vruralvi21.temp.swtest.ru
Open in
urlscan Pro
77.222.40.109
Malicious Activity!
Public Scan
Effective URL: http://vruralvi21.temp.swtest.ru/folder/rvIa/esp/
Submission: On October 23 via manual from ES — Scanned from DE
Summary
This is the only time vruralvi21.temp.swtest.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.241.186.140 35.241.186.140 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.186.65 142.250.186.65 | 15169 (GOOGLE) (GOOGLE) | |
4 | 142.250.185.105 142.250.185.105 | 15169 (GOOGLE) (GOOGLE) | |
1 | 77.222.40.109 77.222.40.109 | 44112 (SWEB-AS) (SWEB-AS) | |
12 | 195.53.82.136 195.53.82.136 | 57117 (RSI) (RSI) | |
1 | 142.250.184.234 142.250.184.234 | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 142.250.186.142 142.250.186.142 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.185.99 142.250.185.99 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 64.233.167.154 64.233.167.154 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.186.68 142.250.186.68 | 15169 (GOOGLE) (GOOGLE) | |
23 | 9 |
ASN15169 (GOOGLE, US)
PTR: 140.186.241.35.bc.googleusercontent.com
xuq2s.mjt.lu |
ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f1.1e100.net
volavor.blogspot.com |
ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f9.1e100.net
www.blogger.com |
ASN44112 (SWEB-AS, RU)
PTR: vh286.sweb.ru
vruralvi21.temp.swtest.ru |
ASN57117 (RSI, ES)
PTR: 136.red-195-53-82.customer.static.ccgg.telefonica.net
www.ruralvia.com |
ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f14.1e100.net
www.google-analytics.com |
ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f3.1e100.net
fonts.gstatic.com |
ASN15169 (GOOGLE, US)
PTR: wl-in-f154.1e100.net
stats.g.doubleclick.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
ruralvia.com
www.ruralvia.com |
87 KB |
4 |
blogger.com
www.blogger.com |
186 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com |
17 KB |
1 |
google.com
www.google.com |
472 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net |
444 B |
1 |
gstatic.com
fonts.gstatic.com |
44 KB |
1 |
googleapis.com
fonts.googleapis.com |
2 KB |
1 |
swtest.ru
vruralvi21.temp.swtest.ru |
6 KB |
1 |
blogspot.com
volavor.blogspot.com |
3 KB |
1 |
mjt.lu
1 redirects
xuq2s.mjt.lu |
177 B |
23 | 10 |
Domain | Requested by | |
---|---|---|
12 | www.ruralvia.com |
vruralvi21.temp.swtest.ru
www.ruralvia.com |
4 | www.blogger.com |
volavor.blogspot.com
|
2 | www.google-analytics.com |
1 redirects
vruralvi21.temp.swtest.ru
|
1 | www.google.com |
vruralvi21.temp.swtest.ru
|
1 | stats.g.doubleclick.net | 1 redirects |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
www.ruralvia.com
|
1 | vruralvi21.temp.swtest.ru |
volavor.blogspot.com
|
1 | volavor.blogspot.com | |
1 | xuq2s.mjt.lu | 1 redirects |
23 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
misc-sni.blogspot.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
*.blogger.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
www.ruralvia.com DigiCert SHA2 Extended Validation Server CA |
2021-01-13 - 2022-02-13 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://vruralvi21.temp.swtest.ru/folder/rvIa/esp/
Frame ID: 36E727F092C6CC457062CF0105C90030
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Caja RuralPage URL History Show full URLs
-
http://xuq2s.mjt.lu/lnk/AVQAAEBU-GUAAAAAAAAAAOcZqeoAAAAAS2MAAAAAABIMXQBhcZBLpJQGEIReTOG9S_86ReMw...
