bbva-pdftools.vipnetsaas.com Open in urlscan Pro
82.223.13.34 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bbva-pdftools.vipnetsaas.com/
Effective URL:
https://bbva-pdftools.vipnetsaas.com/login
Submission: On May 20 via automatic, source certstream-suspicious (May 20th 2024, 2:20:14 pm UTC) — Scanned from ES

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 82.223.13.34, located in Spain and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is bbva-pdftools.vipnetsaas.com.
TLS certificate: Issued by R3 on May 20th 2024. Valid for: 3 months.

This is the only time bbva-pdftools.vipnetsaas.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BBVA (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 4	82.223.13.34 82.223.13.34	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1	2a04:4e42:400... 2a04:4e42:400::485	54113 (FASTLY) (FASTLY)
2	2606:4700:20:... 2606:4700:20::ac43:4b21	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
1	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	5

4 82.223.13.34 (Spain) 1 redirects

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)

bbva-pdftools.vipnetsaas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:4b21 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.datatables.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

tailwindui.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	vipnetsaas.com 1 redirects bbva-pdftools.vipnetsaas.com	6 KB
2	datatables.net cdn.datatables.net — Cisco Umbrella Rank: 4919	30 KB
1	tailwindui.com tailwindui.com — Cisco Umbrella Rank: 355317	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 776	30 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 310	270 KB
8	5

	Domain	Requested by
4	bbva-pdftools.vipnetsaas.com	1 redirects bbva-pdftools.vipnetsaas.com
2	cdn.datatables.net	bbva-pdftools.vipnetsaas.com
1	tailwindui.com	bbva-pdftools.vipnetsaas.com
1	code.jquery.com	bbva-pdftools.vipnetsaas.com
1	cdn.jsdelivr.net	bbva-pdftools.vipnetsaas.com
8	5

This site contains no links.

Subject Issuer	Validity	Valid
bbva-pdftools.vipnetsaas.com R3	`2024-05-20` - `2024-08-18`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
datatables.net GTS CA 1P5	`2024-03-27` - `2024-06-25`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
tailwindui.com GTS CA 1P5	`2024-05-20` - `2024-08-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bbva-pdftools.vipnetsaas.com/login
Frame ID: E53F0D81F9493C7D9C226152706E2BF3
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BBVA

Page URL History Show full URLs

https://bbva-pdftools.vipnetsaas.com/ HTTP 302
https://bbva-pdftools.vipnetsaas.com/login Page URL

Detected technologies

DataTables (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

dataTables.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

8
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

336 kB
Transfer

3058 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bbva-pdftools.vipnetsaas.com/ HTTP 302
https://bbva-pdftools.vipnetsaas.com/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login Show response
bbva-pdftools.vipnetsaas.com/
Redirect Chain

https://bbva-pdftools.vipnetsaas.com/
https://bbva-pdftools.vipnetsaas.com/login

6 KB
3 KB

98ms
97ms

Document
text/html

82.223.13.34
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://bbva-pdftools.vipnetsaas.com/login
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 82.223.13.34 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: nginx / PHP/8.2.19 PleskLin
Resource Hash: c88b04734cf738247bb87c4fbb939217f7d6b958e3add4dcb5811c7f68da09a5

Request headers

Accept-Language: es-ES,es;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: private, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 20 May 2024 14:20:10 GMT
expires: -1
pragma: no-cache
server: nginx
x-powered-by: PHP/8.2.19 PleskLin

Redirect headers

cache-control: private, must-revalidate
content-type: text/html; charset=utf-8
date: Mon, 20 May 2024 14:20:10 GMT
expires: -1
location: https://bbva-pdftools.vipnetsaas.com/login
pragma: no-cache
server: nginx
x-powered-by: PHP/8.2.19 PleskLin

GET
H2 200 tailwind.min.css
cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/ 3 MB
270 KB 133ms
42ms Stylesheet
text/css 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css

Requested by

Host: bbva-pdftools.vipnetsaas.com
URL: https://bbva-pdftools.vipnetsaas.com/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b6ad97402eddb903e7a5d7a73ee47a679204efbdda4521a391cbad9df509b932

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://bbva-pdftools.vipnetsaas.com/
Accept-Language: es-ES,es;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 20 May 2024 14:20:10 GMT
x-content-type-options: nosniff
content-encoding: br
age: 1077098
x-jsd-version: 2.2.19
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 275864
x-served-by: cache-fra-eddf8230029-FRA, cache-mad2200140-MAD
x-jsd-version-type: version
etag: W/"2cc503-cyTPK4s7rX9aC3Y3NNaHIxjV1fQ"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 jquery.dataTables.min.css
cdn.datatables.net/1.10.21/css/ 14 KB
2 KB 139ms
51ms Stylesheet
text/css 2606:4700:20::ac43:4b21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.datatables.net/1.10.21/css/jquery.dataTables.min.css

