urlscan.io logo urlscan.io
SecurityTrails logo

www.castlebarflowers.com Open in urlscan Pro
46.22.130.86  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Submission: On May 21 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 46.22.130.86, located in Ireland and belongs to BLACKNIGHT-AS, IE. The main domain is www.castlebarflowers.com.
This is the only time www.castlebarflowers.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BBVA (Financial)

Domain & IP information

IP Address AS Autonomous System
6 46.22.130.86 39122 (BLACKNIGH...)
1 186.113.14.51 32787 (PROLEXIC-...)
7 2
Apex Domain
Subdomains		 Transfer
6 castlebarflowers.com
www.castlebarflowers.com
145 KB
1 bbva.com.co
www.bbva.com.co
710 KB
7 2
Domain Requested by
6 www.castlebarflowers.com www.castlebarflowers.com
1 www.bbva.com.co www.castlebarflowers.com
7 2

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Frame ID: 63BBF380A3388307A7750E5C3B304929
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

856 kB
Transfer

1461 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request LogonOperacionServletOtp2nd.php
www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Protocol
HTTP/1.1
Server
46.22.130.86 , Ireland, ASN39122 (BLACKNIGHT-AS, IE),
Reverse DNS
cloud.modata.ie
Software
Apache/2.2.22 (Ubuntu) / PHP/5.4.9-4ubuntu2.4
Resource Hash
237fb845b20bac55f780d06371d602c11e37fc6bc663f982ea93b6be44a6cf44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
www.castlebarflowers.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
63BBF380A3388307A7750E5C3B304929

