web-app-grouprural-es.herokuapp.com

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 54.220.192.176, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is web-app-grouprural-es.herokuapp.com.
TLS certificate: Issued by Amazon on May 2nd 2022. Valid for: a year.

This is the only time web-app-grouprural-es.herokuapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Grupo Caja Rural (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3033::ac43:8f02	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:303... 2606:4700:3035::ac43:a0f0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	54.220.192.176 54.220.192.176	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (STACKPATH...) (STACKPATH-CDN)
6	2

1 2606:4700:3033::ac43:8f02 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

hbr.tc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::ac43:a0f0 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.kisa.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.220.192.176 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-220-192-176.eu-west-1.compute.amazonaws.com

web-app-grouprural-es.herokuapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	herokuapp.com web-app-grouprural-es.herokuapp.com	54 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 669	30 KB
1	kisa.link 1 redirects www.kisa.link	590 B
1	hbr.tc 1 redirects hbr.tc	511 B
6	4

	Domain	Requested by
5	web-app-grouprural-es.herokuapp.com	web-app-grouprural-es.herokuapp.com
1	code.jquery.com	web-app-grouprural-es.herokuapp.com
1	www.kisa.link	1 redirects
1	hbr.tc	1 redirects
6	4

This site contains no links.

Subject Issuer	Validity	Valid
*.herokuapp.com Amazon	`2022-05-02` - `2023-05-31`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://web-app-grouprural-es.herokuapp.com/
Frame ID: CC5D5A6C290949B1E4DFA61804A839E0
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://hbr.tc/Qkoo HTTP 302
https://www.kisa.link/url_redirector.php?url=Qkoo&domain=hbr.tc HTTP 301
https://web-app-grouprural-es.herokuapp.com/ Page URL