Requested by

Host: bbva-pdftools.vipnetsaas.com
URL: https://bbva-pdftools.vipnetsaas.com/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4b21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36c8cf50f6b50d4a39d4df1ac37b957f8ca0b7210107c0f30c07c7d9e4494d4b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://bbva-pdftools.vipnetsaas.com/
Accept-Language: es-ES,es;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 20 May 2024 14:20:10 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2418883
last-modified: Fri, 19 Apr 2024 08:45:39 GMT
server: cloudflare
etag: W/"66222f33-3644"
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hKVj3qZMGPK6tmsN2e3AWlqGkBEbhCn5t45DvMJ1yRwSS5dgpSHGNIDUtYwsU91F5K9CWlw578BuFBywquaQ9ikm3cRUxK5jXUmCjdAcHrpHl5uAta4b5CNQR0nTwSSR4QFT4%2FFBJD14PXagZa%2FlWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
cf-ray: 886cf7448be186c9-MAD
access-control-allow-headers: origin, x-requested-with, content-type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 130ms
39ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: bbva-pdftools.vipnetsaas.com
URL: https://bbva-pdftools.vipnetsaas.com/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://bbva-pdftools.vipnetsaas.com/
Accept-Language: es-ES,es;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 20 May 2024 14:20:10 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 2070982
x-cache: HIT, HIT
content-length: 30879
x-served-by: cache-lga21981-LGA, cache-mad22068-MAD
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1716214810.325416,VS0,VE0
etag: W/"28feccc0-15d84"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 21, 157052

GET
H2 200 jquery.dataTables.min.js Show response
cdn.datatables.net/1.10.21/js/ 83 KB
27 KB 148ms
60ms Script
text/javascript 2606:4700:20::ac43:4b21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.datatables.net/1.10.21/js/jquery.dataTables.min.js

Requested by

Host: bbva-pdftools.vipnetsaas.com
URL: https://bbva-pdftools.vipnetsaas.com/login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4b21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ffbce8dbb2e5fe154a842b04fb2f26d924b96e114f11016179308bf3b1eeba60

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://bbva-pdftools.vipnetsaas.com/
Accept-Language: es-ES,es;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 20 May 2024 14:20:10 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2418884
last-modified: Fri, 19 Apr 2024 08:45:39 GMT
server: cloudflare
etag: W/"66222f33-14aa7"
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, GET
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F5VNN3YgMbexBO394TD2Ely3tUFI8mRXyZRUWLe2P9RpkalT0QDvRlAdDOHt1MAVATzp6RQQgHKHXC4obNuCU%2BwiyL0I5LQusxhbhCwIIXN0XWCVpwvRqBP32Mab9iBQysv8yb15o%2Bharu9E7B3HXg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
cf-ray: 886cf7448be486c9-MAD
access-control-allow-headers: origin, x-requested-with, content-type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 logo_bbva_blanco.svg
bbva-pdftools.vipnetsaas.com/content/ 2 KB
2 KB 50ms
49ms Image
image/svg+xml 82.223.13.34
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bbva-pdftools.vipnetsaas.com/content/logo_bbva_blanco.svg
Requested by: Host: bbva-pdftools.vipnetsaas.com
URL: https://bbva-pdftools.vipnetsaas.com/login
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 82.223.13.34 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 4110bfbebf5162bd8ce32b34a411c8c4ec827b0d65947993c25379646e5db120

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://bbva-pdftools.vipnetsaas.com/login
Accept-Language: es-ES,es;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 20 May 2024 14:20:10 GMT
last-modified: Tue, 14 May 2024 06:14:06 GMT
server: nginx
etag: "6643012e-769"
x-powered-by: PleskLin
content-type: image/svg+xml
accept-ranges: bytes
content-length: 1897

GET
H3 200 mark.svg
tailwindui.com/img/logos/ 1 KB
1 KB 248ms
174ms Image
image/svg+xml 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tailwindui.com/img/logos/mark.svg?color=indigo&shade=600

Requested by

Host: bbva-pdftools.vipnetsaas.com
URL: https://bbva-pdftools.vipnetsaas.com/login

