graditest.com
Open in
urlscan Pro
104.251.214.87
Malicious Activity!
Public Scan
Effective URL: https://graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/
Submission: On January 18 via manual from FR
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 14th 2021. Valid for: 3 months.
This is the only time graditest.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Raiffeisen Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 103.252.189.43 103.252.189.43 | 133335 (IDNIC-PNP...) (IDNIC-PNP-AS-ID Politeknik Negeri Padang) | |
2 9 | 104.251.214.87 104.251.214.87 | 54540 (INCERO-HVVC) (INCERO-HVVC) | |
11 | 90.182.107.142 90.182.107.142 | 5610 (O2-CZECH-...) (O2-CZECH-REPUBLIC) | |
19 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
rb.cz
online.rb.cz |
382 KB |
9 |
graditest.com
2 redirects
graditest.com |
13 KB |
1 |
pnp.ac.id
p3m.pnp.ac.id |
362 B |
19 | 3 |
Domain | Requested by | |
---|---|---|
11 | online.rb.cz |
graditest.com
online.rb.cz |
9 | graditest.com |
2 redirects
p3m.pnp.ac.id
graditest.com |
1 | p3m.pnp.ac.id | |
19 | 3 |
Subject Issuer | Validity | Valid | |
---|---|---|---|
p3m.pnp.ac.id Let's Encrypt Authority X3 |
2020-11-19 - 2021-02-17 |
3 months | crt.sh |
graditest.com cPanel, Inc. Certification Authority |
2021-01-14 - 2021-04-14 |
3 months | crt.sh |
online.rb.cz DigiCert SHA2 Extended Validation Server CA |
2020-09-21 - 2021-10-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/
Frame ID: D4B51E921CFA8EBCD9159C127BADBCDB
Requests: 19 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://p3m.pnp.ac.id/wp-includes/ID3/aspx.php Page URL
-
https://graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/
HTTP 302
https://graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10 HTTP 301
https://graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/ Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Angular (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+ ng-version="([\d.]+)"/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Dynatrace (Analytics) Expand
Detected patterns
- script /dtagent.*\.js/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Kontakty
Search URL Search Domain Scan URL
Title: Bezpečnost
Search URL Search Domain Scan URL
Title: Nápověda
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://p3m.pnp.ac.id/wp-includes/ID3/aspx.php Page URL
-
https://graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/
HTTP 302
https://graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10 HTTP 301
https://graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
aspx.php
p3m.pnp.ac.id/wp-includes/ID3/ |
123 B 362 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/ Redirect Chain
|
13 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dtagent_ICA23STVbgjpqrvx_7000200141014.js
graditest.com/dt/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.3864caecf327e470640d.css
online.rb.cz/gaas/authorize/login/ |
352 KB 61 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gib-fragments.css
online.rb.cz/app/gib/ |
139 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runtime.4b3e0924272f3f1cd5b3.js
graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
polyfills.a032d72b2e443c1a0dcc.js
graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scripts.541c83bb9cb6c140515c.js
graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor.8befbc06ed70e2861191.js
graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.c87dea3a4da0b73c1d09.js
graditest.com/blogspring/wp-content/uploads/2021/01/raiffcz/95a4589d925279f759f70acaecc73c10/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-background.cf19ccff4c94cf3a2c16.png
online.rb.cz/gaas/authorize/login/ |
86 KB 86 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.9ce9d86f5636d8765042.png
online.rb.cz/gaas/authorize/login/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-sms-normal.a1ed23ce8a792dba46ea.png
online.rb.cz/gaas/authorize/login/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-phone-footer.8ec7664941533cb9438d.png
online.rb.cz/gaas/authorize/login/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-mail-info-footer.82d1ba035d285b0df64c.png
online.rb.cz/gaas/authorize/login/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
futuraTEE.587a70c97ad419538b01.woff
online.rb.cz/gaas/authorize/login/ |
27 KB 27 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
futuraTEEBold.35773772d311b90d2553.woff
online.rb.cz/gaas/authorize/login/ |
27 KB 27 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ionicons.e9f4c425fc377740601b.ttf
online.rb.cz/gaas/authorize/login/ |
184 KB 108 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FuturaTOT-Demi.6ad65ef59592bd4999f1.woff
online.rb.cz/gaas/authorize/login/ |
19 KB 20 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Raiffeisen Bank (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
graditest.com
online.rb.cz
p3m.pnp.ac.id
103.252.189.43
104.251.214.87
90.182.107.142
0679c87b2cfcf6ce33093fa7ee14fa86a839f3f926a986e1b8b1d962ef3f0efa
086abf3fb91693e20f0c988c8872ee3c01a661d794b007d5eacdf87cfe13b873
0e098af33e95634a981fec16cc3d746fa3e218af1da5a3dea48627aa234762cb
0ee076fb765d7807b041a3a2685e7f052697c8a98db482ad12cd2a3135a3caaa
2e26447e2542225b252aa996afdd91c4b967001a9a3043d88ecfd131800b2a3f
5e700835ec05293a3d0f9e354e7d038319d34521cd279e782198dff6d1dd58f2
719f26fb69aac9f34d13884d48f71111087e07b6e1d353664c51a0aa4fe629b2
9d5379dfed235eb573009946f5d416d1468b624003fccf6e51daacb7c6fec08c
abc9ebbeedf0999677259492736ed26cd3cc45055c9dc2868d1301d17fcbf7b4
c810e91dc2a17c90f0a4c421ac99b6bc5c9bcb209fde13da08c6b9f12a60a1d5
c9b82a008c17eb547ed2993d77b1ae642f4c7743f85b6b5f1fb897996182a888
f7c9b9e3268768128bcc27bff0af10777b1b8e2539b39d572629ee1adec71a60
fe7c86efca3c58748cc556871ecf13f680d7157e1706112fa43ad283c8aa05df