opplemea.com Open in urlscan Pro
92.204.214.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://opplemea.com/
Submission Tags: @phish_report
Submission: On November 11 via api (November 11th 2023, 10:55:06 am UTC) from FI — Scanned from FR

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 5 domains to perform 15 HTTP transactions. The main IP is 92.204.214.188, located in Strasbourg, France and belongs to GODADDY-SXB, DE. The main domain is opplemea.com.

This is the only time opplemea.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BBVA (Financial)

Domain & IP information

	IP Address	AS Autonomous System
10	92.204.214.188 92.204.214.188	21499 (GODADDY-SXB) (GODADDY-SXB)
1 2	2.19.126.92 2.19.126.92	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	2600:9000:223... 2600:9000:223e:2400:5:880b:42c0:21	16509 (AMAZON-02) (AMAZON-02)
3	23.36.237.230 23.36.237.230	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
15	4

10 92.204.214.188 (Strasbourg, France)

ASN21499 (GODADDY-SXB, DE)
PTR: 188.214.204.92.host.secureserver.net

opplemea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.19.126.92 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-19-126-92.deploy.static.akamaitechnologies.com

secure-ds.serving-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223e:2400:5:880b:42c0:21 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

dsy67kqg9gcnf.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.36.237.230 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-237-230.deploy.static.akamaitechnologies.com

mobile.bbva.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	opplemea.com opplemea.com	509 KB
3	bbva.it mobile.bbva.it	2 KB
2	serving-sys.com 1 redirects secure-ds.serving-sys.com — Cisco Umbrella Rank: 2642	22 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 762	32 KB
1	cloudfront.net 1 redirects dsy67kqg9gcnf.cloudfront.net	509 B
15	5

	Domain	Requested by
10	opplemea.com	opplemea.com code.jquery.com
3	mobile.bbva.it	opplemea.com
2	secure-ds.serving-sys.com	1 redirects opplemea.com
1	code.jquery.com	opplemea.com
1	dsy67kqg9gcnf.cloudfront.net	1 redirects
15	5

This site contains no links.

Subject Issuer	Validity	Valid
bbva.com DigiCert TLS RSA SHA256 2020 CA1	`2023-05-15` - `2024-05-16`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://opplemea.com/
Frame ID: 49DE6C13A371D87574DF1E79FD372ACC
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BBVA

Detected technologies

Sizmek (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

serving-sys\.com/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

27 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

566 kB
Transfer

1664 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://secure-ds.serving-sys.com/SemiCachedScripts/ebOneTag.js HTTP 301
https://dsy67kqg9gcnf.cloudfront.net/SemiCachedScripts/ebOneTag.js HTTP 301
https://secure-ds.serving-sys.com/SemiCachedScripts/ebOneTag.js

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
opplemea.com/ 11 KB
3 KB 87ms
48ms Document
text/html 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to

Full URL: http://opplemea.com/
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache /
Resource Hash: 43f436603239be8afe86392572ade3c993cb6be4a9e943b10b8c92cab244097c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 2691
Content-Type: text/html
Date: Sat, 11 Nov 2023 10:55:02 GMT
ETag: "19a04c9-2d69-6088b033bf000-gzip"
Keep-Alive: timeout=5
Last-Modified: Wed, 25 Oct 2023 14:10:08 GMT
Server: Apache
Upgrade: h2,h2c
Vary: Accept-Encoding

GET
H2

200

ebOneTag.js Show response
secure-ds.serving-sys.com/SemiCachedScripts/
Redirect Chain

http://secure-ds.serving-sys.com/SemiCachedScripts/ebOneTag.js
https://dsy67kqg9gcnf.cloudfront.net/SemiCachedScripts/ebOneTag.js
https://secure-ds.serving-sys.com/SemiCachedScripts/ebOneTag.js

