login-revolut-app.146-190-138-169.plesk.page Open in urlscan Pro
146.190.138.169 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com/blog.html
Effective URL:
https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Submission: On August 03 via manual (August 3rd 2023, 7:01:10 pm UTC) from FR — Scanned from FR

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 12 HTTP transactions. The main IP is 146.190.138.169, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is login-revolut-app.146-190-138-169.plesk.page.
TLS certificate: Issued by R3 on August 2nd 2023. Valid for: 3 months.

This is the only time login-revolut-app.146-190-138-169.plesk.page was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Revolut (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	52.219.56.151 52.219.56.151	16509 (AMAZON-02) (AMAZON-02)
3	146.190.138.169 146.190.138.169	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	34.95.97.3 34.95.97.3	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (STACKPATH...) (STACKPATH-CDN)
12	5

1 52.219.56.151 (Incheon, Korea, Republic Of)

ASN16509 (AMAZON-02, US)
PTR: s3-r-w.ap-northeast-2.amazonaws.com

eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 146.190.138.169 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

login-revolut-app.146-190-138-169.plesk.page	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.95.97.3 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 3.97.95.34.bc.googleusercontent.com

assets.revolut.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.revolut.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	revolut.com assets.revolut.com — Cisco Umbrella Rank: 27435 cdn.revolut.com — Cisco Umbrella Rank: 267697	81 KB
3	plesk.page login-revolut-app.146-190-138-169.plesk.page	16 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 743	30 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 265	28 KB
1	amazonaws.com eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com	532 B
12	5

	Domain	Requested by
4	assets.revolut.com	login-revolut-app.146-190-138-169.plesk.page
3	login-revolut-app.146-190-138-169.plesk.page	login-revolut-app.146-190-138-169.plesk.page
2	cdn.revolut.com	login-revolut-app.146-190-138-169.plesk.page
1	code.jquery.com	login-revolut-app.146-190-138-169.plesk.page
1	cdnjs.cloudflare.com	login-revolut-app.146-190-138-169.plesk.page
1	eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com
12	6

This site contains links to these domains. Also see Links.

Domain
help.revolut.com

Subject Issuer	Validity	Valid
*.s3.ap-northeast-2.amazonaws.com Amazon RSA 2048 M01	`2023-04-11` - `2024-03-15`	a year	crt.sh
login-revolut-app.146-190-138-169.plesk.page R3	`2023-08-02` - `2023-10-31`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.revolut.com Go Daddy Secure Certificate Authority - G2	`2023-04-04` - `2024-05-05`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Frame ID: 93D4F1E0B3B0B3383F1D16DA8FE8631E
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

One app, Vérification | RevolutRevolut

Page URL History Show full URLs

https://eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com/blog.html Page URL
https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

5
IPs

3
Countries

156 kB
Transfer

356 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://help.revolut.com/help/profile-and-plan/log-in-issues/i-lost-access-to-my-phone-number
Title: Je n'ai plus accès à mon numéro

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com/blog.html Page URL
https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK blog.html Show response
eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com/ 138 B
532 B 984ms
300ms Document
text/html 52.219.56.151
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com/blog.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.219.56.151 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-r-w.ap-northeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 2ea498258c230846e550ef8367489036ca9ef3c64287b8c3f13284968de91b4c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Accept-Ranges: bytes
Content-Length: 138
Content-Type: text/html
Date: Thu, 03 Aug 2023 19:01:07 GMT
ETag: "ee8bfae0ec74313e31dc260b8da3f2fc"
Last-Modified: Thu, 03 Aug 2023 00:08:33 GMT
Server: AmazonS3
x-amz-id-2: F+xVTkFxy987fk+kPwC4gIUlQ4dxaOJmfdzeZRHtbJK+EAUHY2hZly5AQfWmabHiWzD/I4qa+JU=
x-amz-request-id: QFKCM7CSPPNFPSQ0
x-amz-server-side-encryption: AES256

GET
H2 200 Primary Request / Show response
login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/ 60 KB
9 KB 768ms
326ms Document
text/html 146.190.138.169
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 146.190.138.169 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 96dcd9d0a8b43f91c7349f28999035937054d5ebe407edf5d99fbc90c112aa1e