HTTP 302
https://volavor.blogspot.com/2021/10/2023.html Page URL
- http://vruralvi21.temp.swtest.ru/folder/rvIa/esp/ Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://xuq2s.mjt.lu/lnk/AVQAAEBU-GUAAAAAAAAAAOcZqeoAAAAAS2MAAAAAABIMXQBhcZBLpJQGEIReTOG9S_86ReMwEwASE-c/1/4q3-SKi8EWaX-K2FJy8pkg/aHR0cHM6Ly92b2xhdm9yLmJsb2dzcG90LmNvbS8yMDIxLzEwLzIwMjMuaHRtbA
HTTP 302
https://volavor.blogspot.com/2021/10/2023.html Page URL
- http://vruralvi21.temp.swtest.ru/folder/rvIa/esp/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://xuq2s.mjt.lu/lnk/AVQAAEBU-GUAAAAAAAAAAOcZqeoAAAAAS2MAAAAAABIMXQBhcZBLpJQGEIReTOG9S_86ReMwEwASE-c/1/4q3-SKi8EWaX-K2FJy8pkg/aHR0cHM6Ly92b2xhdm9yLmJsb2dzcG90LmNvbS8yMDIxLzEwLzIwMjMuaHRtbA HTTP 302
- https://volavor.blogspot.com/2021/10/2023.html
- http://www.google-analytics.com/ga.js HTTP 307
- https://www.google-analytics.com/ga.js
- http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1423666399&utmhn=vruralvi21.temp.swtest.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caja%20Rural&utmhid=1612092234&utmr=-&utmp=%2Ffolder%2FrvIa%2Fesp%2F&utmht=1634975597059&utmac=UA-12835961-1&utmcc=__utma%3D171092711.2022211065.1634975597.1634975597.1634975597.1%3B%2B__utmz%3D171092711.1634975597.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1153685410&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
- https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1423666399&utmhn=vruralvi21.temp.swtest.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Caja%20Rural&utmhid=1612092234&utmr=-&utmp=%2Ffolder%2FrvIa%2Fesp%2F&utmht=1634975597059&utmac=UA-12835961-1&utmcc=__utma%3D171092711.2022211065.1634975597.1634975597.1634975597.1%3B%2B__utmz%3D171092711.1634975597.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1153685410&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-12835961-1&cid=2022211065.1634975597&jid=1153685410&_v=5.7.2&z=1423666399 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-12835961-1&cid=2022211065.1634975597&jid=1153685410&_v=5.7.2&z=1423666399
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
2023.html
volavor.blogspot.com/2021/10/ Redirect Chain
|
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1394523530-widget_css_bundle.css
www.blogger.com/static/v1/widgets/ |
30 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2918676466-widgets.js
www.blogger.com/static/v1/widgets/ |
154 KB 155 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authorization.css
www.blogger.com/dyn-css/ |
1 B 688 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
vruralvi21.temp.swtest.ru/folder/rvIa/esp/ |
20 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authorization.css
www.blogger.com/dyn-css/ |
1 B 88 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rviaLogin.css
www.ruralvia.com/estilos_prtl/css_acceso/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
checkUsuPass.js
www.ruralvia.com/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
acceso.js
www.ruralvia.com/javascripts_portal/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
keyboard.js
www.ruralvia.com/javascripts_portal/es_ES/js_portal/ |
24 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info_psd2.svg
www.ruralvia.com/accesos_cms/es/contenido_dos_archivos/ |
47 KB 47 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telefono.jpg
www.ruralvia.com/accesos_cms/es/contenido_tres_archivos/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
15 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
www.google-analytics.com/ Redirect Chain
|
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ruralvia-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye-view-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
964 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-info.svg
www.ruralvia.com/estilos_prtl/css/html5/css/images/icons/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico-warning-mantenimiento.svg
www.ruralvia.com/estilos_prtl/css_acceso/img/mantenimiento/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aviso.svg
www.ruralvia.com/estilos_prtl/css_acceso/images/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
contacto.svg
