ |
488 KB 488 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.df3b6d63.css
cajamar-assistant-poc.ibm-client-engineering-pegaso.com/static/css/ |
3 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
267.dbb7ef5a.chunk.js
cajamar-assistant-poc.ibm-client-engineering-pegaso.com/static/js/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
486.797813aa.chunk.js
cajamar-assistant-poc.ibm-client-engineering-pegaso.com/static/js/ |
40 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
401.089978f3.chunk.js
cajamar-assistant-poc.ibm-client-engineering-pegaso.com/static/js/ |
514 KB 514 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
199.3886c05f.chunk.js
cajamar-assistant-poc.ibm-client-engineering-pegaso.com/static/js/ |
27 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
me
cajamar-assistant-poc.ibm-client-engineering-pegaso.com/api/users/ |
66 B 439 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cuenta-ahorro.jpg
cajamar-assistant-poc.ibm-client-engineering-pegaso.com/ |
87 KB 87 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cajamar (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| webpackChunkcajamar_assistant object| TreemapSquared function| SVG object| Apex function| ApexCharts2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| cajamar-assistant-poc.ibm-client-engineering-pegaso.com/ | Name: d38660aa915e149680972b2b20d638a2 Value: de4ab981d40ed4f32ddd0158b176360a |
|
| cajamar-assistant-poc.ibm-client-engineering-pegaso.com/ | Name: c952831f30a668aba024049c17517a84 Value: ff91cfb6fd894b1293bda8e59e6e503c |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cajamar-assistant-poc.ibm-client-engineering-pegaso.com
fonts.googleapis.com
fonts.gstatic.com
158.177.19.148
2a00:1450:4001:810::200a
2a00:1450:4001:82b::2003
16807235503964af48fdd9461a3bac659bb85a32dc98ae9c7a1f8360b31fa96e
3c3212650d35145a1cc309e517b37d0f3535260273ccd0a77435fbead93188fa
77aeb653d5c0642557de447a3e56061bd151acf3fbd6f74b7e5b1447a657999a
9c4b637013a6526b6028dc61be7aad4bf7f51b8b4e9e2711f6658ecf3c2df021
a174dd0e04ad82aaa8740200a9127785cdd958884e4f301bf2b6116dfbe67f01
af3a8f2f52f134f7d2b56841b13d7c34e489bb468fd11594c2e8dfc51f4cbeeb
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b4fde7a33504eccc053c9486a6081494d0a655aa538ec9cbd681a524350ee966
bfc0fb321a5a515225b7af63918297dc194f54845d4f44e6af5232d8b2693738
d61e4844faab0cdec61f9f3640635d5dfabf16a816c1f25f6163ffcfac379552
e3ee1aff3f17f44b523af13c0ddfd58953c285741c8822aa529c1af1763ab488
e444601d7bd4cfec0eb05f67bed76d871efc9d2a6e22f032f7bd8510345c8075
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615