74 KB
22 KB

193ms
23ms

Script
application/javascript

2.19.126.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://secure-ds.serving-sys.com/SemiCachedScripts/ebOneTag.js
Requested by: Host: opplemea.com
URL: http://opplemea.com/
Protocol: H2
Server: 2.19.126.92 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-19-126-92.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4c2e03d0e2d3f21d25a50ac39491f5124a03d778da219ccb65801c522201a370

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://opplemea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 11 Nov 2023 10:55:02 GMT
content-encoding: gzip
x-amz-request-id: XKGHZFD3MWE70SZ5
x-amz-cf-pop: JFK52-P1
x-amz-server-side-encryption: AES256
content-length: 21820
x-amz-id-2: gWr3vmZpuUzRmaKoPVdSs4ykeAN462JpboAK4ld9+bVsv5xw5w9p3fV9vmBtMtnNjQiNw7PfAEA=
last-modified: Wed, 06 Sep 2023 14:35:36 GMT
server: AmazonS3
etag: "220840acac0b72605c541d1c968febe3"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=349
accept-ranges: bytes
x-amz-cf-id: Jp9zwROH3po8zTkriAo-o-qhv3WHYM2JGt8p3Mza7an2zSSb460m_g==

Redirect headers

date: Sat, 11 Nov 2023 10:55:03 GMT
via: 1.1 c813ed55721b9ee3209e2abab7207a00.cloudfront.net (CloudFront)
x-amz-request-id: ZPCZJ3VNYMHGF662
x-amz-cf-pop: FRA56-P4
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-length: 0
x-amz-id-2: bgBJIyWZG+HfT08t7DLnj6xnEibxNgfbbBNIwpKcsdJFUZ8CC8IWsnv+2dLS6MNsmFO05q8P8KE=
last-modified: Wed, 06 Sep 2023 14:35:36 GMT
server: AmazonS3
etag: "220840acac0b72605c541d1c968febe3"
content-type: application/javascript
location: https://secure-ds.serving-sys.com/SemiCachedScripts/ebOneTag.js
cache-control: max-age=900
accept-ranges: bytes
x-amz-cf-id: jEvEzSTZ5NVlx1TwmGXuN7s7HJJ56rm2NK5DDkxMn-mb_CjuUXpfDQ==

GET
H/1.1 200
OK app.min-5ff21a7006c61ec8f21575b32fdc9fcb.css
opplemea.com/files/ 1 MB
139 KB 53ms
52ms Stylesheet
text/css 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to

Full URL: http://opplemea.com/files/app.min-5ff21a7006c61ec8f21575b32fdc9fcb.css
Requested by: Host: opplemea.com
URL: http://opplemea.com/
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache /
Resource Hash: 3ea1861152c7e715d4a5b90d6448c5b9c3d7a86675153a78c14e8007ec0b70fa

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://opplemea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Sat, 11 Nov 2023 10:55:02 GMT
Content-Encoding: gzip
Last-Modified: Sun, 01 Oct 2023 08:29:23 GMT
Server: Apache
ETag: "19a04d1-117d33-606a3746cfec0-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5

GET
H2 200 vendor-73c83e3d8925ce4914aaf1b9b955a197.css
mobile.bbva.it/assets/ 2 KB
978 B 155ms
47ms Stylesheet
text/css 23.36.237.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mobile.bbva.it/assets/vendor-73c83e3d8925ce4914aaf1b9b955a197.css

Requested by

Host: opplemea.com
URL: http://opplemea.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.237.230 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-237-230.deploy.static.akamaitechnologies.com

Software

Resource Hash

a6fc7014c70f279496b9cf040d5d378a9807cb7de06f5693549c446348931c7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://opplemea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 20 Sep 2023 10:04:59 GMT
date: Sat, 11 Nov 2023 10:55:02 GMT
x-amz-cf-pop: AMS50-C1
etag: W/"73c83e3d8925ce4914aaf1b9b955a197"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: must-revalidate, max-age=7776000
x-amz-cf-id: gd_z6a40L0LYZYJtQkX6Q0ZTjdSCoTGuMbfr4Mq69sp7lmTwJw5MPg==
x-xss-protection: 1; mode=block
content-length: 588