www.ruralvia.com/estilos_prtl/css_acceso/images/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.com/ads/ Redirect Chain
|
42 B 472 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.ruralvia.com
- URL
- https://www.ruralvia.com/estilos_prtl/css/html5/css/images/icons/icon-info.svg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)85 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster string| iAlphanumeric string| iAlphanumericVB string| iDocument string| iAlphanumericOrEmail boolean| defaultEmptyOK string| whitespace function| isLetter function| isAsciiCharPermited function| isDigit function| isLetterOrDigit function| isEmpty function| isAlphanumericVB function| isAlphanumeric function| isEmail function| checkAlphanumeric function| checkAlphanumericVB function| warnInvalid function| isWhitespace function| checkDocumento function| showError function| comprobarAcceso undefined| win2 string| CODAPP number| longCadena string| entidad object| filtro function| VKI_attach function| VKI_close function| VKI_buildKeyboardInputs function| VKI_findPos function| VKI_innerDimensions function| VKI_scrollDist function| VKI_getStyle function| VKI_disableSelection function| Conectando function| ConectandoIur number| pulsada object| fActual function| volverTemporizado number| timerPPub function| mandar function| mandarIur function| posicion function| pulsarTecla boolean| ie4tecla object| _gaq function| regeneracionClave function| validaAcceso undefined| iPass undefined| iNif function| changeNifVisibility function| changePassVisibility object| _gat object| gaGlobal boolean| VKI_visible boolean| VKI_target boolean| VKI_dead boolean| VKI_capslock boolean| VKI_shift boolean| VKI_deadkeysOn string| VKI_kt boolean| VKI_clearPasswords string| VKI_imageURI boolean| VKI_clickless number| VKI_clicklessDelay number| VKI_keyCenter boolean| VKI_isIE boolean| VKI_isIE6 boolean| VKI_isIElt8 boolean| VKI_isIE9 boolean| VKI_isIE10 boolean| VKI_isMoz boolean| VKI_isWebKit object| VKI_layout object| VKI_layoutDDK object| VKI_deadkey function| VKI_attachKeyboard object| VKI_keyboard function| VKI_buildKeys function| VKI_modify function| VKI_insert function| VKI_show_focus function| VKI_position5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.vruralvi21.temp.swtest.ru/ | Name: __utma Value: 171092711.2022211065.1634975597.1634975597.1634975597.1 |
|
.vruralvi21.temp.swtest.ru/ | Name: __utmc Value: 171092711 |
|
.vruralvi21.temp.swtest.ru/ | Name: __utmz Value: 171092711.1634975597.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.vruralvi21.temp.swtest.ru/ | Name: __utmt Value: 1 |
|
.vruralvi21.temp.swtest.ru/ | Name: __utmb Value: 171092711.1.10.1634975597 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
stats.g.doubleclick.net
volavor.blogspot.com
vruralvi21.temp.swtest.ru
www.blogger.com
www.google-analytics.com
www.google.com
www.ruralvia.com
xuq2s.mjt.lu
www.ruralvia.com
142.250.184.234
142.250.185.105
142.250.185.99
142.250.186.142
142.250.186.65
142.250.186.68
195.53.82.136
35.241.186.140
64.233.167.154
77.222.40.109
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1363d61babf2b49f7e4ddca416e88156b581468f1288ab9ca2c14b74e97653e9
161a19b918385decae284d642d88455f174992a19a742cf13c31acc0286564cd
36ec8a2c1c3a936316b64f686261db7eb0d1bc301f1d779cd844db268a933978
3aa4c7972f9b400d68eba8aaa350840ce00a14d8678612d8bbeea7266b8dc99f
509805421bb51434ceb54f81e2210cff4968a8c4140587cc70264e15d45e6696
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
5819e059aaa02db4ba199f883386b688eaaf1c71c50666d881947b618ae2c8b6
5dcfcba5605a3d22a34cc3f99054c035836d410bc90f1936b9af0e279882dfea
69951dde4b5dbc60793065b821ab8c9e8cfa50df2ee950fae653e611e8fdf81b
71d3b53f5fc2d9ff983184f539a0c8b9991c31af89b3448ab7475c1ef94e6124
7945d38f7854f4302e0e2914b064a5392a0b16ca617a0e70599a229b73ef058b
804059be177f745bf8b6ab1aa52106fd39c772da4df5067817cfae8a29cfeab0
92b0c012b34ea951e730d0452dce78cf13aa209c90279035f0600af911227126
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
b7f5a8431ee4a984e1590927d7c1069ca86cf4852074c26846e1a8b21a49c95c
d62c0ff930b5ae1563cc2903c64043d3aab6566fae687fa0de4fa3daa91f82b0
e6356f8b5072cd803d7dbd4fd05fa6e1a9fbc7b37847c91869a363f8947bb86e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629