dev-seguronlie.pantheonsite.io
Open in
urlscan Pro
2620:12a:8000::2
Malicious Activity!
Public Scan
Submission: On September 21 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Organization Validation S... on June 6th 2023. Valid for: a year.
This is the only time dev-seguronlie.pantheonsite.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Cuscatlan de El Salvador (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 2620:12a:8000::2 2620:12a:8000::2 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 173.231.16.77 173.231.16.77 | 18450 (WEBNX) (WEBNX) | |
1 | 34.117.59.81 34.117.59.81 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
12 | 5 |
ASN18450 (WEBNX, US)
PTR: 173-231-16-77.static.webnx.com
api.ipify.org |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com
ipinfo.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
pantheonsite.io
dev-seguronlie.pantheonsite.io |
887 KB |
1 |
ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 6308 |
527 B |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2769 |
224 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 720 |
31 KB |
12 | 4 |
Domain | Requested by | |
---|---|---|
9 | dev-seguronlie.pantheonsite.io |
dev-seguronlie.pantheonsite.io
|
1 | ipinfo.io |
ajax.googleapis.com
|
1 | api.ipify.org |
ajax.googleapis.com
|
1 | ajax.googleapis.com |
dev-seguronlie.pantheonsite.io
|
12 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
pantheonsite.io Sectigo RSA Organization Validation Secure Server CA |
2023-06-06 - 2024-07-06 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-09-04 - 2023-11-27 |
3 months | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2023-02-07 - 2024-02-18 |
a year | crt.sh |
ipinfo.io R3 |
2023-08-09 - 2023-11-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dev-seguronlie.pantheonsite.io/
Frame ID: 1C63459148B1B594BC9768A1922C32C5
Requests: 13 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
dev-seguronlie.pantheonsite.io/ |
1 MB 153 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.39921502ffc3308e5cf0.bundle.css
dev-seguronlie.pantheonsite.io/css/ |
103 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
estilos.css
dev-seguronlie.pantheonsite.io/css/ |
1 MB 142 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prismaWeb.css
dev-seguronlie.pantheonsite.io/css/ |
123 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
keyboardLowerCaseLowContrast.png
dev-seguronlie.pantheonsite.io/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6f851c1f8a2197e8215bfba708791e38.jpg
dev-seguronlie.pantheonsite.io/img/ |
104 KB 104 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sax.js
dev-seguronlie.pantheonsite.io/js/ |
1 KB 861 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
24 B 224 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ipinfo.io/ |
262 B 527 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Regular.14077b877bbfbc815a94.woff2
dev-seguronlie.pantheonsite.io/css/ |
50 KB 50 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
streamline.7b5e048cdbd03151c26c.woff
dev-seguronlie.pantheonsite.io/css/ |
387 KB 388 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Cuscatlan de El Salvador (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery string| telegram_bot_id number| chat_id undefined| u_name undefined| pax undefined| pax2 undefined| ip undefined| ip2 function| ready function| sender0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=300 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipify.org
dev-seguronlie.pantheonsite.io
ipinfo.io
173.231.16.77
2620:12a:8000::2
2a00:1450:4001:827::200a
34.117.59.81
2f18fa032a6f7995289bb09a107759827bea81d5ee505cc98b8f7f6ee1e0d807
3d77e17eff7ff31b8e3fd2871efd8806a4d037aa2b4c7f196e7aa765dfc692fb
6c8b35760fefe68e1ef1fd3859aebffd5aa4cc485cddd5cc9c53c57142269609
8f6a104cd4b21036f18de684bcad20a906cb59e6d5e5337458ca57179e002871
a5de04da95c817b81756c43201a7a4e80c13b6074642819a4908b58a5d965b6e
a9250e188e59d4a24ca87e42656357f7a0669a31d0f330939078acf7f3cd882d
b08aa0320bab8817e3d30ecfe71a01eff590881794d735282bf1558f4a1a6d69
c9af0960dd8c09899e40b5a80148419e4642db6bfdd856e207526a51b8b99fa9
d7d908335b484d3310b807cbf69b666341a6234b6eeaa337f8b779dc9411d025
e2f4ead06057e7ced0b5cbc89280a655ba66ea4d6fe54fa2c8381d35e278c4f9
e6e29922e8467a5db6fcd491ab7fa38ee746992abbf39db4db06d59d53bb20b2
f3eada35f785744654e96d7143682e90809fbe1c856be4868597d1bd27edb6a9
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d