bbvaesudates.myoptimates2.com
Open in
urlscan Pro
2606:4700:3034::ac43:cef7
Malicious Activity!
Public Scan
Submission: On July 05 via manual from NL
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 4th 2021. Valid for: a year.
This is the only time bbvaesudates.myoptimates2.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2606:4700:303... 2606:4700:3034::ac43:cef7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 193.17.195.46 193.17.195.46 | 34022 (INGRO-AS) (INGRO-AS) | |
5 | 3 |
ASN13335 (CLOUDFLARENET, US)
bbvaesudates.myoptimates2.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
myoptimates2.com
bbvaesudates.myoptimates2.com |
441 KB |
1 |
homebank.ro
www.homebank.ro |
1 KB |
5 | 2 |
Domain | Requested by | |
---|---|---|
4 | bbvaesudates.myoptimates2.com |
bbvaesudates.myoptimates2.com
|
1 | www.homebank.ro |
bbvaesudates.myoptimates2.com
|
5 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-04 - 2022-07-03 |
a year | crt.sh |
www.homebank.ro Entrust Certification Authority - L1M |
2021-02-23 - 2022-03-22 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://bbvaesudates.myoptimates2.com/homebank/hb/hb/api/v4/account/login/?sainins=4564500001546548979953326545488989865445652320123&emas=554974121346579329784132387965ingsysid
Frame ID: 519207C9E1BFD40905246A34B730FF15
Requests: 3 HTTP requests in this frame
Frame:
https://bbvaesudates.myoptimates2.com/soporte/plataforma/identidad/api/v11/account/login/
Frame ID: F6AD9279760EBE6C54E48BC3E888856A
Requests: 15 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
bbvaesudates.myoptimates2.com/homebank/hb/hb/api/v4/account/login/ |
517 B 827 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
iframeResizer.min.js
bbvaesudates.myoptimates2.com/static/ |
14 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
main.js
bbvaesudates.myoptimates2.com/static/ |
42 B 631 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
/
bbvaesudates.myoptimates2.com/soporte/plataforma/identidad/api/v11/account/login/ Frame F6AD |
1 MB 434 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
68 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
905 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
3 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
34 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
30 KB 30 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
29 KB 29 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
55 KB 55 KB |
Font
application/font-sfnt |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
3 KB 3 KB |
Font
application/font-sfnt |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6AD |
43 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
www.homebank.ro/Epfxn0/ Frame F6AD |
53 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| iFrameResize1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bbvaesudates.myoptimates2.com/ | Name: csrftoken Value: p2F5YPalYpI56Zf528L7qoo0x4sz6fCYY3pO3IEp2LaVAO2pe230m3BZfoL2wLo8 |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bbvaesudates.myoptimates2.com
www.homebank.ro
193.17.195.46
2606:4700:3034::ac43:cef7
061502dc7afa31effc647970e0ad46b4c0abe78085556d3ccdf5ffd21a8e6aaa
1114f3821b29756a2e3d9c49d9e30a0f394749cb0e324485c40f3b24fcc424ff
20b74c733a7a3424e81a6b1e7326089c8d18f82e32743da0d997b4592ff47c03
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e
3ecd0ca89f4e10d74aace7ca2dc9a7d3ee2439146d590b50c54bd095fce79f29
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
6727c4e528fb3ba23d5d083a2663b5a02ce76b9a028467e9e5b97382ac4f06ae
6b7c577cfbd9e0c9aa36f9f412ee059d7a576a85d35472e3d06fd261ce8b25b2
740f75d95ec2429f6f51f3dbc35d5e7347639e2c43ce46e970ea3f4462fb43e8
a01583bb1046d42e54d2ddf18e6659d54025b7db0a792464dba2a2572e23c696
a2d465d1a2c3d854b4818a84eccd757e18e83d449ae4c45047e47635e1d5127d
ab5e6a3b241084ca9059733a7127b3ce1a5a03490dcfa2a39355d0a725d8a80f
bda493e7bf82c322bdb5c7e577b149cf4e4fca4709dd8eba7e2c9174fe90e9f8
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e75328d6933c2a3491de009c90102a91049d6e7ca600fed5538b68a3394e1fea
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155
f8a612bc01431507ffadb91f3cfd90d4356d198f413f759337eaa33ea01c6f75