![](/screenshots/fba4f39d-2907-4713-8c33-e83c6c4f58e0.png)
reservatio.temp.swtest.ru
Open in
urlscan Pro
77.222.40.7
Malicious Activity!
Public Scan
Effective URL: http://reservatio.temp.swtest.ru/2/
Submission: On October 27 via manual — Scanned from DE
Summary
This is the only time reservatio.temp.swtest.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Grupo Caja Rural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 3.214.235.32 3.214.235.32 | 14618 (AMAZON-AES) (AMAZON-AES) | |
5 | 13.225.87.11 13.225.87.11 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 142.250.185.234 142.250.185.234 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 143.204.98.16 143.204.98.16 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 67.199.248.12 67.199.248.12 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
2 | 23.45.108.127 23.45.108.127 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 142.250.74.193 142.250.74.193 | 15169 (GOOGLE) (GOOGLE) | |
1 | 77.222.40.7 77.222.40.7 | 44112 (SWEB-AS) (SWEB-AS) | |
11 | 6 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-214-235-32.compute-1.amazonaws.com
api.xsend8.email | |
app.sendx.io |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-11.fra2.r.cloudfront.net
51.fi |
ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f10.1e100.net
fonts.googleapis.com |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-16.fra50.r.cloudfront.net
api.51.fi |
ASN16625 (AKAMAI-AS, US)
PTR: a23-45-108-127.deploy.static.akamaitechnologies.com
www.xfinity.com |
ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f1.1e100.net
rura56788544.blogspot.com |
ASN44112 (SWEB-AS, RU)
PTR: vh290.sweb.ru
reservatio.temp.swtest.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
51.fi
1 redirects
51.fi api.51.fi |
171 KB |
2 |
xfinity.com
www.xfinity.com |
22 KB |
1 |
swtest.ru
reservatio.temp.swtest.ru |
68 KB |
1 |
blogspot.com
rura56788544.blogspot.com |
14 KB |
1 |
xfin.tv
1 redirects
xfin.tv |
290 B |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
sendx.io
1 redirects
app.sendx.io |
643 B |
1 |
xsend8.email
1 redirects
api.xsend8.email |
265 B |
11 | 8 |
Domain | Requested by | |
---|---|---|
5 | 51.fi |
51.fi
|
2 | www.xfinity.com |
51.fi
www.xfinity.com |
1 | reservatio.temp.swtest.ru |
rura56788544.blogspot.com
|
1 | rura56788544.blogspot.com |
www.xfinity.com
|
1 | xfin.tv | 1 redirects |
1 | api.51.fi | 1 redirects |
1 | fonts.googleapis.com |
51.fi
|
1 | app.sendx.io | 1 redirects |
1 | api.xsend8.email | 1 redirects |
11 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
51.fi Amazon |
2021-02-23 - 2022-03-24 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
xapi.xfinity.com COMODO RSA Organization Validation Secure Server CA |
2020-05-07 - 2022-05-07 |
2 years | crt.sh |
misc-sni.blogspot.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://reservatio.temp.swtest.ru/2/
Frame ID: 444CC87011C7FF276EF875514A3AC35D
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/fba4f39d-2907-4713-8c33-e83c6c4f58e0.png)
Page Title
Caja Rural Nuestra Señora de Guadalupe de Baena, S.C.A.C.Page URL History Show full URLs
-
http://api.xsend8.email/api/v1/track/campaign/click/ndU1nbZtXCcPuskiU2q0oo/1IueCu3jTJ6MebzM1FgTwW
HTTP 301
http://app.sendx.io/api/v1/track/campaign/click/ndU1nbZtXCcPuskiU2q0oo/1IueCu3jTJ6MebzM1FgTwW HTTP 302
https://51.fi/f8R?utm_campaign=Ruralvia&utm_content=Acceso+Banca+internet&utm_medium=email... Page URL
-
https://api.51.fi/f8R?cb=1635323944537
HTTP 308
https://xfin.tv/3mcNPBb HTTP 301
https://www.xfinity.com/mobile/cima-logout.html?continue=%0Ahttps://rura56788544.blogspot.com/ Page URL
- https://rura56788544.blogspot.com/ Page URL
- http://reservatio.temp.swtest.ru/2/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://api.xsend8.email/api/v1/track/campaign/click/ndU1nbZtXCcPuskiU2q0oo/1IueCu3jTJ6MebzM1FgTwW
HTTP 301
http://app.sendx.io/api/v1/track/campaign/click/ndU1nbZtXCcPuskiU2q0oo/1IueCu3jTJ6MebzM1FgTwW HTTP 302
https://51.fi/f8R?utm_campaign=Ruralvia&utm_content=Acceso+Banca+internet&utm_medium=email&utm_source=sendx Page URL
-
https://api.51.fi/f8R?cb=1635323944537
HTTP 308
https://xfin.tv/3mcNPBb HTTP 301
https://www.xfinity.com/mobile/cima-logout.html?continue=%0Ahttps://rura56788544.blogspot.com/ Page URL
- https://rura56788544.blogspot.com/ Page URL
