test.hackathonbbva.com Open in urlscan Pro
174.138.61.56  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response test.hackathonbbva.com/	19 KB 4 KB	362ms 138ms	Document text/html	174.138.61.56 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://test.hackathonbbva.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 174.138.61.56 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS Software LiteSpeed / Resource Hash cb2611a1c8f0f6d98fcf2d8bd970b4a8f41b7ce4bc7d07c30e441b5bbda97ea5 Security Headers Name Value Strict-Transport-Security max-age=True; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority test.hackathonbbva.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers status 200 content-type text/html; charset=utf-8 x-frame-options SAMEORIGIN vary Cookie,Accept-Encoding strict-transport-security max-age=True; includeSubDomains; preload x-content-type-options nosniff x-xss-protection 1; mode=block set-cookie csrftoken=81uDw30t5CyrUTS6wHiz4JFmu5sADkkL05U3nChXuIbzaaCZl5yhEIpUSibG3qhL; expires=Mon, 03 Aug 2020 19:06:03 GMT; Max-Age=31449600; Path=/; SameSite=Lax; Secure content-encoding gzip date Mon, 05 Aug 2019 19:06:03 GMT server LiteSpeed
GET H2	200	material-design-iconic-font.min.css cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/	69 KB 7 KB	29ms 28ms	Stylesheet text/css	2606:4700::6813:c797 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css Requested by Host: test.hackathonbbva.com URL: https://test.hackathonbbva.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Sec-Fetch-Mode no-cors Referer https://test.hackathonbbva.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 05 Aug 2019 19:06:03 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT age 9665903 status 200 served-in-seconds 0.028 timing-allow-origin * last-modified Thu, 17 May 2018 09:21:10 GMT server cloudflare etag W/"5afd4986-1149f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000; includeSubDomains content-type text/css access-control-allow-origin * cache-control public, max-age=30672000 cf-ray 501b0bcb6800e00b-FRA expires Sat, 25 Jul 2020 19:06:03 GMT
GET H2	200	staticbundle-ade7fa7950aacc59ad37.css test.hackathonbbva.com/static/bundles/	1 MB 544 KB	94ms 93ms	Stylesheet text/css	174.138.61.56 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://test.hackathonbbva.com/static/bundles/staticbundle-ade7fa7950aacc59ad37.css Requested by Host: test.hackathonbbva.com URL: https://test.hackathonbbva.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 174.138.61.56 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS Software LiteSpeed / Resource Hash 36f6d13b74f5ee0a5ed4853fa003cdcb9db70395f4900bd3f5b642f6ef218fae Request headers Sec-Fetch-Mode no-cors Referer https://test.hackathonbbva.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 05 Aug 2019 19:06:03 GMT content-encoding br last-modified Mon, 05 Aug 2019 16:25:49 GMT server LiteSpeed etag "127958-5d48588d-277d50;br" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 555416 expires Mon, 12 Aug 2019 19:06:03 GMT
GET H2	200	logo_bbva_blanco.svg www.bbva.mx/content/dam/public-web/global/images/logos/	2 KB 1 KB	4389ms 236ms	Image image/svg+xml	104.108.61.228 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://www.bbva.mx/content/dam/public-web/global/images/logos/logo_bbva_blanco.svg Requested by Host: test.hackathonbbva.com URL: https://test.hackathonbbva.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.61.228 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a104-108-61-228.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 4110bfbebf5162bd8ce32b34a411c8c4ec827b0d65947993c25379646e5db120 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://test.hackathonbbva.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubdomains; preload content-encoding gzip x-content-type-options nosniff status 200 content-length 888 x-xss-protection 1; mode=block last-modified Sun, 04 Aug 2019 08:18:23 GMT server Apache x-frame-options SAMEORIGIN date Mon, 05 Aug 2019 19:06:07 GMT vary Accept-Encoding content-type image/svg+xml access-control-allow-origin https://w3.igrupobbva https://w4.igrupobbva https://w3.grupobbva.com https://originacion.bancomer.com https://portal.bancomer.com https://qa.bancomer.com https://originacion.bbva.mx https://portal.bbva.mx https://qa.bbva.mx” cache-control max-age=31536000 accept-ranges bytes expires Mon, 03 Aug 2020 08:47:44 GMT
GET H2	200	staticbundle-ade7fa7950aacc59ad37.js Show response test.hackathonbbva.com/static/bundles/	137 KB 46 KB	557ms 556ms	Script application/x-javascript	174.138.61.56 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://test.hackathonbbva.com/static/bundles/staticbundle-ade7fa7950aacc59ad37.js Requested by Host: test.hackathonbbva.com URL: https://test.hackathonbbva.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 174.138.61.56 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS Software LiteSpeed / Resource Hash 35780d19a58b7f8e935f9409f711ce8f9291f78e6c071953d7a5c9febb83b854 Request headers Sec-Fetch-Mode no-cors Referer https://test.hackathonbbva.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 05 Aug 2019 19:06:03 GMT content-encoding br last-modified Mon, 05 Aug 2019 16:25:49 GMT server LiteSpeed etag "22333-5d48588d-277c92;br" vary Accept-Encoding content-type application/x-javascript status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 47245 expires Mon, 12 Aug 2019 19:06:03 GMT
