safinahblasting.com Open in urlscan Pro
51.161.91.232 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://safinahblasting.com/secureconfirm.html
Submission: On August 17 via manual (August 17th 2022, 2:43:36 pm UTC) from UY — Scanned from CA

Summary HTTP 13 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 51.161.91.232, located in Montreal, Canada and belongs to OVH, FR. The main domain is safinahblasting.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 22nd 2022. Valid for: 3 months.

This is the only time safinahblasting.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco de la República Oriental del Uruguay (Banking)

Domain & IP information

	IP Address		AS Autonomous System
13	51.161.91.232 51.161.91.232		16276 (OVH) (OVH)
13	2

13 51.161.91.232 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: meteor.indowebsite.net

safinahblasting.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	safinahblasting.com safinahblasting.com	236 KB
13	1

	Domain	Requested by
13	safinahblasting.com	safinahblasting.com
13	1

This site contains links to these domains. Also see Links.

Domain
www.portal.brou.com.uy

Subject Issuer	Validity	Valid
safinahblasting.com cPanel, Inc. Certification Authority	`2022-07-22` - `2022-10-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://safinahblasting.com/secureconfirm.html
Frame ID: 4312965FFD2B6AF1FE13725870110AE1
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

eBROU - BROU

Detected technologies

Ionicons (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+ionicons(?:\.min)?\.css

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

236 kB
Transfer

947 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.portal.brou.com.uy/
Title: Portal BROU

Search URL Search Domain Scan URL

URL: https://www.portal.brou.com.uy/web/guest/institucional/seguridad/tu-banco-seguro
Title: Seguridad

Search URL Search Domain Scan URL

URL: https://www.portal.brou.com.uy/web/guest/contactenos
Title: Gestión de Reclamos