Detected technologies

Heroku (PaaS) Expand

Overall confidence: 100%
Detected patterns

\.herokuapp\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

84 kB
Transfer

140 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://hbr.tc/Qkoo HTTP 302
https://www.kisa.link/url_redirector.php?url=Qkoo&domain=hbr.tc HTTP 301
https://web-app-grouprural-es.herokuapp.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response web-app-grouprural-es.herokuapp.com/ Redirect Chain https://hbr.tc/Qkoo https://www.kisa.link/url_redirector.php?url=Qkoo&domain=hbr.tc https://web-app-grouprural-es.herokuapp.com/	1 KB 2 KB	180ms 45ms	Document text/html	54.220.192.176 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://web-app-grouprural-es.herokuapp.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.192.176 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-192-176.eu-west-1.compute.amazonaws.com Software Cowboy / Express Resource Hash `516e7c9a949a2ff62e510ad951df853639e45ad53bc1c4c0d612d154c71b0846` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Length 1262 Content-Type text/html; charset=utf-8 Date Thu, 17 Nov 2022 08:42:13 GMT Etag W/"4ee-Gqe2AKp3S8TxNtPrJxDH1bq+YLg" Server Cowboy Via 1.1 vegur X-Powered-By Express Redirect headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 76b72bf24d1f6904-FRA content-type text/html; charset=UTF-8 date Thu, 17 Nov 2022 08:42:13 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location https://web-app-grouprural-es.herokuapp.com nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MiLhZyF9ryUpVFA%2FKZYFQExvgXPkVhF8stnFf3Ti7c3K2UtdCZxPGTRVpcx4epQWksKvPg0cA2MkvMg3BuYHfDvykKSkrCrAS8C0YkLRrV8BraFMTYlULhbS2xlw4Dffe4h6Hig%2BsvchEhaf"}],"group":"cf-nel","max_age":604800} server cloudflare x-turbo-charged-by LiteSpeed
GET H/1.1	200 OK	main.css web-app-grouprural-es.herokuapp.com/css/	2 KB 2 KB	44ms 44ms	Stylesheet text/css	54.220.192.176 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://web-app-grouprural-es.herokuapp.com/css/main.css Requested by Host: web-app-grouprural-es.herokuapp.com URL: https://web-app-grouprural-es.herokuapp.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.192.176 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-192-176.eu-west-1.compute.amazonaws.com Software Cowboy / Express Resource Hash `713777e28f63b6afbfa3e85ac5c1bf6e37478c0b605eeb1b6fa57a8e0fe4fdc5` Request headers accept-language de-DE,de;q=0.9 Referer https://web-app-grouprural-es.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers Date Thu, 17 Nov 2022 08:42:13 GMT Via 1.1 vegur Last-Modified Mon, 14 Nov 2022 12:25:38 GMT Server Cowboy X-Powered-By Express Etag W/"828-184761a2dd0" Content-Type text/css; charset=UTF-8 Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Length 2088
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	96ms 36ms	Script application/javascript	2001:4de0:ac18::1:a:2a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: web-app-grouprural-es.herokuapp.com URL: https://web-app-grouprural-es.herokuapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers Referer https://web-app-grouprural-es.herokuapp.com/ Origin https://web-app-grouprural-es.herokuapp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 17 Nov 2022 08:42:13 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-15d9d" vary Accept-Encoding x-hw 1668674533.dop004.fr8.t,1668674533.cds167.fr8.hn,1668674533.cds144.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H/1.1	200 OK	hed.JPG web-app-grouprural-es.herokuapp.com/img/	16 KB 16 KB	44ms 44ms	Image image/jpeg	54.220.192.176 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://web-app-grouprural-es.herokuapp.com/img/hed.JPG Requested by Host: web-app-grouprural-es.herokuapp.com URL: https://web-app-grouprural-es.herokuapp.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.192.176 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-192-176.eu-west-1.compute.amazonaws.com Software Cowboy / Express Resource Hash `9a76f10ea0db1fe913dde2b5f84b546d4f5837bc8eb3da5d3b0f02638c156add` Request headers accept-language de-DE,de;q=0.9 Referer https://web-app-grouprural-es.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers Date Thu, 17 Nov 2022 08:42:13 GMT Via 1.1 vegur Last-Modified Mon, 14 Nov 2022 12:25:38 GMT Server Cowboy X-Powered-By Express Etag W/"3f8a-184761a2dd0" Content-Type image/jpeg Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Length 16266
GET H/1.1	200 OK	cc-inp.JPG web-app-grouprural-es.herokuapp.com/img/	31 KB 31 KB	110ms 45ms	Image image/jpeg	54.220.192.176 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://web-app-grouprural-es.herokuapp.com/img/cc-inp.JPG Requested by Host: web-app-grouprural-es.herokuapp.com URL: https://web-app-grouprural-es.herokuapp.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.192.176 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-192-176.eu-west-1.compute.amazonaws.com Software Cowboy / Express Resource Hash `ad22840dd7892ab0ef47c16032db9d3538cf565685011e989e5650becd87b0e9` Request headers accept-language de-DE,de;q=0.9 Referer https://web-app-grouprural-es.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers Date Thu, 17 Nov 2022 08:42:13 GMT Via 1.1 vegur Last-Modified Mon, 14 Nov 2022 12:25:38 GMT Server Cowboy X-Powered-By Express Etag W/"7c41-184761a2dd0" Content-Type image/jpeg Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Length 31809
GET H/1.1	200 OK	stb.js Show response web-app-grouprural-es.herokuapp.com/js/	2 KB 2 KB	45ms 45ms	Script application/javascript	54.220.192.176 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://web-app-grouprural-es.herokuapp.com/js/stb.js Requested by Host: web-app-grouprural-es.herokuapp.com URL: https://web-app-grouprural-es.herokuapp.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.192.176 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-192-176.eu-west-1.compute.amazonaws.com Software Cowboy / Express Resource Hash `80bc2b4c026aefe87d037fa07c96492557e0b1a5b460405bade87ef93efce0e2` Request headers accept-language de-DE,de;q=0.9 Referer https://web-app-grouprural-es.herokuapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers Date Thu, 17 Nov 2022 08:42:13 GMT Via 1.1 vegur Last-Modified Mon, 14 Nov 2022 12:25:38 GMT Server Cowboy X-Powered-By Express Etag W/"89d-184761a2dd0" Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Length 2205

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Grupo Caja Rural (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.kisa.link/	1969-12-31 23:59:59	Name: shorturl Value: vjaer5jnj5ncgdidg57juik2po
			web-app-grouprural-es.herokuapp.com/	1969-12-31 23:59:59	Name: connect.sid Value: s%3AE0C3hIrfAjSphefSEHrSC67yghHMzpfG.3zHg%2FuAMvjdHOJnUeMRlGVc3%2BhFTbcMetAtVjDd8jZ8

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
hbr.tc
web-app-grouprural-es.herokuapp.com
www.kisa.link
2001:4de0:ac18::1:a:2a
2606:4700:3033::ac43:8f02
2606:4700:3035::ac43:a0f0
54.220.192.176
516e7c9a949a2ff62e510ad951df853639e45ad53bc1c4c0d612d154c71b0846
713777e28f63b6afbfa3e85ac5c1bf6e37478c0b605eeb1b6fa57a8e0fe4fdc5
80bc2b4c026aefe87d037fa07c96492557e0b1a5b460405bade87ef93efce0e2
9a76f10ea0db1fe913dde2b5f84b546d4f5837bc8eb3da5d3b0f02638c156add
ad22840dd7892ab0ef47c16032db9d3538cf565685011e989e5650becd87b0e9
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

web-app-grouprural-es.herokuapp.com Open in urlscan Pro 54.220.192.176 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

2 IPs

3 Countries

84 kBTransfer

140 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

2 Cookies

Indicators

web-app-grouprural-es.herokuapp.com Open in urlscan Pro
54.220.192.176 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

84 kB
Transfer

140 kB
Size

2
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!