particulares-verificacion.xyz Open in urlscan Pro
2606:4700:3036::6815:32a5 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://particulares-verificacion.xyz/login.php
Submission: On April 24 via api (April 24th 2022, 12:08:06 am UTC) from JP — Scanned from JP

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3036::6815:32a5, located in United States and belongs to CLOUDFLARENET, US. The main domain is particulares-verificacion.xyz.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 22nd 2022. Valid for: a year.

This is the only time particulares-verificacion.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BBVA (Financial)

Domain & IP information

	IP Address		AS Autonomous System
2 4	2606:4700:303... 2606:4700:3036::6815:32a5		13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2

4 2606:4700:3036::6815:32a5 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

particulares-verificacion.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	particulares-verificacion.xyz 2 redirects particulares-verificacion.xyz	14 KB
8	1

	Domain	Requested by
4	particulares-verificacion.xyz	2 redirects particulares-verificacion.xyz
8	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-04-22` - `2023-04-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://particulares-verificacion.xyz/login.php
Frame ID: B69A29AF95F2C4D658360C1B2A137D8F
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://particulares-verificacion.xyz/login.php HTTP 302
https://particulares-verificacion.xyz/ HTTP 302
https://particulares-verificacion.xyz/static Page URL
https://particulares-verificacion.xyz/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

8
Requests

25 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

13 kB
Transfer

52 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://particulares-verificacion.xyz/login.php HTTP 302
https://particulares-verificacion.xyz/ HTTP 302
https://particulares-verificacion.xyz/static Page URL
https://particulares-verificacion.xyz/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://particulares-verificacion.xyz/login.php HTTP 302
https://particulares-verificacion.xyz/ HTTP 302
https://particulares-verificacion.xyz/static

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	static Show response particulares-verificacion.xyz/ Redirect Chain https://particulares-verificacion.xyz/login.php https://particulares-verificacion.xyz/ https://particulares-verificacion.xyz/static	15 KB 5 KB	483ms 483ms	Document text/html	2606:4700:3036::6815:32a5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://particulares-verificacion.xyz/static Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:32a5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7a7bf6e378fc401286b5b5ed4d2dbece4fb4bb07f313de11865517aaa5d2798e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 700a9a203aa380bd-NRT content-encoding br content-type text/html; charset=UTF-8 date Sun, 24 Apr 2022 00:08:01 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yui0vV6BzD3Vb2apRI7iHpJSt0Tr9QkkXnBMgb8zbhQsBzIsNY%2BSwl9qTwKFs9OxI56YpFJBX4lSzu2j22l3lXNjvKhUXAL1KFS0vrEB1tB7apJkRZEql0vBNmAik0rfacUzwHcVUrr24NBVpfwh4qm2BUvd5i2gElh3kg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 700a9a1d4a68809c-NRT content-type text/html; charset=UTF-8 date Sun, 24 Apr 2022 00:08:01 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" expires Thu, 19 Nov 1981 08:52:00 GMT location ./static nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ALzfsDlkpaOO1GiRN4jdQVXVKNNK8ST9OTA4kA6h3TVgJULcj7%2BMjWVWnhxPuOfzqfRQxg%2F7F57T0dkHW61D1dKUzikbhffw%2BSeNfcz6%2BSiVABwV67jd0f8d6nqJOI0UrAZP0IIu2CZMzH0HwJJpJv973lCKiHMlkOiuA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H3	200	Primary Request login.php Show response particulares-verificacion.xyz/	37 KB 8 KB	246ms 246ms	Document text/html	2606:4700:3036::6815:32a5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://particulares-verificacion.xyz/login.php Requested by Host: particulares-verificacion.xyz URL: https://particulares-verificacion.xyz/static Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::6815:32a5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a31b0ec1c41b20bf182037a552803c6245a7d12c951d531303f4cb517516e870` Request headers Referer https://particulares-verificacion.xyz/static Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 700a9a393da780bd-NRT content-encoding br content-type text/html; charset=UTF-8 date Sun, 24 Apr 2022 00:08:05 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FSAz5Sz7kltAvk2qZ8WfB4NOBdKPRo3y26R3RTQNYYRukDf55YyMTqdLj4s8O0Ut%2FEakgCjZqO95mM7x%2Bck6hOsUyjnAqbr0PkC28IiYGkAPxYYDsc%2BTw8zPwJcIfFNt2YlFpBwqge7t18IMis19ynfNYkDH3JgMJ8fx4g%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET		buzz.css particulares-verificacion.xyz/assets/	0 0

GET		vendor.css particulares-verificacion.xyz/assets/	0 0

GET		app.min.css particulares-verificacion.xyz/assets/	0 0

GET		jquery-3.5.1.min.js particulares-verificacion.xyz/assets/js/	0 0

GET		jquery.cookie.js particulares-verificacion.xyz/assets/js/	0 0

GET		logo-white.svg particulares-verificacion.xyz/assets/svg/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: particulares-verificacion.xyz
URL: https://particulares-verificacion.xyz/assets/buzz.css

Domain: particulares-verificacion.xyz
URL: https://particulares-verificacion.xyz/assets/vendor.css

Domain: particulares-verificacion.xyz
URL: https://particulares-verificacion.xyz/assets/app.min.css

Domain: particulares-verificacion.xyz
URL: https://particulares-verificacion.xyz/assets/js/jquery-3.5.1.min.js

Domain: particulares-verificacion.xyz
URL: https://particulares-verificacion.xyz/assets/js/jquery.cookie.js

Domain: particulares-verificacion.xyz
URL: https://particulares-verificacion.xyz/assets/svg/logo-white.svg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BBVA (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			particulares-verificacion.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: b0fbhphnnjh5pd458dr4cqq41t

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

particulares-verificacion.xyz
particulares-verificacion.xyz
2606:4700:3036::6815:32a5
7a7bf6e378fc401286b5b5ed4d2dbece4fb4bb07f313de11865517aaa5d2798e
a31b0ec1c41b20bf182037a552803c6245a7d12c951d531303f4cb517516e870

particulares-verificacion.xyz Open in urlscan Pro 2606:4700:3036::6815:32a5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

25 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

13 kBTransfer

52 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

particulares-verificacion.xyz Open in urlscan Pro
2606:4700:3036::6815:32a5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

25 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

13 kB
Transfer

52 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!