GET H2	200	sdk.js Show response connect.facebook.net/es_ES/	3 KB 2 KB	40ms 6ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/es_ES/sdk.js Requested by Host: test.hackathonbbva.com URL: https://test.hackathonbbva.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 53c80f9d83091c6839a78206050927794617992061e54108eec069615c53b27f Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Sec-Fetch-Mode cors Referer https://test.hackathonbbva.com/ Origin https://test.hackathonbbva.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 Z54hoiclF4HnUG2KaTsYxA== status 200 content-length 1781 etag "2d966fd228834a9f179cd3fa2ebb543a" x-fb-debug M1yaNX3tr/POiqj2fqDMcKyvyooD3+UdZ1BLoIwEsyc60Hwj2iny4m9KHI9CZY/tE4lORAAiBLkpRCB9PoGqOA== x-fb-trip-id 420120009 x-fb-content-md5 84973f4df00743c027628f5ec9aa6c5a x-frame-options DENY date Mon, 05 Aug 2019 19:06:03 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=1200,stale-while-revalidate=3600 timing-allow-origin * expires Mon, 05 Aug 2019 19:21:30 GMT
GET H/1.1	200 OK	widgets.js Show response platform.twitter.com/	93 KB 93 KB	54ms 6ms	Script application/javascript	2606:2800:234:46c:e8b:1e2f:2bd:694 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets.js Requested by Host: test.hackathonbbva.com URL: https://test.hackathonbbva.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/41A0) / Resource Hash a8907cef9f64bccd7d625c25537cadf6c4d4ba17f7c62e1e029edc706e1a654d Request headers Sec-Fetch-Mode no-cors Referer https://test.hackathonbbva.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 05 Aug 2019 19:06:03 GMT Last-Modified Wed, 24 Jul 2019 23:24:45 GMT Server ECS (fcn/41A0) Etag "1b95626cf7796551e445933f79466124" Access-Control-Allow-Methods GET P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin * Cache-Control public, max-age=1800 X-Cache HIT Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 Content-Length 95170
GET H2	200	d0ad97979779343e3c9c691b257b27c7.woff test.hackathonbbva.com/static/bundles/	18 KB 18 KB	94ms 94ms	Font application/font-woff	174.138.61.56 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://test.hackathonbbva.com/static/bundles/d0ad97979779343e3c9c691b257b27c7.woff Requested by Host: test.hackathonbbva.com URL: https://test.hackathonbbva.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 174.138.61.56 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS Software LiteSpeed / Resource Hash 788c518dc82799c7ae7807ff18c54edd58b36ab9d73c56ef6866570d6098038b Request headers Sec-Fetch-Mode cors Referer https://test.hackathonbbva.com/static/bundles/staticbundle-ade7fa7950aacc59ad37.css Origin https://test.hackathonbbva.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 05 Aug 2019 19:06:03 GMT last-modified Mon, 05 Aug 2019 16:25:49 GMT server LiteSpeed etag "4650-5d48588d-277d1d;;;" content-type application/font-woff status 200 accept-ranges bytes content-length 18000
GET H2	200	3f89dd0a44013966d75693e557cf9aaa.woff test.hackathonbbva.com/static/bundles/	17 KB 17 KB	94ms 94ms	Font application/font-woff	174.138.61.56 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://test.hackathonbbva.com/static/bundles/3f89dd0a44013966d75693e557cf9aaa.woff Requested by Host: test.hackathonbbva.com URL: https://test.hackathonbbva.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 174.138.61.56 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS Software LiteSpeed / Resource Hash ad692a816d5570be5ec0ee110c27c550bf87c83c86f041cd66dc26b5e200fa1d Request headers Sec-Fetch-Mode cors Referer https://test.hackathonbbva.com/static/bundles/staticbundle-ade7fa7950aacc59ad37.css Origin https://test.hackathonbbva.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 05 Aug 2019 19:06:03 GMT last-modified Mon, 05 Aug 2019 16:25:49 GMT server LiteSpeed etag "4534-5d48588d-277d2e;;;" content-type application/font-woff status 200 accept-ranges bytes content-length 17716
GET H2	200	f6c0ce7dced2eea5a22ffeb94236ef72.woff test.hackathonbbva.com/static/bundles/	18 KB 18 KB	94ms 94ms	Font application/font-woff	174.138.61.56 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://test.hackathonbbva.com/static/bundles/f6c0ce7dced2eea5a22ffeb94236ef72.woff Requested by Host: test.hackathonbbva.com URL: https://test.hackathonbbva.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 174.138.61.56 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS Software LiteSpeed / Resource Hash 40afd10fbce6b7e743a7cc3f1b60127eacbc2bbd723210a95af7c16b52e96758 Request headers Sec-Fetch-Mode cors Referer https://test.hackathonbbva.com/static/bundles/staticbundle-ade7fa7950aacc59ad37.css Origin https://test.hackathonbbva.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 05 Aug 2019 19:06:03 GMT last-modified Mon, 05 Aug 2019 16:25:49 GMT server LiteSpeed etag "4678-5d48588d-277d4f;;;" content-type application/font-woff status 200 accept-ranges bytes content-length 18040
