refaktor.org
Open in
urlscan Pro
68.66.197.163
Malicious Activity!
Public Scan
Effective URL: http://refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServlet.html
Submission: On September 12 via manual from US
Summary
This is the only time refaktor.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BBVA (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 41.222.244.34 41.222.244.34 | 37010 (NUS-AS) (NUS-AS) | |
2 18 | 68.66.197.163 68.66.197.163 | 55293 (A2HOSTING) (A2HOSTING - A2 Hosting) | |
1 | 186.113.14.51 186.113.14.51 | 32787 (PROLEXIC-...) (PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK - Akamai Technologies) | |
17 | 2 |
ASN55293 (A2HOSTING - A2 Hosting, Inc., US)
PTR: 68.66.197.163.static.a2webhosting.com
refaktor.org |
ASN32787 (PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK - Akamai Technologies, Inc., US)
PTR: www.bbva.com.co
www.bbva.com.co |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
refaktor.org
2 redirects
refaktor.org |
759 KB |
2 |
ur.ac.rw
2 redirects
law.ur.ac.rw |
514 B |
1 |
bbva.com.co
www.bbva.com.co |
711 KB |
17 | 3 |
Domain | Requested by | |
---|---|---|
18 | refaktor.org |
2 redirects
refaktor.org
|
2 | law.ur.ac.rw | 2 redirects |
1 | www.bbva.com.co |
refaktor.org
|
17 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
windows.microsoft.com |
www.bbva.com.co |
www.bbvanet.com.co |
nuevaversion.bbvanet.com.co |
www.bbvateinforma.com.co |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.bbva.com.co DigiCert SHA2 Extended Validation Server CA |
2018-04-24 - 2020-04-24 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServlet.html
Frame ID: E11C899BB80D8CE9236D22315F79FC7D
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://law.ur.ac.rw/sites/default/files/bvb/
HTTP 302
http://law.ur.ac.rw/sites/default/files/bvb/goo.php HTTP 302
http://refaktor.org/~9m/https/ HTTP 302
http://refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/index.php HTTP 302
http://refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/LogonOpera... Page URL
Detected technologies
OpenSSL (Web Server Extensions) ExpandDetected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- script /jquery-ui.*\.js/i
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- script /jquery-ui.*\.js/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: Actualiza tu navegador
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Regístrate
Search URL Search Domain Scan URL
Title: Olvidé mi contraseña
Search URL Search Domain Scan URL
Title: Aviso legal
Search URL Search Domain Scan URL
Title: Seguridad
Search URL Search Domain Scan URL
Title: Tarifas y otros avisos
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://law.ur.ac.rw/sites/default/files/bvb/
HTTP 302
http://law.ur.ac.rw/sites/default/files/bvb/goo.php HTTP 302
http://refaktor.org/~9m/https/ HTTP 302
http://refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/index.php HTTP 302
http://refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServlet.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
LogonOperacionServlet.html
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/ Redirect Chain
|
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
global.css
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/estilos/ |
288 KB 288 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/estilos/ |
120 KB 120 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.css
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/estilos/ |
34 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Logo_BBVA_Colombia_tcm1304-668421.svg
www.bbva.com.co/fbin/mult/ |
938 KB 711 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boostrap.min.js
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.min.js
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-login.jpg
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/estilos/img/ |
70 KB 70 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow-select-b.png
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/estilos/img/ |
425 B 750 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
coronita-icons-v2.ttf
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/estilos/fonts/coronita/coronita-icons-v2/ |
32 KB 33 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BentonSansBBVA-Bold.woff
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/estilos/fonts/coronita/benton/bold/ |
60 KB 61 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BentonSansBBVA-Book.woff
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/estilos/fonts/coronita/benton/book/ |
69 KB 69 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BentonSansBBVA-Medium.woff
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/estilos/fonts/coronita/benton/medium/ |
71 KB 71 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boostrap.min.js
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.min.js
refaktor.org/~9m/https/148.251.45.25434983/www.bbvanet.com.co/bbva/colombianet/choose/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BBVA (Financial)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| tagLogging20 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
law.ur.ac.rw
refaktor.org
www.bbva.com.co
186.113.14.51
41.222.244.34
68.66.197.163
0004dadcb7e8b8a2fa2ec411d1ab30135434c644c1aa914db3ac4b8ceb610110
2252078762616251f5af9d6473de26515dd6e8807552270c1cef50e92e0cde00
2f8c1b745db648a45650be066cda74e3d8d45b5c4d28ffd4a47a84e3fc307f2e
3083fbe6abf509978e8507eca89fd9e394320586c72c084889c798fc9b502c2d
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
6c87d2984458696bd0b7724ccb33690289b341cb8b20f0c385f7e8e7684b6e70
7af3360fe39c201b1ccbe7a726a5d3c2f0253add6616b71176f0d9e7c849a732
7f8e420a4ac3ea7f6fd081ce07234101414d27df260a6d547663f8e0c0efbaf4
8484b6c2c46c56e05107c49b7f96d2cdedc4e0a2152a80b55fa746224828e7a5
e793f79e1e684dfd3538880ae4e97f9d630b86a7f0cb519905ea286a06231819
faef4c0bda0c3c95f57f42c990d7623eedb0d7f8174a6640ff4114f1091217ec