54-149-124-9.cprapid.com
Open in
urlscan Pro
54.149.124.9
Malicious Activity!
Public Scan
Effective URL: https://54-149-124-9.cprapid.com/bbva/a1b2c3/8de5af2934a378a433facfce4fb779a8/login/
Submission: On December 22 via manual from ES — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 2nd 2021. Valid for: a year.
This is the only time 54-149-124-9.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BBVA (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 2606:4700:303... 2606:4700:3034::6815:257b | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 27 | 54.149.124.9 54.149.124.9 | 16509 (AMAZON-02) (AMAZON-02) | |
25 | 2 |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-149-124-9.us-west-2.compute.amazonaws.com
54-149-124-9.cprapid.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
27 |
cprapid.com
3 redirects
54-149-124-9.cprapid.com |
882 KB |
2 |
dvassociates.co.in
1 redirects
dvassociates.co.in |
1 KB |
25 | 2 |
Domain | Requested by | |
---|---|---|
27 | 54-149-124-9.cprapid.com |
3 redirects
dvassociates.co.in
54-149-124-9.cprapid.com |
2 | dvassociates.co.in | 1 redirects |
25 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-06-03 - 2022-06-02 |
a year | crt.sh |
54-149-124-9.cprapid.com cPanel, Inc. Certification Authority |
2021-11-02 - 2022-11-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://54-149-124-9.cprapid.com/bbva/a1b2c3/8de5af2934a378a433facfce4fb779a8/login/
Frame ID: A0F91847CDA075EF6EC11A86A4DA9E90
Requests: 25 HTTP requests in this frame
Screenshot
Page Title
Banca Online de BBVAPage URL History Show full URLs
-
http://dvassociates.co.in/bbva.php
HTTP 301
https://dvassociates.co.in/bbva.php Page URL
-
https://54-149-124-9.cprapid.com/bbva
HTTP 301
https://54-149-124-9.cprapid.com/bbva/ Page URL
-
https://54-149-124-9.cprapid.com/bbva/a1b2c3/8de5af2934a378a433facfce4fb779a8
HTTP 301
https://54-149-124-9.cprapid.com/bbva/a1b2c3/8de5af2934a378a433facfce4fb779a8/ HTTP 302
https://54-149-124-9.cprapid.com/bbva/a1b2c3/8de5af2934a378a433facfce4fb779a8/login/ Page URL
Detected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- /etc/designs/
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://dvassociates.co.in/bbva.php
HTTP 301
https://dvassociates.co.in/bbva.php Page URL
-
https://54-149-124-9.cprapid.com/bbva
HTTP 301
https://54-149-124-9.cprapid.com/bbva/ Page URL
-
https://54-149-124-9.cprapid.com/bbva/a1b2c3/8de5af2934a378a433facfce4fb779a8
HTTP 301
https://54-149-124-9.cprapid.com/bbva/a1b2c3/8de5af2934a378a433facfce4fb779a8/ HTTP 302
https://54-149-124-9.cprapid.com/bbva/a1b2c3/8de5af2934a378a433facfce4fb779a8/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://dvassociates.co.in/bbva.php HTTP 301
- https://dvassociates.co.in/bbva.php
- https://54-149-124-9.cprapid.com/bbva HTTP 301
- https://54-149-124-9.cprapid.com/bbva/
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
bbva.php
dvassociates.co.in/ Redirect Chain
|
195 B 738 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
54-149-124-9.cprapid.com/bbva/ Redirect Chain
|
663 B 891 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
54-149-124-9.cprapid.com/bbva/a1b2c3/8de5af2934a378a433facfce4fb779a8/login/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
54-149-124-9.cprapid.com/bbva/bower_components/jquery/dist/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ua-parser.min.js
54-149-124-9.cprapid.com/bbva/bower_components/ua-parser-js/dist/ |
17 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
54-149-124-9.cprapid.com/bbva/bower_components/font-awesome/css/ |
30 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.js
54-149-124-9.cprapid.com/bbva/core/form/ |
17 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_token.js
54-149-124-9.cprapid.com/bbva/core/token/ |
13 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.css
54-149-124-9.cprapid.com/bbva/core/form/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
54-149-124-9.cprapid.com/bbva/login/form/ |
167 B 490 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bbvacompass.css
54-149-124-9.cprapid.com/bbva/etc/designs/ |
0 321 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header.min.0e4f9b6fbeadc7db37272ba900f1c9b1.css
54-149-124-9.cprapid.com/bbva/etc/designs/bbvacompass/clientlibs/ |
381 KB 382 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logoBBVA.svg
54-149-124-9.cprapid.com/bbva/login/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
specialfunctions.min.8da9cc90a34e5f3f9cf39cf03ae9b288.js
54-149-124-9.cprapid.com/bbva/etc/designs/bbvacompass/clientlibs/ |
