URL: https://treasury-money-vault.com/MV_GLogin.php
Submission Tags: @ecarlesi possiblethreat phishing opendir Search All
Submission: On October 30 via api from IT — Scanned from IT

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 165.22.182.121, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is treasury-money-vault.com.
TLS certificate: Issued by R11 on October 28th 2024. Valid for: 3 months.
This is the only time treasury-money-vault.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 165.22.182.121 14061 (DIGITALOC...)
3 2a00:1450:402... 15169 (GOOGLE)
10 2
Apex Domain
Subdomains
Transfer
7 treasury-money-vault.com
treasury-money-vault.com
2 MB
3 google.com
accounts.google.com — Cisco Umbrella Rank: 18
87 KB
10 2
Domain Requested by
7 treasury-money-vault.com treasury-money-vault.com
3 accounts.google.com treasury-money-vault.com
accounts.google.com
10 2

This site contains links to these domains. Also see Links.

Domain
plaid.com
Subject Issuer Validity Valid
treasury-money-vault.com
R11
2024-10-28 -
2025-01-26
3 months crt.sh
accounts.google.com
WR2
2024-10-07 -
2024-12-30
3 months crt.sh

This page contains 2 frames:

Primary Page: https://treasury-money-vault.com/MV_GLogin.php
Frame ID: A587921A1CEB8D16B26B6C8823419D72
Requests: 9 HTTP requests in this frame

Frame: https://accounts.google.com/gsi/button?theme=outline&size=large&client_id=1041843818116-jdlovup075ar8rpk4m6c3o0mbm4i5b5d.apps.googleusercontent.com&iframe_id=gsi_619293_549283&as=qVaqhVW9fuoZB5TIBcuJLw
Frame ID: 71A249A4803748648330B534657F194E
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

MV Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • accounts\.google\.com/gsi/client

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

2323 kB
Transfer

2468 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request MV_GLogin.php
treasury-money-vault.com/
4 KB
2 KB
Document
General
Full URL
https://treasury-money-vault.com/MV_GLogin.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
165.22.182.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
3878801be6ffb818ea1ba34118ccbefb3c87324cb8f0e6143accbedf16cca501

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1219
Content-Type
text/html; charset=UTF-8
Date
Wed, 30 Oct 2024 02:50:17 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache/2.4.52 (Ubuntu)
Vary
Accept-Encoding
MV_TextStyleSheet.css
treasury-money-vault.com/css/
5 KB
2 KB
Stylesheet
General
Full URL
https://treasury-money-vault.com/css/MV_TextStyleSheet.css
Requested by
Host: treasury-money-vault.com
URL: https://treasury-money-vault.com/MV_GLogin.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
165.22.182.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
ae59dc106ccbac80e0e4c1b64441efaf51e15f3c716cfc4a178ffdb92c19e460

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://treasury-money-vault.com/MV_GLogin.php

Response headers

Content-Encoding
gzip
ETag
"1336-6249d80d25f80-gzip"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1426
Keep-Alive
timeout=5, max=99
Date
Wed, 30 Oct 2024 02:50:17 GMT
Last-Modified
Wed, 16 Oct 2024 19:59:10 GMT
Vary
Accept-Encoding
Server
Apache/2.4.52 (Ubuntu)
Content-Type
text/css
client
accounts.google.com/gsi/
227 KB
86 KB
Script
General
Full URL
https://accounts.google.com/gsi/client
Requested by
Host: treasury-money-vault.com
URL: https://treasury-money-vault.com/MV_GLogin.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4025:402::54 Den Helder, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6783e787c36b11e4f4f9f64162f22125bde57bf637f7c36898faff035620f818
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-c3dV7VjsDJ5nSZHCc15qqQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://treasury-money-vault.com/

Response headers

content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-c3dV7VjsDJ5nSZHCc15qqQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
cache-control
private, max-age=1800
content-encoding
gzip
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
x-content-type-options
nosniff
expires
Wed, 30 Oct 2024 02:50:18 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
date
Wed, 30 Oct 2024 02:50:18 GMT
x-xss-protection
0
content-type
application/javascript; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server
ESF
x-frame-options
SAMEORIGIN
mv_logo3.png
treasury-money-vault.com/images/
192 KB
192 KB
Image
General
Full URL
https://treasury-money-vault.com/images/mv_logo3.png
Requested by
Host: treasury-money-vault.com
URL: https://treasury-money-vault.com/MV_GLogin.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
165.22.182.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
e5cbf9931f4640750d17f8ae265cab61b4664e81bb197a34ad83235f9ffd29b0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://treasury-money-vault.com/MV_GLogin.php