GET
H2 200 app-bbva-it-d41d8cd98f00b204e9800998ecf8427e.css
mobile.bbva.it/assets/@woody-lite/ 0
414 B 155ms
48ms Stylesheet
text/css 23.36.237.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mobile.bbva.it/assets/@woody-lite/app-bbva-it-d41d8cd98f00b204e9800998ecf8427e.css

Requested by

Host: opplemea.com
URL: http://opplemea.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.237.230 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-237-230.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://opplemea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 10:55:02 GMT
x-amz-cf-pop: AMS50-C1
content-length: 20
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 20 Sep 2023 10:04:36 GMT
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: must-revalidate, max-age=7776000
accept-ranges: bytes
x-amz-cf-id: FREm0RMd070UIUDtOuFDM_MRd1---onJByUVQBDAbu1R4ByZOacaaQ==

GET
H/1.1 200
OK BentonSansBBVA-Book-dad6b6198b8254b8bce259aefda62568.woff
opplemea.com/files/fonts/ 69 KB
69 KB 75ms
37ms Font
font/woff 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to

Full URL: http://opplemea.com/files/fonts/BentonSansBBVA-Book-dad6b6198b8254b8bce259aefda62568.woff
Requested by: Host: opplemea.com
URL: http://opplemea.com/
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache /
Resource Hash: faef4c0bda0c3c95f57f42c990d7623eedb0d7f8174a6640ff4114f1091217ec

Request headers

Referer: http://opplemea.com/
Origin: http://opplemea.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Sat, 11 Nov 2023 10:55:02 GMT
Last-Modified: Sun, 01 Oct 2023 08:16:08 GMT
Server: Apache
ETag: "19a04dc-1130c-606a3450a4200"
Vary: Accept-Encoding
Upgrade: h2,h2c
Content-Type: font/woff
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 70412

GET
H/1.1 200
OK BentonSansBBVA-Medium-f50002bc63bc7f6f4e68c65bd0ec40d4.woff
opplemea.com/files/fonts/ 71 KB
71 KB 76ms
38ms Font
font/woff 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to

Full URL: http://opplemea.com/files/fonts/BentonSansBBVA-Medium-f50002bc63bc7f6f4e68c65bd0ec40d4.woff
Requested by: Host: opplemea.com
URL: http://opplemea.com/
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache /
Resource Hash: 7af3360fe39c201b1ccbe7a726a5d3c2f0253add6616b71176f0d9e7c849a732

Request headers

Referer: http://opplemea.com/
Origin: http://opplemea.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Sat, 11 Nov 2023 10:55:02 GMT
Last-Modified: Sun, 01 Oct 2023 08:16:24 GMT
Server: Apache
ETag: "19a04d9-11bec-606a345fe6600"
Vary: Accept-Encoding
Upgrade: h2,h2c
Content-Type: font/woff
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 72684

GET
H/1.1 200
OK BentonSansBBVA-BookItalic-c109f702b5103d7302b44179636a6b6b.woff
opplemea.com/files/fonts/ 71 KB
71 KB 66ms
29ms Font
font/woff 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to

Full URL: http://opplemea.com/files/fonts/BentonSansBBVA-BookItalic-c109f702b5103d7302b44179636a6b6b.woff
Requested by: Host: opplemea.com
URL: http://opplemea.com/
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache /
Resource Hash: 8d2773d3627ef45ce1d6d0bfd029a68fd6b6dadb1aa75e60b8eb9ee01ff26f23

Request headers

Referer: http://opplemea.com/
Origin: http://opplemea.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Sat, 11 Nov 2023 10:55:02 GMT
Last-Modified: Sun, 01 Oct 2023 08:16:32 GMT
Server: Apache
ETag: "19a04dd-11a5c-606a346787800"
Vary: Accept-Encoding
Upgrade: h2,h2c
Content-Type: font/woff
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 72284