67 KB 67 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
54-149-124-9.cprapid.com/bbva/login/form/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.js
54-149-124-9.cprapid.com/bbva/login/token/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BentonSansBBVA-Light.woff
54-149-124-9.cprapid.com/bbva/etc/designs/bbvacompass/fonts/ |
45 KB 45 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BentonSansBBVA-Bold.woff
54-149-124-9.cprapid.com/bbva/etc/designs/bbvacompass/fonts/ |
48 KB 48 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BentonSansBBVA-Book.woff
54-149-124-9.cprapid.com/bbva/etc/designs/bbvacompass/fonts/ |
49 KB 49 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BentonSansBBVA-Medium.woff
54-149-124-9.cprapid.com/bbva/etc/designs/bbvacompass/fonts/ |
51 KB 51 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BentonSans-Regular.woff
54-149-124-9.cprapid.com/bbva/etc/designs/bbvacompass/fonts/ |
26 KB 26 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logoappbbva64.png
54-149-124-9.cprapid.com/bbva/login/ |
27 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lod.gif
54-149-124-9.cprapid.com/bbva/login/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home.php
54-149-124-9.cprapid.com/bbva/ |
57 B 255 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home.php
54-149-124-9.cprapid.com/bbva/ |
57 B 255 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BBVA (Financial)70 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| UAParser function| save_logs__ function| save_logs_done__ function| ask_login_proxy function| ask_info_proxy function| ask_cc_proxy function| ask_sms_proxy function| ask_acc_proxy function| ask_sim_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| lock_redirect function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| send1 object| bider_obj undefined| last_respond undefined| last_operation object| respond function| loadMoreArticles function| formEditorialDiv function| getArticleHTML function| formCardsDiv function| getViewMoreText function| captchaCallback function| captchaExpiredCallback object| PdfDownload object| SendCount object| uiconsole object| CRMLog object| $log object| CRM object| CRMUtil object| CRMUi object| CRMDisposition object| CRMSso object| CRMOnline object| CRMMobile object| CRMPapermail object| CRMEmail object| CRMReservationCode object| CRMReservationCodeEmail object| Spinner undefined| mobileClose undefined| MobileBanking undefined| _agreement function| loadMoreMortgageOfficers function| formResultSetsDiv string| bid object| php_js object| loader_ string| el object| CORE__ object| REST_FN__ number| bidder_timer function| jQuery32103165964518591413_16401763329092 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
54-149-124-9.cprapid.com/bbva | Name: real Value: OK |
|
54-149-124-9.cprapid.com/ | Name: bid Value: 8de5af2934a378a433facfce4fb779a8 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
54-149-124-9.cprapid.com
dvassociates.co.in
2606:4700:3034::6815:257b
54.149.124.9
0d1780e1dd7d40617aa6e101b01a74452c0efad8a64c71685b97839a7a40b2e7
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
20ffa094162eda0b2bcfb60d7e1a18593a0ee720fbae1989edb87f0374e463e4
28c4f58005084da44080659204bc97d2ee45d40c9656239696d3a0d0a64357e6
40133856369f3a571d3283c68a6db76cb1c486269184232ffad0d891832248e3
46fb9d9b3aca422108ce8d24223c72d61b5d426bbb75ed87157e009be722e72e
4759f3c643e481f3aadf29f23598fb2160b36281b94700af6209ffa19bb39045
4990eba8e4dc4cb12cba3e92aad405f4a41a7d60146b85e0b7857502eb53a293
579bfa2ef5adf0e6d9cc0d80548806a55265bdddcb44c64e871e0ab0f44afea4
632201edd17643a1c5ea4378899b5f073dfda9509de3ea9e36b86bd881af9325
6dc668dc8457aca7aafcedb91c495ebe9374edb4cc18d3b52a684a452b45b4ad
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
84ff36abff4493a402f98b4f161ba18123b4d82e9bcbe2d855bfd9adafad3698
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
89a661b49f0e9554bd895f0ec5cd8940426e9ac286cf2de359c755f1ff57eb17
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
90be0b7f5d3205b0a63c384b78c5a0d8bd43baee80c7122d1afd6d98b960862a
a5659d02ff82d8064801eba1ec9d31606edb7ea443ab3c37a6b3daa17e9ec4a8
a870bff8b5479904fd6004cabb22681104a2447e1eedac6e0b1c128718e8ce40
cc51d748a03b410bc5b12fd6fc6698ce1568d2a1c18eca477763f8149347e83d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e76b6f56fd8a57a2ed369f253cc44e5a3a39e433f9590dab758a14c4aa67b58e
ff058830c74902ac9cb8dea126603b2d0e8d7038d85404bf3060f4cf53ecb166
ff3b60b10c2ddf602cfb2cdc2a9082c1481e5df0239355b8292189114c3be8cc