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6266da6bd8587743482853fb382bd4a4dfe46e87afc8f67c6af1468ec53f0ac5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://bbva-pdftools.vipnetsaas.com/
Accept-Language: es-ES,es;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 20 May 2024 14:20:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0L%2FY2ysey9ao2ha%2F%2BW5ZsECiIjuuxqLC4J8vfsox5qvR5ZCtcjKLlghLj9RTmfc2m%2Bx4%2FZ7C9VoQU31xDL73uZc0u%2BOVP1nBIKIT51R%2BWtwbtHp2gyaoObWM7K4cmZlbfg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache, private
cf-ray: 886cf7447dda3cc5-CDG
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H2 200 favicon.ico
bbva-pdftools.vipnetsaas.com/ 0
166 B 49ms
49ms Other
image/vnd.microsoft.icon 82.223.13.34
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://bbva-pdftools.vipnetsaas.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 82.223.13.34 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://bbva-pdftools.vipnetsaas.com/login
Accept-Language: es-ES,es;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 20 May 2024 14:20:10 GMT
last-modified: Tue, 14 May 2024 06:14:06 GMT
server: nginx
x-accel-version: 0.01
etag: "0-61863e8c02780"
x-powered-by: PleskLin
content-type: image/vnd.microsoft.icon
accept-ranges: bytes
content-length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BBVA (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| $jscomp

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			bbva-pdftools.vipnetsaas.com/	1970-01-20 20:43:42	Name: XSRF-TOKEN Value: eyJpdiI6InhySFBHSUdwazRsWDZXR3JETjZtZUE9PSIsInZhbHVlIjoiWWx2OWp5SFd4elhxQlhqWUx2TGZTd3J0SmhMRXg4cndTVlYyZktUZ0tYbXp3aFdxMzk4TUhwcmRkNnZlazNTSlRDMVhjUHVCamE5NkF5V2JsaHFWbTFkUXFOaHZJZTQ1Z0J5dVZlZi9kMXZHc3k4MXVZQ295M21seWxkZFQxay8iLCJtYWMiOiI5ODA1NWJjMGE1YjMwYTIxZmI0Nzc2YzdhZDhmOThkZDdmNWRkZmEwZTc1ZTg2MGU2NDRjMmI1MzQ0OWEyMWQ5IiwidGFnIjoiIn0%3D
			bbva-pdftools.vipnetsaas.com/	1970-01-20 20:43:42	Name: bbva_pdf_tool_session Value: eyJpdiI6IktqcmtBc0h5dSticnhjNStWckNTdHc9PSIsInZhbHVlIjoiRklWSFJPbUxaTEVlUTJ6OS9ucE9YMzhLcG9VOWwxYnhEeXdwaFhTQUJwMmRQT0FSRXpoeGZiWmc4ZmZsZnk5ZXNYVzJsV1Q2c3Q5WEZGRUMyQWNUYzNCWEJGVmNneGFrLzNLTTBmbmNmRktwbmFCTEU2YTNUR0RSZ3lkaDJQQkMiLCJtYWMiOiJjODYyZWVkNDJjODBiODdlMjBjMjkxMzE0OTNkOTQxZWEyZGU2MjQ0NDE0OWI1NTc4YzRmNmM2ZGE2OTY5YTUzIiwidGFnIjoiIn0%3D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://bbva-pdftools.vipnetsaas.com/login Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bbva-pdftools.vipnetsaas.com
cdn.datatables.net
cdn.jsdelivr.net
code.jquery.com
tailwindui.com
188.114.96.3
2606:4700:20::ac43:4b21
2a04:4e42:400::485
2a04:4e42:400::649
82.223.13.34
36c8cf50f6b50d4a39d4df1ac37b957f8ca0b7210107c0f30c07c7d9e4494d4b
4110bfbebf5162bd8ce32b34a411c8c4ec827b0d65947993c25379646e5db120
6266da6bd8587743482853fb382bd4a4dfe46e87afc8f67c6af1468ec53f0ac5
b6ad97402eddb903e7a5d7a73ee47a679204efbdda4521a391cbad9df509b932
c88b04734cf738247bb87c4fbb939217f7d6b958e3add4dcb5811c7f68da09a5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
ffbce8dbb2e5fe154a842b04fb2f26d924b96e114f11016179308bf3b1eeba60

bbva-pdftools.vipnetsaas.com Open in urlscan Pro 82.223.13.34 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

336 kBTransfer

3058 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

bbva-pdftools.vipnetsaas.com Open in urlscan Pro
82.223.13.34 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

336 kB
Transfer

3058 kB
Size

2
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!