Response headers

ETag
"300d1-619c22c9b77c0"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
196817
Keep-Alive
timeout=5, max=98
Date
Wed, 30 Oct 2024 02:50:18 GMT
Last-Modified
Fri, 31 May 2024 16:07:03 GMT
Content-Type
image/png
Server
Apache/2.4.52 (Ubuntu)
Plaid_logo.png
treasury-money-vault.com/images/
97 KB
97 KB
Image
General
Full URL
https://treasury-money-vault.com/images/Plaid_logo.png
Requested by
Host: treasury-money-vault.com
URL: https://treasury-money-vault.com/MV_GLogin.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
165.22.182.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
1642a46b36882b8c218e4e1d7bdd45abbb78378cf49e259c4a068525370a6097

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://treasury-money-vault.com/MV_GLogin.php

Response headers

ETag
"182ce-6247607363d80"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
99022
Keep-Alive
timeout=5, max=100
Date
Wed, 30 Oct 2024 02:50:18 GMT
Last-Modified
Mon, 14 Oct 2024 20:53:26 GMT
Content-Type
image/png
Server
Apache/2.4.52 (Ubuntu)
MV_login.js
treasury-money-vault.com/js/
2 KB
1 KB
Script
General
Full URL
https://treasury-money-vault.com/js/MV_login.js
Requested by
Host: treasury-money-vault.com
URL: https://treasury-money-vault.com/MV_GLogin.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
165.22.182.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
8e7be24ad7ee610f866a86a9fff61f7dde87adbec4f35a9b26b109fa1ef322c7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://treasury-money-vault.com/MV_GLogin.php

Response headers

Content-Encoding
gzip
ETag
"911-623a64d8ea040-gzip"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
800
Keep-Alive
timeout=5, max=100
Date
Wed, 30 Oct 2024 02:50:18 GMT
Last-Modified
Fri, 04 Oct 2024 13:03:53 GMT
Vary
Accept-Encoding
Server
Apache/2.4.52 (Ubuntu)
Content-Type
text/javascript
mv_background_sky.png
treasury-money-vault.com/images/
2 MB
2 MB
Image
General
Full URL
https://treasury-money-vault.com/images/mv_background_sky.png
Requested by
Host: treasury-money-vault.com
URL: https://treasury-money-vault.com/css/MV_TextStyleSheet.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
165.22.182.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
17c1d2a938a17603b74a81cf2656087ca51c6745f5d5fcdbb08e0a5af14ec419

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://treasury-money-vault.com/css/MV_TextStyleSheet.css

Response headers

ETag
"1e1a7a-6236ee3884fc0"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1972858
Keep-Alive
timeout=5, max=100
Date
Wed, 30 Oct 2024 02:50:18 GMT
Last-Modified
Tue, 01 Oct 2024 18:57:11 GMT
Content-Type
image/png
Server
Apache/2.4.52 (Ubuntu)
style
accounts.google.com/gsi/
533 B
610 B
Stylesheet
General
Full URL
https://accounts.google.com/gsi/style
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4025:402::54 Den Helder, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-jjiTVRHJvD79WOYLOOoBnA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://treasury-money-vault.com/

Response headers

content-security-policy
script-src 'report-sample' 'nonce-jjiTVRHJvD79WOYLOOoBnA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
cache-control
private, max-age=86400
content-encoding
gzip
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
x-content-type-options
nosniff
expires
Wed, 30 Oct 2024 02:50:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
date
Wed, 30 Oct 2024 02:50:19 GMT
x-xss-protection
0
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server
ESF
x-frame-options
SAMEORIGIN
button
accounts.google.com/gsi/ Frame 71A2
0
0
Document
General
Full URL
https://accounts.google.com/gsi/button?theme=outline&size=large&client_id=1041843818116-jdlovup075ar8rpk4m6c3o0mbm4i5b5d.apps.googleusercontent.com&iframe_id=gsi_619293_549283&as=qVaqhVW9fuoZB5TIBcuJLw
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4025:402::54 Den Helder, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-MhSnMAXOVykYo-ZDUBsklQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://treasury-money-vault.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-MhSnMAXOVykYo-ZDUBsklQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
cross-origin-resource-policy
cross-origin
date
Wed, 30 Oct 2024 02:50:19 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
server
ESF
x-content-type-options
nosniff
x-xss-protection
0
favicon.ico
treasury-money-vault.com/
15 KB
15 KB
Other
General
Full URL
https://treasury-money-vault.com/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
165.22.182.121 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
e19bad0c89d63369240ff125a043e642c4db56bbe5e9d5f5f63540d7be20be65

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://treasury-money-vault.com/MV_GLogin.php

Response headers

ETag
"3aee-6236fbc7e4dc0"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
15086
Keep-Alive
timeout=5, max=99
Date
Wed, 30 Oct 2024 02:50:19 GMT
Last-Modified
Tue, 01 Oct 2024 19:57:51 GMT
Content-Type
image/vnd.microsoft.icon
Server
Apache/2.4.52 (Ubuntu)

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| default_gsi object| _F_toggles object| google function| handleCredentialResponse function| decodeJwtResponse object| closure_lm_185621 object| __G_ID_CLIENT__

1 Cookies

Domain/Path Name / Value
treasury-money-vault.com/ Name: PHPSESSID
Value: iqgokouhsjqc5u777brb36qnqt