Request headers

Referer: https://eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

content-encoding: br
content-type: text/html
date: Thu, 03 Aug 2023 19:01:07 GMT
etag: W/"64cb001c-f0bf"
last-modified: Thu, 03 Aug 2023 01:17:16 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 package-lock.json
login-revolut-app.146-190-138-169.plesk.page/FinalRevo/ 42 KB
7 KB 174ms
173ms Stylesheet
application/json 146.190.138.169
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/package-lock.json
Requested by: Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 146.190.138.169 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 703db9085771f93b767ad2bf14d42f01ea477550f3326ba48afded81c83267c6

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 19:01:08 GMT
content-encoding: br
last-modified: Wed, 02 Aug 2023 20:15:14 GMT
server: nginx
etag: W/"64cab952-a6f0"
x-powered-by: PleskLin
content-type: application/json

GET
H2 200 package.json
login-revolut-app.146-190-138-169.plesk.page/FinalRevo/ 83 B
242 B 172ms
171ms Stylesheet
application/json 146.190.138.169
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/package.json
Requested by: Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 146.190.138.169 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: eb35f4ac97cef296adbc7de2c6ece2933d23ef3624d79a3fc43f8873d747e40a

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 19:01:08 GMT
content-encoding: br
last-modified: Wed, 02 Aug 2023 20:15:14 GMT
x-accel-version: 0.01
server: nginx
etag: W/"53-601f652437880"
x-powered-by: PleskLin
content-type: application/json

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 76ms
25ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://login-revolut-app.146-190-138-169.plesk.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 19:01:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 9338536
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27938
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "603e8adc-15d9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S9IXSV0WWU6Y6%2FOINO3mYApWuo0p2%2FmnczaSYnq3tN%2BvcB1b09SjI8CEQ49sGmsgiC46sYWZxBTzQIQbkzO%2BCyMd82E%2BV4cvwo1iOHosAZkJdaEo0pqbGDupWZ7O69O%2FfyoMjA7NGOg%2FYvYUbVAi8OLd"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7f10ceb50cce2a71-CDG
expires: Tue, 23 Jul 2024 19:01:08 GMT

GET
H2 200 BasierCircle-Regular.woff2
assets.revolut.com/media/fonts/ 15 KB
15 KB 89ms
38ms Font
application/octet-stream 34.95.97.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revolut.com/media/fonts/BasierCircle-Regular.woff2
Requested by: Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.97.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 3.97.95.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: c23b48bb63c57ddc9662f01e2d439ca9bab78ea9fb611b92a3b44cc0fb3981d6

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://login-revolut-app.146-190-138-169.plesk.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 19:35:11 GMT
age: 689157
x-guploader-uploadid: ADPycdu7QfF2MGZlqbJk3rRFkkvWf6fpvUZrab42LX4nuDTJcsJbt71Rp-xAVhxs4bYO5aNQyEneXnSCkSl8m2Si6nGpLg
x-goog-storage-class: MULTI_REGIONAL
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-metageneration: 7
x-goog-stored-content-encoding: identity
x-goog-meta-access-control-allow-origin: *
content-length: 15208
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
last-modified: Wed, 06 May 2020 08:57:31 GMT
server: UploadServer
etag: "850919ccf819055982b64a74dcf6142a"
x-goog-generation: 1588755451976455
x-goog-hash: crc32c=gfGBZg==, md5=hQkZzPgZBVmCtkp03PYUKg==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000
x-goog-stored-content-length: 15208
accept-ranges: bytes
content-type: application/octet-stream
expires: Thu, 25 Jul 2024 19:35:11 GMT

GET
H2 200 BasierCircle-Medium.woff2
assets.revolut.com/media/fonts/ 15 KB
16 KB 76ms
25ms Font
application/octet-stream 34.95.97.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revolut.com/media/fonts/BasierCircle-Medium.woff2
Requested by: Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.97.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 3.97.95.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: a858e829b2f1ef3a0346efb973efa7c021905c23483292d5319d29ae316e4ce9