GET
H/1.1 200
OK BentonSansBBVA-MediumItalic-803e1fe842adc8c2e1aa001b53874f0b.woff
opplemea.com/files/fonts/ 72 KB
72 KB 68ms
32ms Font
font/woff 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to

Full URL: http://opplemea.com/files/fonts/BentonSansBBVA-MediumItalic-803e1fe842adc8c2e1aa001b53874f0b.woff
Requested by: Host: opplemea.com
URL: http://opplemea.com/
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache /
Resource Hash: d695c54e6a80f75f1de09b33bd8f2f6c349fe257e079e518d42c96f4a10a86a3

Request headers

Referer: http://opplemea.com/
Origin: http://opplemea.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Sat, 11 Nov 2023 10:55:02 GMT
Last-Modified: Sun, 01 Oct 2023 08:17:21 GMT
Server: Apache
ETag: "19a04d4-11f10-606a349642640"
Vary: Accept-Encoding
Upgrade: h2,h2c
Content-Type: font/woff
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 73488

GET
H/1.1 404
Not Found icon-maiden-8c015685592c2ed6bf4b4f4bb754d9ec.woff
opplemea.com/files/ 0
0 66ms
31ms Font
text/html 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to

Full URL: http://opplemea.com/files/icon-maiden-8c015685592c2ed6bf4b4f4bb754d9ec.woff
Requested by: Host: opplemea.com
URL: http://opplemea.com/
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache /
Resource Hash

Request headers

Referer: http://opplemea.com/
Origin: http://opplemea.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Sat, 11 Nov 2023 10:55:02 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 logo-white-1c1c2a68cc4c755b9ebacef725dd3421.svg
mobile.bbva.it/assets/sid/res/img/logos/ 1 KB
1 KB 151ms
49ms Image
image/svg+xml 23.36.237.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mobile.bbva.it/assets/sid/res/img/logos/logo-white-1c1c2a68cc4c755b9ebacef725dd3421.svg

Requested by

Host: opplemea.com
URL: http://opplemea.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.237.230 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-237-230.deploy.static.akamaitechnologies.com

Software

Resource Hash

683f5dea1976fd4a6745667691c91dcffb2db35cf292aa17a3ed079e12f8ba7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://opplemea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 20 Sep 2023 10:04:52 GMT
date: Sat, 11 Nov 2023 10:55:02 GMT
x-amz-cf-pop: AMS50-C1
etag: W/"1c1c2a68cc4c755b9ebacef725dd3421"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: must-revalidate, max-age=7776000
x-amz-cf-id: 0Db-9ejvMeCCGwnOZUzBf_uZo6Vsm62vHRwaSP8Ck3zxm0S6Ja_iJg==
x-xss-protection: 1; mode=block
content-length: 652

GET
H2 200 jquery-1.9.1.min.js Show response
code.jquery.com/ 90 KB
32 KB 73ms
25ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.9.1.min.js
Requested by: Host: opplemea.com
URL: http://opplemea.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://opplemea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 11 Nov 2023 10:55:02 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1091440
x-cache: HIT, HIT
content-length: 32772
x-served-by: cache-lga13625-LGA, cache-lcy-eglc8600029-LCY
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1699700102.215557,VS0,VE0
etag: W/"28feccc0-169d5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 11, 1366863

GET
H/1.1 404
Not Found bg-menu-a5a292edf3027c756482651a9fbb4bd3.svg
opplemea.com/files/res/img/ 315 B
315 B 29ms
29ms Image
text/html 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://opplemea.com/files/res/img/bg-menu-a5a292edf3027c756482651a9fbb4bd3.svg
Requested by: Host: opplemea.com
URL: http://opplemea.com/files/app.min-5ff21a7006c61ec8f21575b32fdc9fcb.css
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://opplemea.com/files/app.min-5ff21a7006c61ec8f21575b32fdc9fcb.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Sat, 11 Nov 2023 10:55:02 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK icon-maiden-8c015685592c2ed6bf4b4f4bb754d9ec.woff
opplemea.com/files/fonts/ 83 KB
84 KB 29ms
29ms Font
font/woff 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to

