promericagt.com Open in urlscan Pro
2a02:7b40:3e4d:9982::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://promericagt.com/bl/pb/pages/administration/bienvenidos.php
Submission: On March 01 via manual (March 1st 2022, 8:56:48 pm UTC) from GT — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2a02:7b40:3e4d:9982::1, located in Lithuania and belongs to RACKRAY UAB Rakrejus, LT. The main domain is promericagt.com.
TLS certificate: Issued by R3 on February 27th 2022. Valid for: 3 months.

This is the only time promericagt.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Promerica (Banking)

Domain & IP information

	IP Address		AS Autonomous System
8	2a02:7b40:3e4... 2a02:7b40:3e4d:9982::1		62282 (RACKRAY U...) (RACKRAY UAB Rakrejus)
8	1

8 2a02:7b40:3e4d:9982::1 (Lithuania)

ASN62282 (RACKRAY UAB Rakrejus, LT)

promericagt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	promericagt.com promericagt.com	143 KB
8	1

	Domain	Requested by
8	promericagt.com	promericagt.com
8	1

This site contains no links.

Subject Issuer	Validity	Valid
promericagt.com R3	`2022-02-27` - `2022-05-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://promericagt.com/bl/pb/pages/administration/bienvenidos.php
Frame ID: 04AE30328DFF1891B76355D42AE1612E
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Promerica