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://login-revolut-app.146-190-138-169.plesk.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 22:04:40 GMT
age: 593788
x-guploader-uploadid: ADPycdv_WLTYPEljFlvFoqhO7PSoeU1KxQpd09HznLSz7C0xuxEP7fq3oYI3n4E08hIfVbaGP7xsEz5ekGXFm5-wbEovlw
x-goog-storage-class: MULTI_REGIONAL
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
x-goog-meta-access-control-allow-origin: *
content-length: 15748
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
last-modified: Wed, 06 May 2020 08:57:31 GMT
server: UploadServer
etag: "ecb8f6aea34bb31c9f19e0c34108d582"
x-goog-generation: 1588755451985849
x-goog-hash: crc32c=69AP/Q==, md5=7Lj2rqNLsxyfGeDDQQjVgg==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000
x-goog-stored-content-length: 15748
accept-ranges: bytes
content-type: application/octet-stream
expires: Fri, 26 Jul 2024 22:04:40 GMT

GET
H2 200 BasierCircle-SemiBold.woff2
assets.revolut.com/media/fonts/ 15 KB
16 KB 71ms
20ms Font
application/octet-stream 34.95.97.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revolut.com/media/fonts/BasierCircle-SemiBold.woff2
Requested by: Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.97.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 3.97.95.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 7162676d3741eea3ba1c42e87a80c8f9be8f893f580b7862b12a3fa75eacd828

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://login-revolut-app.146-190-138-169.plesk.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:50:13 GMT
age: 742255
x-guploader-uploadid: ADPycduvEVBfqFJOpA6CKnLJnTcj879hM5VwQq7LA4672-3MNXgB0xLhEIfnfNiHWwDYHm1hON2135HDqGaVDlHqNRVzNA
x-goog-storage-class: MULTI_REGIONAL
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
x-goog-meta-access-control-allow-origin: *
content-length: 15684
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
last-modified: Wed, 06 May 2020 08:57:31 GMT
server: UploadServer
etag: "d2b14106c8703dd266a18dcc37402949"
x-goog-generation: 1588755451952627
x-goog-hash: crc32c=CtG0BA==, md5=0rFBBshwPdJmoY3MN0ApSQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000
x-goog-stored-content-length: 15684
accept-ranges: bytes
content-type: application/octet-stream
expires: Thu, 25 Jul 2024 04:50:13 GMT

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 77ms
26ms Script
application/javascript 2001:4de0:ac18::1:a:3b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://login-revolut-app.146-190-138-169.plesk.page/
Origin: https://login-revolut-app.146-190-138-169.plesk.page
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 19:01:08 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-15d9d"
surrogate-control: max-age=315360000;hw-h2proxy
vary: Accept-Encoding
x-hw: 1691089268.cdn4-pxy208-cdg02.pa1.evs,1691089268.cds047.pa1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000,public
accept-ranges: bytes
content-length: 30875

GET
H2 200 MA.png
assets.revolut.com/assets/flags/ 3 KB
3 KB 46ms
45ms Image
image/png 34.95.97.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.revolut.com/assets/flags/MA.png
Requested by: Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.97.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 3.97.95.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e7435125e96eed4485780d7fa72f792901aa6612cef7fdb60863e5d4f48bd853

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://login-revolut-app.146-190-138-169.plesk.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 19:01:08 GMT
age: 0
x-guploader-uploadid: ADPycdsAApJ-Ic4rybGEw0QbRvI18ctuD8GIIUvhPA7CeQJ7H-a-TsOopsVNfi1ChhDw9c8pgts4dZG_n13wdgdbXZFOgg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3252
last-modified: Mon, 03 Apr 2023 16:35:51 GMT
server: UploadServer
etag: "c6d58fad5cd49247844bb096e0149b06"
x-goog-generation: 1680539751870363
x-goog-hash: crc32c=Ei8mOQ==, md5=xtWPrVzUkkeES7CW4BSbBg==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 3252
accept-ranges: bytes
content-type: image/png
expires: Thu, 03 Aug 2023 20:01:08 GMT

GET
H2 200 BasierCircle-SemiBold.woff2
cdn.revolut.com/media/fonts/ 15 KB
16 KB 76ms
20ms Font
application/octet-stream 34.95.97.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.revolut.com/media/fonts/BasierCircle-SemiBold.woff2
Requested by: Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.97.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 3.97.95.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 7162676d3741eea3ba1c42e87a80c8f9be8f893f580b7862b12a3fa75eacd828