Full URL: http://opplemea.com/files/fonts/icon-maiden-8c015685592c2ed6bf4b4f4bb754d9ec.woff
Requested by: Host: opplemea.com
URL: http://opplemea.com/files/app.min-5ff21a7006c61ec8f21575b32fdc9fcb.css
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache /
Resource Hash: 6909ec9c043f99e4185ed0722c10391b9a7deb9ffdb0fbe096cc00fd543a818f

Request headers

Referer: http://opplemea.com/files/app.min-5ff21a7006c61ec8f21575b32fdc9fcb.css
Origin: http://opplemea.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Sat, 11 Nov 2023 10:55:03 GMT
Last-Modified: Sun, 01 Oct 2023 08:27:02 GMT
Server: Apache
ETag: "19a04d5-14d0c-606a36c058180"
Vary: Accept-Encoding
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 85260

GET
H/1.1 200
OK access.php Show response
opplemea.com/panel/ 88 B
347 B 1044ms
1043ms XHR
text/html 92.204.214.188
GODADDY-SXB

General

Check archive.org

Show headers Download Go to

Full URL: http://opplemea.com/panel/access.php
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.9.1.min.js
Protocol: HTTP/1.1
Server: 92.204.214.188 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS: 188.214.204.92.host.secureserver.net
Software: Apache / PHP/7.3.33
Resource Hash: fea1078f1c89033344ccd1179dfb9e24cd64acddbccbc9157997348f194e9367

Request headers

Accept: */*
Referer: http://opplemea.com/
X-Requested-With: XMLHttpRequest
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Sat, 11 Nov 2023 10:55:03 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Connection: Keep-Alive
Keep-Alive: timeout=5
Content-Length: 95

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BBVA (Financial)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://opplemea.com/files/icon-maiden-8c015685592c2ed6bf4b4f4bb754d9ec.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://opplemea.com/files/res/img/bg-menu-a5a292edf3027c756482651a9fbb4bd3.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
dsy67kqg9gcnf.cloudfront.net
mobile.bbva.it
opplemea.com
secure-ds.serving-sys.com
2.19.126.92
23.36.237.230
2600:9000:223e:2400:5:880b:42c0:21
2a04:4e42:400::649
92.204.214.188
3ea1861152c7e715d4a5b90d6448c5b9c3d7a86675153a78c14e8007ec0b70fa
43f436603239be8afe86392572ade3c993cb6be4a9e943b10b8c92cab244097c
4c2e03d0e2d3f21d25a50ac39491f5124a03d778da219ccb65801c522201a370
683f5dea1976fd4a6745667691c91dcffb2db35cf292aa17a3ed079e12f8ba7a
6909ec9c043f99e4185ed0722c10391b9a7deb9ffdb0fbe096cc00fd543a818f
7af3360fe39c201b1ccbe7a726a5d3c2f0253add6616b71176f0d9e7c849a732
8d2773d3627ef45ce1d6d0bfd029a68fd6b6dadb1aa75e60b8eb9ee01ff26f23
a6fc7014c70f279496b9cf040d5d378a9807cb7de06f5693549c446348931c7f
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d695c54e6a80f75f1de09b33bd8f2f6c349fe257e079e518d42c96f4a10a86a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
faef4c0bda0c3c95f57f42c990d7623eedb0d7f8174a6640ff4114f1091217ec
fea1078f1c89033344ccd1179dfb9e24cd64acddbccbc9157997348f194e9367

opplemea.com Open in urlscan Pro 92.204.214.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

27 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

4 IPs

3 Countries

566 kBTransfer

1664 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

opplemea.com Open in urlscan Pro
92.204.214.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

27 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

566 kB
Transfer

1664 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!