_wildcard_.silverbirdgroup.com
Open in
urlscan Pro
162.0.227.26
Malicious Activity!
Public Scan
Submission: On February 25 via manual from PT — Scanned from GB
Summary
This is the only time _wildcard_.silverbirdgroup.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Santander (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
20 | 162.0.227.26 162.0.227.26 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 193.127.177.78 193.127.177.78 | 2134 (GSVNET-AS...) (GSVNET-AS GS Virtual Network Produban) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::2003 | 15169 (GOOGLE) (GOOGLE) | |
22 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: nc-ph-2714.web-hosting.com
_wildcard_.silverbirdgroup.com |
ASN2134 (GSVNET-AS GS Virtual Network Produban, ES)
PTR: www.particulares.santander.pt
www.particulares.santander.pt |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
silverbirdgroup.com
_wildcard_.silverbirdgroup.com |
1 MB |
1 |
gstatic.com
www.gstatic.com |
|
1 |
santander.pt
www.particulares.santander.pt — Cisco Umbrella Rank: 567513 |
14 KB |
22 | 3 |
Domain | Requested by | |
---|---|---|
20 | _wildcard_.silverbirdgroup.com |
_wildcard_.silverbirdgroup.com
|
1 | www.gstatic.com |
_wildcard_.silverbirdgroup.com
|
1 | www.particulares.santander.pt |
_wildcard_.silverbirdgroup.com
|
22 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.particulares.santander.pt Entrust Certification Authority - L1M |
2022-01-31 - 2023-02-27 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-02-17 - 2022-05-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://_wildcard_.silverbirdgroup.com/banksan/sant/?key=32f4057636769b55f7f30c3f65f7e6b9307d739f
Frame ID: C57957899EC8C1CA9DE47D0C9AA110AE
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
Netbanco Particulares - SantanderDetected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery Migrate (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
_wildcard_.silverbirdgroup.com/banksan/sant/ |
7 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ruxitagentjs_ICA2SVfhqrux_10215210506134511.js
_wildcard_.silverbirdgroup.com/banksan/sant/asset/js/ |
209 KB 210 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_and_register.css
_wildcard_.silverbirdgroup.com/banksan/sant/asset/css/ |
43 KB 43 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fonts.css
_wildcard_.silverbirdgroup.com/banksan/sant/asset/css/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nbp_jquery.js
_wildcard_.silverbirdgroup.com/banksan/sant/asset/js/ |
94 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
misc.js
_wildcard_.silverbirdgroup.com/banksan/sant/asset/js/ |
11 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api.js
_wildcard_.silverbirdgroup.com/banksan/sant/asset/js/ |
850 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BEYAM5g3ZYkBxnx9bhxi.js
_wildcard_.silverbirdgroup.com/banksan/sant/asset/js/ |
427 KB 427 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nbp_formf.js
_wildcard_.silverbirdgroup.com/banksan/sant/asset/js/ |
19 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
santander-logo-red.svg
_wildcard_.silverbirdgroup.com/banksan/sant/asset/ficheros/modern/images/icons/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-image-0.svg
www.particulares.santander.pt//ficheros/modern/images/icons/ |
14 KB 14 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ruxitagentjs__10215210506134511.js
_wildcard_.silverbirdgroup.com/banksan/sant/asset/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-migrate-3.1.0.js
_wildcard_.silverbirdgroup.com/ficheros/js/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderTextW05-Regular.woff2
_wildcard_.silverbirdgroup.com/banksan/sant/asset/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye-icon_show.svg
_wildcard_.silverbirdgroup.com/ficheros/modern/images/icons/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderHeadlineW05-Bold.woff2
_wildcard_.silverbirdgroup.com/banksan/sant/asset/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderTextW05-Bold.woff2