Request headers

Referer: https://login-revolut-app.146-190-138-169.plesk.page/
Origin: https://login-revolut-app.146-190-138-169.plesk.page
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:50:13 GMT
age: 742255
x-guploader-uploadid: ADPycduvEVBfqFJOpA6CKnLJnTcj879hM5VwQq7LA4672-3MNXgB0xLhEIfnfNiHWwDYHm1hON2135HDqGaVDlHqNRVzNA
x-goog-storage-class: MULTI_REGIONAL
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
x-goog-meta-access-control-allow-origin: *
content-length: 15684
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
last-modified: Wed, 06 May 2020 08:57:31 GMT
server: UploadServer
etag: "d2b14106c8703dd266a18dcc37402949"
x-goog-generation: 1588755451952627
x-goog-hash: crc32c=CtG0BA==, md5=0rFBBshwPdJmoY3MN0ApSQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000
x-goog-stored-content-length: 15684
accept-ranges: bytes
content-type: application/octet-stream
expires: Thu, 25 Jul 2024 04:50:13 GMT

GET
H2 200 BasierCircle-Regular.woff2
cdn.revolut.com/media/fonts/ 15 KB
15 KB 82ms
26ms Font
application/octet-stream 34.95.97.3
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.revolut.com/media/fonts/BasierCircle-Regular.woff2
Requested by: Host: login-revolut-app.146-190-138-169.plesk.page
URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.97.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 3.97.95.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: c23b48bb63c57ddc9662f01e2d439ca9bab78ea9fb611b92a3b44cc0fb3981d6

Request headers

Referer: https://login-revolut-app.146-190-138-169.plesk.page/
Origin: https://login-revolut-app.146-190-138-169.plesk.page
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 19:35:11 GMT
age: 689157
x-guploader-uploadid: ADPycdu7QfF2MGZlqbJk3rRFkkvWf6fpvUZrab42LX4nuDTJcsJbt71Rp-xAVhxs4bYO5aNQyEneXnSCkSl8m2Si6nGpLg
x-goog-storage-class: MULTI_REGIONAL
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-metageneration: 7
x-goog-stored-content-encoding: identity
x-goog-meta-access-control-allow-origin: *
content-length: 15208
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
last-modified: Wed, 06 May 2020 08:57:31 GMT
server: UploadServer
etag: "850919ccf819055982b64a74dcf6142a"
x-goog-generation: 1588755451976455
x-goog-hash: crc32c=gfGBZg==, md5=hQkZzPgZBVmCtkp03PYUKg==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000
x-goog-stored-content-length: 15208
accept-ranges: bytes
content-type: application/octet-stream
expires: Thu, 25 Jul 2024 19:35:11 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Revolut (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery boolean| buttonClicked

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://login-revolut-app.146-190-138-169.plesk.page/FinalRevo/www.revolut.com/gettheapp/ Message: Failed to find a valid digest in the 'integrity' attribute for resource 'https://code.jquery.com/jquery-3.6.0.min.js' with computed SHA-256 integrity '/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4='. The resource has been blocked.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.revolut.com
cdn.revolut.com
cdnjs.cloudflare.com
code.jquery.com
eopwej-hjsa13.s3.ap-northeast-2.amazonaws.com
login-revolut-app.146-190-138-169.plesk.page
146.190.138.169
2001:4de0:ac18::1:a:3b
2606:4700::6811:190e
34.95.97.3
52.219.56.151
2ea498258c230846e550ef8367489036ca9ef3c64287b8c3f13284968de91b4c
703db9085771f93b767ad2bf14d42f01ea477550f3326ba48afded81c83267c6
7162676d3741eea3ba1c42e87a80c8f9be8f893f580b7862b12a3fa75eacd828
96dcd9d0a8b43f91c7349f28999035937054d5ebe407edf5d99fbc90c112aa1e
a858e829b2f1ef3a0346efb973efa7c021905c23483292d5319d29ae316e4ce9
c23b48bb63c57ddc9662f01e2d439ca9bab78ea9fb611b92a3b44cc0fb3981d6
e7435125e96eed4485780d7fa72f792901aa6612cef7fdb60863e5d4f48bd853
eb35f4ac97cef296adbc7de2c6ece2933d23ef3624d79a3fc43f8873d747e40a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

login-revolut-app.146-190-138-169.plesk.page Open in urlscan Pro 146.190.138.169 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

40 %IPv6

5 Domains

6 Subdomains

5 IPs

3 Countries

156 kBTransfer

356 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

login-revolut-app.146-190-138-169.plesk.page Open in urlscan Pro
146.190.138.169 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

5
IPs

3
Countries

156 kB
Transfer

356 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!