GET H2	200	sdk.js Show response connect.facebook.net/es_ES/	199 KB 59 KB	6ms 6ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/es_ES/sdk.js?hash=7382d9245f780d24662ce5f16454e5a5&ua=modern_es6 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/es_ES/sdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 6c0f352f26d5f81f8795918fd0a513b784ac014900653593e91f89ae3649a6be Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Sec-Fetch-Mode cors Referer https://test.hackathonbbva.com/ Origin https://test.hackathonbbva.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 x9J/ThJ3i8bJGR0ceh5TyA== status 200 content-length 60476 etag "e505d73a22e08a71dc87eb9263dda872" x-fb-debug wKB2hF8GMN7pr6oKxYwYBVcAk0ybG6WCy82jG+non+wDGcK/uP3qB1qYXRrany9oEeLthTDebBp7vi1x0+Vtgg== x-fb-trip-id 420120009 x-fb-content-md5 0fad35ec002d00e475bd916245e66d99 x-frame-options DENY date Mon, 05 Aug 2019 19:06:03 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=31536000,stale-while-revalidate=3600,immutable timing-allow-origin * expires Tue, 04 Aug 2020 16:54:12 GMT
GET H/1.1	200 OK	widget_iframe.0639d67d95b7680840758b6833f06d87.html platform.twitter.com/widgets/ Frame EB91	0 0	6ms 6ms	Document text/html	2606:2800:234:46c:e8b:1e2f:2bd:694 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/widget_iframe.0639d67d95b7680840758b6833f06d87.html?origin=https%3A%2F%2Ftest.hackathonbbva.com Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40EB) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Referer https://test.hackathonbbva.com/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://test.hackathonbbva.com/ Response headers Accept-Ranges bytes Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Mon, 05 Aug 2019 19:06:09 GMT Etag "7d3f6ed140174a20e7c8be261a70a863" Last-Modified Wed, 24 Jul 2019 23:23:20 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40EB) X-Cache HIT Content-Length 15194
GET H2	200	xd_arbiter.php staticxx.facebook.com/connect/ Frame 4B28	0 0	7ms 6ms	Document text/html	2a03:2880:f02d:12:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://staticxx.facebook.com/connect/xd_arbiter.php?version=44 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/es_ES/sdk.js?hash=7382d9245f780d24662ce5f16454e5a5&ua=modern_es6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self'; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority staticxx.facebook.com :scheme https :path /connect/xd_arbiter.php?version=44 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode nested-navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site referer https://test.hackathonbbva.com/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://test.hackathonbbva.com/ Response headers status 200 content-type text/html; charset=utf-8 expires Sat, 01 Aug 2020 17:31:16 GMT strict-transport-security max-age=15552000; preload content-encoding br content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self'; vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0 cache-control public,max-age=31536000,immutable x-fb-debug 55rQmo+RvAJ+PUBYFzV+HBXezK3igaMWBWx3pNjnohzyh24sZNMuc0tBhpSXZ5oi3WIvR8EIndGcpyrZtgam4Q== content-length 11519 x-fb-trip-id 420120009 date Mon, 05 Aug 2019 19:06:04 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BBVA (Financial)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| hide function| show function| show_right_field object| FB object| __twttrll object| twttr object| __twttr function| setImmediate function| clearImmediate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=True; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
connect.facebook.net
platform.twitter.com
staticxx.facebook.com
test.hackathonbbva.com
www.bbva.mx
104.108.61.228
174.138.61.56
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:4700::6813:c797
2a03:2880:f02d:12:face:b00c:0:3
35780d19a58b7f8e935f9409f711ce8f9291f78e6c071953d7a5c9febb83b854
36f6d13b74f5ee0a5ed4853fa003cdcb9db70395f4900bd3f5b642f6ef218fae
40afd10fbce6b7e743a7cc3f1b60127eacbc2bbd723210a95af7c16b52e96758
4110bfbebf5162bd8ce32b34a411c8c4ec827b0d65947993c25379646e5db120
53c80f9d83091c6839a78206050927794617992061e54108eec069615c53b27f
6c0f352f26d5f81f8795918fd0a513b784ac014900653593e91f89ae3649a6be
788c518dc82799c7ae7807ff18c54edd58b36ab9d73c56ef6866570d6098038b
a8907cef9f64bccd7d625c25537cadf6c4d4ba17f7c62e1e029edc706e1a654d
ad692a816d5570be5ec0ee110c27c550bf87c83c86f041cd66dc26b5e200fa1d
cb2611a1c8f0f6d98fcf2d8bd970b4a8f41b7ce4bc7d07c30e441b5bbda97ea5
dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56