webonlibes.ru.com
Open in
urlscan Pro
38.242.247.3
Malicious Activity!
Public Scan
URL:
https://webonlibes.ru.com/
Submission Tags: @phish_report
Submission: On January 10 via api from FI — Scanned from FI
Submission Tags: @phish_report
Submission: On January 10 via api from FI — Scanned from FI
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 11 HTTP transactions.
The main IP is 38.242.247.3, located in
Düsseldorf, Germany and
belongs to CONTABO, DE.
The main domain is webonlibes.ru.com.
TLS certificate: Issued by R3 on January 7th 2024. Valid for: 3 months.
This is the only time webonlibes.ru.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 7th 2024. Valid for: 3 months.
This is the only time webonlibes.ru.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BANPAIS (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 38.242.247.3 38.242.247.3 | 51167 (CONTABO) (CONTABO) | |
| 1 | 2606:4700:10:... 2606:4700:10::ac43:2997 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 2 | 2a00:1450:400... 2a00:1450:4001:806::200a | 15169 (GOOGLE) (GOOGLE) | |
| 11 | 3 |
8
38.242.247.3
(Düsseldorf, Germany)
ASN51167 (CONTABO, DE)
PTR: vmi1442144.contaboserver.net
ASN51167 (CONTABO, DE)
PTR: vmi1442144.contaboserver.net
| webonlibes.ru.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
ru.com
webonlibes.ru.com |
2 MB |
| 2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 115 |
3 KB |
| 1 |
bi.com.gt
images.bi.com.gt |
314 B |
| 11 | 3 |
| Domain | Requested by | |
|---|---|---|
| 8 | webonlibes.ru.com |
webonlibes.ru.com
|
| 2 | fonts.googleapis.com |
webonlibes.ru.com
|
| 1 | images.bi.com.gt |
webonlibes.ru.com
|
| 11 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| webonlibes.ru.com R3 |
2024-01-07 - 2024-04-06 |
3 months | crt.sh |
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-16 - 2024-05-15 |
a year | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2023-12-11 - 2024-03-04 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://webonlibes.ru.com/
Frame ID: 4019B9D2E9EFCE0FA54FB76C7CCED2F3
Requests: 11 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
webonlibes.ru.com/ |
315 KB 316 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles.89c1177e3244a69b5759.css
webonlibes.ru.com/online-banking/ |
830 KB 830 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
banpais_logo.png
webonlibes.ru.com/assets/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.png
images.bi.com.gt/files/0/77494c6738517a44557268734149446e326e776a306f7334464b6175577137315133567a4d6b6e4631336e6468414e776c7252432b7a2f374b3239724a417a7677654e484b4f787771636b354a52746c757565716e6b... |
70 B 314 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
22 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
8 KB 823 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
banpais_bg.e5ca6aaf77b65e1df90d.png
webonlibes.ru.com/online-banking/ |
965 KB 966 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Lato-normal-700.a354bb0b0b0f22de7bef.woff
webonlibes.ru.com/online-banking/ |
27 KB 28 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
banca-regional.b3302831d6ce31b2bece.woff
webonlibes.ru.com/online-banking/ |
16 KB 16 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Lato-normal-400.319df0f5492062b546b0.woff
webonlibes.ru.com/online-banking/ |
28 KB 28 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Lato-italic-400.17e7244f4b78c6b2c7e1.woff
webonlibes.ru.com/online-banking/ |
29 KB 29 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BANPAIS (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
images.bi.com.gt
webonlibes.ru.com
2606:4700:10::ac43:2997
2a00:1450:4001:806::200a
38.242.247.3
04050bae4cc3b9ccd20d3c7f57f5b1ba249d4a54d6eff75a1e4df504362e8c00
33a96f4d1f03d358709f3f9118ed6640145d54062ad7f6ee768208c4d4111dfc
74d29b5ddfb71cd4d1c2e8d0d38ffb9dc28a6cf41ba0d7f3bd72a7d145c4151d
8c7ccb0ae7337681fd2ea16e77956fd8eb19b87080237197c824d0af1e57b60a
98d2e3edd14aa506c4521125c7cdb7bb3030d7caae5803feec6d2613195ee955
99ec21212d0aea3370825b56214c6b3d75e99a657d3d4f097384e46a8a6c6632
9f5a6fb49257579436c7bd8d42fa5d052336132b6f9f8972a7c9c00d93ed18b4
b3d067407dcb4a68c8c04d64fe21d01f8eb8cc7710b78a0096adc96c0b658a69
cd80174a4080cc069b483035a249af558ccc4eb26efe5309549165cb1ea1ac25
d98792e1f2eaa92968f94c35f08da7b23db7333c79cdb657dca3a819d8e6d0d9
db5ce228533c885bafb72245fe89b9d945b0fba8865a6b7e8c37ae714d9bed9d