_wildcard_.silverbirdgroup.com/banksan/sant/asset/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderTextW05-Regular.woff
_wildcard_.silverbirdgroup.com/banksan/sant/asset/fonts/ |
68 KB 68 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderTextW05-Bold.woff
_wildcard_.silverbirdgroup.com/banksan/sant/asset/fonts/ |
70 KB 70 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderHeadlineW05-Bold.woff
_wildcard_.silverbirdgroup.com/banksan/sant/asset/fonts/ |
69 KB 70 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
dynaTraceMonitor
_wildcard_.silverbirdgroup.com/banksan/sant/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Santander (Banking)75 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| dT_ object| dtrum function| $ function| jQuery function| initializeSelectionFields function| iframeResize function| createPopup function| fadeOutElement function| fadeInElement function| addLoginLoadingOverlay object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| _0x1d7a function| _0x3c13 function| _0x1df497 function| SessionToken2 object| setupDatepickerOpts function| setupDatepickerShow function| execute boolean| procesando function| initFocus function| setFocusDown function| setFocusPress function| setFocus function| setInitialFocus function| getKey function| getStringFormByName function| getFormByName function| getFormulario function| ejecutarAccion function| cambioPagina function| ejecutarAccionEnOtraUF function| ejecutarUnaAccionEnOtraUF function| operar2Params function| validaValorImporte function| UntoNdp function| importeJS_to_importePT function| importePT_to_importeJS function| teclaEsNumero function| teclaEsNumeroOrArrows function| checkDosDecimales function| checkDecimales function| exportToPdf function| exportToExcel function| expPriv function| formPopin function| showDialog function| goSetHeight function| addExtraIframeHeight function| resizeIframe function| iFrameReload function| checkIFrameReload function| getPageHeight function| isIEBrowser function| _hideSelect function| _showSelect function| isDefined function| showPopin function| showPopinNBP function| closePopin function| MM_openBrWindow function| printWindow function| getObject function| set_placeholder_iframe_load function| initialize function| initializePage function| cleanResponse function| utaglink function| utagview object| NBP object| autos function| collapsable7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
_wildcard_.silverbirdgroup.com/ | Name: PHPSESSID Value: 09a755d4067eb112819710a7edbc5b02 |
|
.silverbirdgroup.com/ | Name: dtCookie Value: -46$24PPVOOE56DE7M1LIKQHR37VO7CS92AG |
|
.silverbirdgroup.com/ | Name: rxVisitor Value: 1645789599692CQ7HM1TOJSS5SCJ2HNOAQJ730IMH02BD |
|
.silverbirdgroup.com/ | Name: dtSa Value: - |
|
.silverbirdgroup.com/ | Name: dtLatC Value: 94 |
|
.silverbirdgroup.com/ | Name: rxvt Value: 1645791401443|1645789599696 |
|
.silverbirdgroup.com/ | Name: dtPC Value: -46$589599687_217h-vMQAEHVFMCIOSIFPUQNAWMUFODDWPSAJK-0 |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
_wildcard_.silverbirdgroup.com
www.gstatic.com
www.particulares.santander.pt
162.0.227.26
193.127.177.78
2a00:1450:4001:827::2003
0afbafc1a47a0abcf601975e9f95019633769f405ae83219f0b4218346d68ab7
2d2d2cfd7a36307f8ca530948d454dcd9f706830b7c18ee0cc4fa3ec16d96091
2f0e67192e014a837002fff61326afa99204d4b19c1b7c3d3a0c95fe4eea32df
3f3a895792ca9ae541cc5456ef3e7d33cf4329f2a1d42028186d226333cdd14e
3f4c7ddda08cfd6b96895f6317d790f01a397f9a00cc272c15c0a7f298ba39cb
5ba78ace4566a255ad507449ba7d10f5013f5e6ef6bc027dfcf762c3817aeac2
5c59342159ccd8b7c7278a0cfca52e3b64d713381cd3a8480371fd5e3fe49b6e
5e9ed6be50032ab5fbdd608df33f88942a268b0e09445d80d6609a7704f2da88
70569c9eefd69c4707a5f6447b58cbacfa8f7753496ebdbce8955b6f8aa67d74
768a38021128a2657d6267b5681dc037f9cd59f7b3b2c42a9c39879811089b16
b3e36283594a5c24cf9e9ba48a5bd484878a98cb1bc0a688dc41001cfc3eec3b
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e2476c1b39457c00a77799c17873baa76a727d90a8fba59201ca34c50cfb9d7d
f9b8141392d617e653d1e010337c41069d423c3e0963bed209edb32b62fe8d6d
fb9959e108e4e451081311056d730119759da5ae0a4fe4b9e629cee4bd39a4d2