- http://reservatio.temp.swtest.ru/2/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://api.xsend8.email/api/v1/track/campaign/click/ndU1nbZtXCcPuskiU2q0oo/1IueCu3jTJ6MebzM1FgTwW HTTP 301
- http://app.sendx.io/api/v1/track/campaign/click/ndU1nbZtXCcPuskiU2q0oo/1IueCu3jTJ6MebzM1FgTwW HTTP 302
- https://51.fi/f8R?utm_campaign=Ruralvia&utm_content=Acceso+Banca+internet&utm_medium=email&utm_source=sendx
- https://api.51.fi/f8R?cb=1635323944537 HTTP 308
- https://xfin.tv/3mcNPBb HTTP 301
- https://www.xfinity.com/mobile/cima-logout.html?continue=%0Ahttps://rura56788544.blogspot.com/
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
f8R
51.fi/ Redirect Chain
|
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
699 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.e9b67983.chunk.css
51.fi/static/css/ |
225 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.3058547b.chunk.css
51.fi/static/css/ |
993 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.f2995001.chunk.js
51.fi/static/js/ |
500 KB 140 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.fb71ab67.chunk.js
51.fi/static/js/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cima-logout.html
www.xfinity.com/mobile/ Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
6194338d
www.xfinity.com/akam/11/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wOjAB
www.xfinity.com/3GTB1cTa-3VExbSvVsotmSJZ/SYYu6L8ta5V1/BGEpQGNdAg/OQkGIxo/ |
77 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
rura56788544.blogspot.com/ |
63 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
reservatio.temp.swtest.ru/2/ |
108 KB 68 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
683 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.xfinity.com
- URL
- https://www.xfinity.com/akam/11/6194338d
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Grupo Caja Rural (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
app.sendx.io/ | Name: sendx_sess Value: 30f2f1cba114c0a77afa3b896595aa0f |
|
.xfin.tv/ | Name: _bit Value: l9r8D5-afd7a1a00a92e72aab-00Y |
|
.xfinity.com/ | Name: AKA_A2 Value: A |
|
.xfinity.com/ | Name: ak_bmsc Value: 321E2330127F8F323DB2785341CB5041~000000000000000000000000000000~YAAQFLUQAiSfyLx8AQAASyLnwA1TWYUyAU/5vcrcCt8ung7T1n91oRqbJ5nAFRqZL4VKrp1XOdlR0bsbiUiI2zbAvnTF3Qn2nyZw6YA1TFgIXkaOtXrTOssbw+Gdqq81eZbVozgvv1OdIRJMe9vjmFoUk4ucAy9z5Ee/OLodpAn6bpUgMvuEVun2RXadHkStX2nudHOgJe/jqDJZVkBLCLKmPMGjwsQg3hI1tZ7AbaDFOCZh7lJhlljr75jdQ9fy0FbSZcHQS9EMoS7SeVYlq7V57P8PlC8YNozfzvFUnYHoe2xxjYzM449CoJ2/+Ywa+UHLTkQ4GVYrJ6UNkhxKYvFufwY6vpLO33RZ2f7AzNKRwIyGzL9mfR+s2lsYQ/9erPanj8if92o7STPp |
|
.xfinity.com/ | Name: bm_sz Value: 375B5615EBEFEDC6DB184BCAA1A3509E~YAAQFLUQAiWfyLx8AQAASyLnwA0h5kUYbpct0WKzYrjKsyU2S7gZRls4JdfyVE58F5Oo6qCQyJUSUGx3rcEJ4F9NvfDmH/yLhGevh9ZbW53JrzQggOl2WdJgxGLzTEvuK27QI0CBeFqjViCE0gOmnuszzuEWA8eFVbYgyAItRV14Obcph11K3pM1DBo3QVgPvteCpn7YOHbiSmh9IKfqNlM367e3vaWYCg1iuoE6CjGwAseQKouNQ04FK0QeidAD2JXv9OXRlvf746ntxVxRFXMTtWjhj/BI4SuaPZI3Y3Lhdt8V~3425092~4469048 |
|
.xfinity.com/ | Name: _abck Value: 9477496B2A0272F41B3F7426A7826C9B~-1~YAAQFLUQAiafyLx8AQAAniLnwAZ34zqrCGM7KDscVQNf5T6evt0hIOzcTqjesaKTUwKF/unl1xS/eULDfdGIEAtQQXJSFP56BjGBifm/bktSwB5ImmH6uCjgcmeHB3g8FE21Dv3eLYEBcio9O/FO34n2U3h447KknkGMwDa00LW/OIuefk5hCkYK4oreUL1hNemgBGxfiJHq6UP+VeqKnuH02ZUfSIU+RWo6YY7ga+VLcsu9iycUXrWuJE4SoaVT9Bmy2rIHdxXPiaXfPqkEZovxCPFHmNyI6Lb/XKxU8aY5z4rtHebdIlGWKJYxgoO/sbOWfzlnHU/Van7s7df1+e7OlI9z7j/0oRHRA41EQ1RKRdH108bs7mXbtulruz+J/VoOcHckJ48Bypo=~-1~-1~-1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
51.fi
api.51.fi
api.xsend8.email
app.sendx.io
fonts.googleapis.com
reservatio.temp.swtest.ru
rura56788544.blogspot.com
www.xfinity.com
xfin.tv
www.xfinity.com
13.225.87.11
142.250.185.234
142.250.74.193
143.204.98.16
23.45.108.127
3.214.235.32
67.199.248.12
77.222.40.7
1931f9326b0377fdad5f7910eadae9570912eebe0076f1e2b09da58378c5eb11
4afe3905d2c584eacf57bca32ddc9358f49613a7e5e3a3fba315191d60f85fd4
77927acfd732e9631541d0030a3dfdeb7315af91b30e1f954afefbeee44343c6
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a7437ba825edd317914a9d7e90bf9425dd7e90e8a56dee13fe2e1b2ac394927f
aad5e9744b12853a66dc04189bfbba8b367613e51643aa91b000563074d3672b
c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7
c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c
f641f6e2027f7477309dbe817cc48137f4ef7ea6d7c574343acf61efb7144627