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request secureconfirm.html Show response safinahblasting.com/	194 KB 138 KB	541ms 14ms	Document text/html	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash `198174d12525c03bdd554487336e024a42440087c6b19df9517449390d604fbb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language en-CA,en;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-type text/html date Wed, 17 Aug 2022 14:43:31 GMT last-modified Sun, 07 Aug 2022 11:59:37 GMT server Apache vary Accept-Encoding,User-Agent
GET H2	200	fonts.css safinahblasting.com/secureconfirm_files/	2 KB 325 B	24ms 23ms	Stylesheet text/css	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/fonts.css Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash `367cba5c66dcb77e9efdefae321a5fa51b4ed0773b15ebbd7a8ee35b913e75fe` Request headers accept-language en-CA,en;q=0.9 Referer https://safinahblasting.com/secureconfirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding gzip last-modified Sun, 07 Aug 2022 11:59:13 GMT server Apache vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes content-length 286
GET H2	200	ionicons.css safinahblasting.com/secureconfirm_files/	59 KB 9 KB	25ms 24ms	Stylesheet text/css	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/ionicons.css Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash `d4d41483cf38b6182b0a495196cfc55821cfd2e3d310861f32bcd2240806f187` Request headers accept-language en-CA,en;q=0.9 Referer https://safinahblasting.com/secureconfirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding gzip last-modified Sun, 07 Aug 2022 11:59:14 GMT server Apache vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes content-length 8971
GET H2	200	1.3cc10fbd.chunk.css safinahblasting.com/secureconfirm_files/	28 KB 5 KB	24ms 23ms	Stylesheet text/css	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/1.3cc10fbd.chunk.css Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash `92e56b81fed31737958484ada927138d6ae05903737eb05d2e0959bdd42cc223` Request headers accept-language en-CA,en;q=0.9 Referer https://safinahblasting.com/secureconfirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding gzip last-modified Sun, 07 Aug 2022 11:59:13 GMT server Apache vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes content-length 5085
GET H2	200	main.9d27c490.chunk.css safinahblasting.com/secureconfirm_files/	527 KB 78 KB	26ms 26ms	Stylesheet text/css	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/main.9d27c490.chunk.css Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash `947e9613bdbb7de0852b7aa5334cd83d6b9274b5d09ce19187c01eb283b3407e` Request headers accept-language en-CA,en;q=0.9 Referer https://safinahblasting.com/secureconfirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding gzip last-modified Sun, 07 Aug 2022 11:59:17 GMT server Apache accept-ranges bytes vary Accept-Encoding,User-Agent content-type text/css
GET H2	200	css safinahblasting.com/secureconfirm_files/	5 KB 595 B	23ms 22ms	Stylesheet text/plain	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/css Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash `4f5e10f41a06a7caeea83a23bd8596d651f3096e9895f6524a921121cf86e45d` Request headers accept-language en-CA,en;q=0.9 Referer https://safinahblasting.com/secureconfirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding gzip last-modified Sun, 07 Aug 2022 11:59:13 GMT server Apache accept-ranges bytes content-length 541 vary Accept-Encoding,User-Agent
GET DATA	200 OK	truncated /	127 KB 0		Image image/jpg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `073426a4337ab29d7c7b7b7e31f593959740ec5cb7a51c1a409a758182323fcf` Request headers accept-language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/jpg
GET H2	404	selectArrowDown.b3a49a7d.svg safinahblasting.com/frontend/static/media/	5 KB 5 KB	14ms 14ms	Image text/html	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://safinahblasting.com/frontend/static/media/selectArrowDown.b3a49a7d.svg Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm_files/main.9d27c490.chunk.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash `07a173a2b9b4ade40985dd8894f229605c547e783165b76807863d206151ae97` Request headers accept-language en-CA,en;q=0.9 Referer https://safinahblasting.com/secureconfirm_files/main.9d27c490.chunk.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding br server Apache accept-ranges bytes content-length 1237 vary Accept-Encoding content-type text/html
GET H2	404	GothamBook.woff2 safinahblasting.com/secureconfirm_files/gotham/	0 0	14ms 14ms	Font text/html	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/gotham/GothamBook.woff2 Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm_files/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash Request headers Referer https://safinahblasting.com/secureconfirm_files/fonts.css Origin https://safinahblasting.com accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding br server Apache accept-ranges bytes content-length 1237 vary Accept-Encoding content-type text/html
GET H2	404	Gotham-Medium.woff2 safinahblasting.com/secureconfirm_files/gotham/	0 0	13ms 13ms	Font text/html	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/gotham/Gotham-Medium.woff2 Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm_files/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash Request headers Referer https://safinahblasting.com/secureconfirm_files/fonts.css Origin https://safinahblasting.com accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding br server Apache accept-ranges bytes content-length 1237 vary Accept-Encoding content-type text/html
GET H2	404	Gotham-Medium.woff safinahblasting.com/secureconfirm_files/gotham/	0 0	13ms 12ms	Font text/html	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/gotham/Gotham-Medium.woff Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm_files/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash Request headers Referer https://safinahblasting.com/secureconfirm_files/fonts.css Origin https://safinahblasting.com accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding br server Apache accept-ranges bytes content-length 1237 vary Accept-Encoding content-type text/html
GET H2	404	GothamBook.woff safinahblasting.com/secureconfirm_files/gotham/	0 0	12ms 12ms	Font text/html	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/gotham/GothamBook.woff Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm_files/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash Request headers Referer https://safinahblasting.com/secureconfirm_files/fonts.css Origin https://safinahblasting.com accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:31 GMT content-encoding br server Apache accept-ranges bytes content-length 1237 vary Accept-Encoding content-type text/html
GET H2	404	GothamBook.ttf safinahblasting.com/secureconfirm_files/gotham/	0 0	13ms 12ms	Font text/html	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/gotham/GothamBook.ttf Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm_files/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash Request headers Referer https://safinahblasting.com/secureconfirm_files/fonts.css Origin https://safinahblasting.com accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:32 GMT content-encoding br server Apache accept-ranges bytes content-length 1237 vary Accept-Encoding content-type text/html
GET H2	404	Gotham-Medium.ttf safinahblasting.com/secureconfirm_files/gotham/	0 0	13ms 12ms	Font text/html	51.161.91.232 OVH
General Check archive.org Show headers Download Go to Full URL https://safinahblasting.com/secureconfirm_files/gotham/Gotham-Medium.ttf Requested by Host: safinahblasting.com URL: https://safinahblasting.com/secureconfirm_files/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.161.91.232 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS meteor.indowebsite.net Software Apache / Resource Hash Request headers Referer https://safinahblasting.com/secureconfirm_files/fonts.css Origin https://safinahblasting.com accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Wed, 17 Aug 2022 14:43:32 GMT content-encoding br server Apache accept-ranges bytes content-length 1237 vary Accept-Encoding content-type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco de la República Oriental del Uruguay (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://safinahblasting.com/frontend/static/media/selectArrowDown.b3a49a7d.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://safinahblasting.com/secureconfirm_files/gotham/Gotham-Medium.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://safinahblasting.com/secureconfirm_files/gotham/GothamBook.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://safinahblasting.com/secureconfirm_files/gotham/GothamBook.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://safinahblasting.com/secureconfirm_files/gotham/Gotham-Medium.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://safinahblasting.com/secureconfirm_files/gotham/GothamBook.ttf Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://safinahblasting.com/secureconfirm_files/gotham/Gotham-Medium.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

safinahblasting.com
51.161.91.232
073426a4337ab29d7c7b7b7e31f593959740ec5cb7a51c1a409a758182323fcf
07a173a2b9b4ade40985dd8894f229605c547e783165b76807863d206151ae97
198174d12525c03bdd554487336e024a42440087c6b19df9517449390d604fbb
367cba5c66dcb77e9efdefae321a5fa51b4ed0773b15ebbd7a8ee35b913e75fe
4f5e10f41a06a7caeea83a23bd8596d651f3096e9895f6524a921121cf86e45d
92e56b81fed31737958484ada927138d6ae05903737eb05d2e0959bdd42cc223
947e9613bdbb7de0852b7aa5334cd83d6b9274b5d09ce19187c01eb283b3407e
d4d41483cf38b6182b0a495196cfc55821cfd2e3d310861f32bcd2240806f187

safinahblasting.com Open in urlscan Pro 51.161.91.232 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

236 kBTransfer

947 kBSize

0 Cookies

3 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

7 Console Messages

Indicators

safinahblasting.com Open in urlscan Pro
51.161.91.232 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

236 kB
Transfer

947 kB
Size

0
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!