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

143 kB
Transfer

502 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request bienvenidos.php Show response promericagt.com/bl/pb/pages/administration/	6 KB 2 KB	185ms 73ms	Document text/html	2a02:7b40:3e4d:9982::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://promericagt.com/bl/pb/pages/administration/bienvenidos.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:7b40:3e4d:9982::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `468bdd00406ade8c5f529f46c89655f81785e58830f91aad7fa738842b5a42dc` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache vary Accept-Encoding,User-Agent content-encoding gzip content-length 2146 content-type text/html date Tue, 01 Mar 2022 20:56:43 GMT server Apache
GET H2	200	bootstrap.css promericagt.com/bl/pb/pages/administration/css/	158 KB 21 KB	118ms 117ms	Stylesheet text/css	2a02:7b40:3e4d:9982::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://promericagt.com/bl/pb/pages/administration/css/bootstrap.css Requested by Host: promericagt.com URL: https://promericagt.com/bl/pb/pages/administration/bienvenidos.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:7b40:3e4d:9982::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `f5795551918b85a3a173075b2e8b0583da923b2c32d738d57c12f9210fab9598` Request headers Accept-Language de-DE,de;q=0.9 Referer https://promericagt.com/bl/pb/pages/administration/bienvenidos.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 20:56:44 GMT content-encoding gzip last-modified Thu, 03 Feb 2022 20:54:08 GMT server Apache vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=604800 accept-ranges bytes content-length 21535 expires Tue, 08 Mar 2022 20:56:44 GMT
GET H2	200	jquery.js Show response promericagt.com/bl/pb/pages/administration/lib/	580 B 490 B	62ms 61ms	Script application/javascript	2a02:7b40:3e4d:9982::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://promericagt.com/bl/pb/pages/administration/lib/jquery.js Requested by Host: promericagt.com URL: https://promericagt.com/bl/pb/pages/administration/bienvenidos.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:7b40:3e4d:9982::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `e61c2316561f4005e049fe421fe284b92e8d9e39420b1d2e2f122021d492344b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://promericagt.com/bl/pb/pages/administration/bienvenidos.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 20:56:44 GMT content-encoding gzip last-modified Sat, 15 Jun 2019 03:15:46 GMT server Apache vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=604800 accept-ranges bytes content-length 354 expires Tue, 08 Mar 2022 20:56:44 GMT
GET H2	200	jquery.validate.js Show response promericagt.com/bl/pb/pages/administration/dist/	50 KB 13 KB	64ms 64ms	Script application/javascript	2a02:7b40:3e4d:9982::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://promericagt.com/bl/pb/pages/administration/dist/jquery.validate.js Requested by Host: promericagt.com URL: https://promericagt.com/bl/pb/pages/administration/bienvenidos.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:7b40:3e4d:9982::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `acbcc668499cfd9457ce36437c698e926acd18de8cfc1d6330760f3eecf362a9` Request headers Accept-Language de-DE,de;q=0.9 Referer https://promericagt.com/bl/pb/pages/administration/bienvenidos.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 20:56:44 GMT content-encoding gzip last-modified Sat, 15 Jun 2019 03:20:46 GMT server Apache vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=604800 accept-ranges bytes content-length 13531 expires Tue, 08 Mar 2022 20:56:44 GMT
GET H2	200	img_panel_centro.png promericagt.com/bl/pb/pages/administration/	18 KB 18 KB	65ms 64ms	Image image/png	2a02:7b40:3e4d:9982::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Show image Full URL https://promericagt.com/bl/pb/pages/administration/img_panel_centro.png Requested by Host: promericagt.com URL: https://promericagt.com/bl/pb/pages/administration/bienvenidos.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:7b40:3e4d:9982::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `25e58236dea2b2aec6dea5e851c2af06b4eea8b11c56138d1aa88d1a4c6fce25` Request headers Accept-Language de-DE,de;q=0.9 Referer https://promericagt.com/bl/pb/pages/administration/bienvenidos.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 20:56:44 GMT last-modified Mon, 07 Jan 2019 22:32:12 GMT server Apache content-type image/png cache-control max-age=604800 accept-ranges bytes content-length 18632 expires Tue, 08 Mar 2022 20:56:44 GMT
GET H2	200	ima_debajo.png promericagt.com/bl/pb/pages/administration/	479 B 542 B	63ms 62ms	Image image/png	2a02:7b40:3e4d:9982::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Show image Full URL https://promericagt.com/bl/pb/pages/administration/ima_debajo.png Requested by Host: promericagt.com URL: https://promericagt.com/bl/pb/pages/administration/bienvenidos.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:7b40:3e4d:9982::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `cfd01355b3a445c385cbe83b78ab7d5b04abe37e36ceccb2a8a59e72f9659051` Request headers Accept-Language de-DE,de;q=0.9 Referer https://promericagt.com/bl/pb/pages/administration/bienvenidos.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 20:56:44 GMT last-modified Mon, 07 Jan 2019 23:27:28 GMT server Apache content-type image/png cache-control max-age=604800 accept-ranges bytes content-length 479 expires Tue, 08 Mar 2022 20:56:44 GMT
GET H2	200	jquery-3.1.1.js Show response promericagt.com/bl/pb/pages/administration/lib/	261 KB 78 KB	75ms 74ms	Script application/javascript	2a02:7b40:3e4d:9982::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://promericagt.com/bl/pb/pages/administration/lib/jquery-3.1.1.js Requested by Host: promericagt.com URL: https://promericagt.com/bl/pb/pages/administration/lib/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:7b40:3e4d:9982::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `d7a71d3dd740e95755227ba6446a3a21b8af6c4444f29ec2411dc7cd306e10b0` Request headers Accept-Language de-DE,de;q=0.9 Referer https://promericagt.com/bl/pb/pages/administration/bienvenidos.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 20:56:44 GMT content-encoding gzip last-modified Sat, 15 Jun 2019 03:15:46 GMT server Apache vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=604800 accept-ranges bytes expires Tue, 08 Mar 2022 20:56:44 GMT
GET H2	200	giphy.gif promericagt.com/bl/pb/pages/administration/	9 KB 9 KB	66ms 65ms	Image image/gif	2a02:7b40:3e4d:9982::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Show image Full URL https://promericagt.com/bl/pb/pages/administration/giphy.gif Requested by Host: promericagt.com URL: https://promericagt.com/bl/pb/pages/administration/bienvenidos.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:7b40:3e4d:9982::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `37fea8aee232ca033a84f5f7cda0eb8acee05583965cf2a461f3b7269f53e387` Request headers Accept-Language de-DE,de;q=0.9 Referer https://promericagt.com/bl/pb/pages/administration/bienvenidos.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 20:56:44 GMT last-modified Wed, 19 Feb 2020 12:57:58 GMT server Apache content-type image/gif cache-control max-age=604800 accept-ranges bytes content-length 8821 expires Tue, 08 Mar 2022 20:56:44 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Promerica (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone function| $ function| jQuery function| valideKey

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			promericagt.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: kr1agof71s8g7fthskrgrl1k00

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

promericagt.com
2a02:7b40:3e4d:9982::1
25e58236dea2b2aec6dea5e851c2af06b4eea8b11c56138d1aa88d1a4c6fce25
37fea8aee232ca033a84f5f7cda0eb8acee05583965cf2a461f3b7269f53e387
468bdd00406ade8c5f529f46c89655f81785e58830f91aad7fa738842b5a42dc
acbcc668499cfd9457ce36437c698e926acd18de8cfc1d6330760f3eecf362a9
cfd01355b3a445c385cbe83b78ab7d5b04abe37e36ceccb2a8a59e72f9659051
d7a71d3dd740e95755227ba6446a3a21b8af6c4444f29ec2411dc7cd306e10b0
e61c2316561f4005e049fe421fe284b92e8d9e39420b1d2e2f122021d492344b
f5795551918b85a3a173075b2e8b0583da923b2c32d738d57c12f9210fab9598

promericagt.com Open in urlscan Pro 2a02:7b40:3e4d:9982::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

143 kBTransfer

502 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

promericagt.com Open in urlscan Pro
2a02:7b40:3e4d:9982::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

143 kB
Transfer

502 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!