Response headers

Date
Mon, 21 May 2018 15:19:58 GMT
Server
Apache/2.2.22 (Ubuntu)
X-Powered-By
PHP/5.4.9-4ubuntu2.4
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1526
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
tablass.css
www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/tablass.css
Requested by
Host: www.castlebarflowers.com
URL: http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Protocol
HTTP/1.1
Server
46.22.130.86 , Ireland, ASN39122 (BLACKNIGHT-AS, IE),
Reverse DNS
cloud.modata.ie
Software
Apache/2.2.22 (Ubuntu) /
Resource Hash
34b71cff67eacd436661d5af3bfcdaa1b84a5f406888538e7aa2da0c7babde69
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.castlebarflowers.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Mon, 21 May 2018 15:19:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 21 May 2018 14:35:01 GMT
Server
Apache/2.2.22 (Ubuntu)
ETag
"365a68-1b57-56cb834e8af40"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
811
X-XSS-Protection
1; mode=block
global.css
www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/ 		288 KB
43 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/global.css
Requested by
Host: www.castlebarflowers.com
URL: http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Protocol
HTTP/1.1
Server
46.22.130.86 , Ireland, ASN39122 (BLACKNIGHT-AS, IE),
Reverse DNS
cloud.modata.ie
Software
Apache/2.2.22 (Ubuntu) /
Resource Hash
2f8c1b745db648a45650be066cda74e3d8d45b5c4d28ffd4a47a84e3fc307f2e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.castlebarflowers.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Mon, 21 May 2018 15:19:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 21 May 2018 14:35:01 GMT
Server
Apache/2.2.22 (Ubuntu)
ETag
"365750-47ea3-56cb834e8af40"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
43472
X-XSS-Protection
1; mode=block
bootstrap.min.css
www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/ 		120 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/bootstrap.min.css
Requested by
Host: www.castlebarflowers.com
URL: http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Protocol
HTTP/1.1
Server
46.22.130.86 , Ireland, ASN39122 (BLACKNIGHT-AS, IE),
Reverse DNS
cloud.modata.ie
Software
Apache/2.2.22 (Ubuntu) /
Resource Hash
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.castlebarflowers.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Mon, 21 May 2018 15:19:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 21 May 2018 14:35:01 GMT
Server
Apache/2.2.22 (Ubuntu)
ETag
"365a69-1deac-56cb834e8af40"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
19883
X-XSS-Protection
1; mode=block
jquery-ui.css
www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/ 		34 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/jquery-ui.css
Requested by
Host: www.castlebarflowers.com
URL: http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Protocol
HTTP/1.1
Server
46.22.130.86 , Ireland, ASN39122 (BLACKNIGHT-AS, IE),
Reverse DNS
cloud.modata.ie
Software
Apache/2.2.22 (Ubuntu) /
Resource Hash
7f8e420a4ac3ea7f6fd081ce07234101414d27df260a6d547663f8e0c0efbaf4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.castlebarflowers.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Mon, 21 May 2018 15:19:59 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 21 May 2018 14:35:01 GMT
Server
Apache/2.2.22 (Ubuntu)
ETag
"365a56-898c-56cb834e8af40"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
8125
X-XSS-Protection
1; mode=block
Logo_BBVA_Colombia_tcm1304-668421.svg
www.bbva.com.co/fbin/mult/ 		938 KB
710 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bbva.com.co/fbin/mult/Logo_BBVA_Colombia_tcm1304-668421.svg
Requested by
Host: www.castlebarflowers.com
URL: http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Protocol
HTTP/1.1
Server
186.113.14.51 Bogotá, Colombia, ASN32787 (PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK - Akamai Technologies, Inc., US),
Reverse DNS
www.bbva.com.co
Software
/
Resource Hash
8484b6c2c46c56e05107c49b7f96d2cdedc4e0a2152a80b55fa746224828e7a5
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.adobedtm.com https://apis.google.com https://www.youtube.com https://www.googleadservices.com https://cdn.tt.omtrdc.net https://bbvacolombia.tt.omtrdc.net https://www.google-analytics.com https://s.ytimg.com https://static.ads-twitter.com https://secure-ds.serving-sys.com https://connect.facebook.net https://googleads.g.doubleclick.net https://bs.serving-sys.com;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
Connection
Keep-Alive
Vary
Accept-Encoding
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 26 Apr 2018 19:49:02 GMT
Date
Mon, 21 May 2018 15:15:17 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
Content-Type
image/svg+xml
Access-Control-Allow-Origin
https://w3.igrupobbva https://w4.igrupobbva https://w3.grupobbva.com
Cache-Control
max-age=2592000
Content-Security-Policy
script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.adobedtm.com https://apis.google.com https://www.youtube.com https://www.googleadservices.com https://cdn.tt.omtrdc.net https://bbvacolombia.tt.omtrdc.net https://www.google-analytics.com https://s.ytimg.com https://static.ads-twitter.com https://secure-ds.serving-sys.com https://connect.facebook.net https://googleads.g.doubleclick.net https://bs.serving-sys.com;
Accept-Ranges
bytes
Keep-Alive
timeout=10, max=100
Expires
Wed, 20 Jun 2018 15:15:17 GMT
BentonSansBBVA-Medium.woff
www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/fonts/coronita/benton/medium/ 		71 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/fonts/coronita/benton/medium/BentonSansBBVA-Medium.woff
Requested by
Host: www.castlebarflowers.com
URL: http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/LogonOperacionServletOtp2nd.php
Protocol
HTTP/1.1
Server
46.22.130.86 , Ireland, ASN39122 (BLACKNIGHT-AS, IE),
Reverse DNS
cloud.modata.ie
Software
Apache/2.2.22 (Ubuntu) /
Resource Hash
7af3360fe39c201b1ccbe7a726a5d3c2f0253add6616b71176f0d9e7c849a732
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Origin
http://www.castlebarflowers.com
Accept-Encoding
gzip, deflate
Host
www.castlebarflowers.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
*/*
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/global.css
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
http://www.castlebarflowers.com/js/https/200.84.134.25340821/www.bbvanet.com.co/bbva/colombianet/choose/estilos/global.css
Origin
http://www.castlebarflowers.com

Response headers

Date
Mon, 21 May 2018 15:19:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 21 May 2018 14:35:01 GMT
Server
Apache/2.2.22 (Ubuntu)
ETag
"365a65-11bec-56cb834e8af40"
Content-Type
application/x-font-woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
72684
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BBVA (Financial)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| valida

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block