serigrafia.com.ar Open in urlscan Pro
2800:6c0:2::116 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php
Effective URL:
https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php
Submission: On April 12 via manual (April 12th 2024, 11:07:07 am UTC) from DE — Scanned from DE

Summary HTTP 6 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 2800:6c0:2::116, located in Buenos Aires, Argentina and belongs to Dattatec.com, AR. The main domain is serigrafia.com.ar.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 13th 2024. Valid for: a year.

This is the only time serigrafia.com.ar was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: TF Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
5	2800:6c0:2::116 2800:6c0:2::116		27823 (Dattatec.com) (Dattatec.com)
6	2

5 2800:6c0:2::116 (Buenos Aires, Argentina)

ASN27823 (Dattatec.com, AR)

serigrafia.com.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	serigrafia.com.ar serigrafia.com.ar	2 MB
0	shur4u.co.il Failed tds.shur4u.co.il Failed
6	2

	Domain	Requested by
5	serigrafia.com.ar	serigrafia.com.ar
0	tds.shur4u.co.il Failed
6	2

This site contains no links.

Subject Issuer	Validity	Valid
serigrafia.com.ar Sectigo RSA Domain Validation Secure Server CA	`2024-03-13` - `2025-03-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php
Frame ID: 0138186A7467863F0E8510F3A463FE31
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

tfbank

Page URL History Show full URLs

http://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php HTTP 307
https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Page Statistics

6
Requests

83 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

2329 kB
Transfer

4897 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php HTTP 307
https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://serigrafia.com.ar/kundenservice/tfbankonline/web/css/favicon.ico HTTP 0
http://tds.shur4u.co.il/allht

6 HTTP transactions
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response serigrafia.com.ar/kundenservice/tfbankonline/web/ Redirect Chain http://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php	4 KB 2 KB	1233ms 229ms	Document text/html	2800:6c0:2::116 Dattatec.com
General Check archive.org Show headers Download Go to Full URL https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2800:6c0:2::116 Buenos Aires, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS Software Apache / PHP/5.6.40 Resource Hash `d98782d5a8a08c7dc1e3d5be138bd63033805a8e85f2062ef663f613fe18f65b` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers content-encoding gzip content-length 2134 content-type text/html; charset=UTF-8 date Fri, 12 Apr 2024 11:07:01 GMT server Apache vary Accept-Encoding x-powered-by PHP/5.6.40 Redirect headers Location https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php Non-Authoritative-Reason HttpsUpgrades
GET H2	200	style.js Show response serigrafia.com.ar/kundenservice/tfbankonline/web/layout/js/	96 KB 34 KB	229ms 228ms	Script application/javascript	2800:6c0:2::116 Dattatec.com
General Check archive.org Show headers Download Go to Full URL https://serigrafia.com.ar/kundenservice/tfbankonline/web/layout/js/style.js Requested by Host: serigrafia.com.ar URL: https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2800:6c0:2::116 Buenos Aires, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS Software Apache / Resource Hash `1fe16a32fcc5f88e626cd18256ac7fffe64b0c9f6a21c993c97e02e97cc36b6c` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers date Fri, 12 Apr 2024 11:07:02 GMT content-encoding gzip last-modified Sat, 27 May 2023 02:02:38 GMT server Apache etag "18055-5fca33f742b80-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 34546
GET H2	200	1.css serigrafia.com.ar/kundenservice/tfbankonline/web/css/	421 KB 205 KB	453ms 453ms	Stylesheet text/css	2800:6c0:2::116 Dattatec.com
General Check archive.org Show headers Download Go to Full URL https://serigrafia.com.ar/kundenservice/tfbankonline/web/css/1.css Requested by Host: serigrafia.com.ar URL: https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2800:6c0:2::116 Buenos Aires, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS Software Apache / Resource Hash `5318c21e5659d53efe2d092d35ccba921d9864e192da34a3cf54ca9eebf29dab` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers date Fri, 12 Apr 2024 11:07:02 GMT content-encoding gzip last-modified Sat, 27 May 2023 02:02:38 GMT server Apache etag "693a8-5fca33f742b80-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes
GET H2	200	2.css serigrafia.com.ar/kundenservice/tfbankonline/web/css/	2 MB 2 MB	453ms 453ms	Stylesheet text/css	2800:6c0:2::116 Dattatec.com
General Check archive.org Show headers Download Go to Full URL https://serigrafia.com.ar/kundenservice/tfbankonline/web/css/2.css Requested by Host: serigrafia.com.ar URL: https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2800:6c0:2::116 Buenos Aires, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS Software Apache / Resource Hash `70761f8ffb9703975c747c54e5c2b990b04966c75afbd989dd430ce4491f801c` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers date Fri, 12 Apr 2024 11:07:02 GMT content-encoding gzip last-modified Sat, 27 May 2023 02:02:38 GMT server Apache etag "271b5d-5fca33f742b80-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes
GET H2	200	wave.css serigrafia.com.ar/kundenservice/tfbankonline/web/css/	973 B 467 B	226ms 225ms	Stylesheet text/css	2800:6c0:2::116 Dattatec.com
General Check archive.org Show headers Download Go to Full URL https://serigrafia.com.ar/kundenservice/tfbankonline/web/css/wave.css Requested by Host: serigrafia.com.ar URL: https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2800:6c0:2::116 Buenos Aires, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS Software Apache / Resource Hash `31974d1e4d7235e911151c22a9cef62990bc27452cddb1b22c25a380f1231da3` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers date Fri, 12 Apr 2024 11:07:02 GMT content-encoding gzip last-modified Sat, 27 May 2023 02:02:38 GMT server Apache etag "3cd-5fca33f742b80-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 355
GET DATA	200 OK	truncated /	2 MB 0		Image image/webp
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a6bcbccd8410b2044e7a005c74c71c09c8ffc2021f516b191c84f2744e6f3cc1` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Content-Type image/webp
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a1c5ae128a15c00c005f02cab2836792f33932f4ff2b4ffde7dda864641d169e` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5ca9e44cda59c6232b2393b76a2e68e36dd7c588e96c4dfefea7363fdd94f322` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	302 KB 302 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8e7948221210e0bff86b70de2a2e893e24e0d9c5a16a5db0aa47834b88bf1998` Request headers Referer Origin https://serigrafia.com.ar Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers Content-Type application/octet-stream
GET		allht tds.shur4u.co.il/ Redirect Chain https://serigrafia.com.ar/kundenservice/tfbankonline/web/css/favicon.ico http://tds.shur4u.co.il/allht	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: tds.shur4u.co.il
URL: http://tds.shur4u.co.il/allht

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: TF Bank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| preventBack object| Modernizr function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://serigrafia.com.ar/kundenservice/tfbankonline/web/login.php Message: Refused to load the image 'http://tds.shur4u.co.il/allht' because it violates the following Content Security Policy directive: "img-src 'self' data:".

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

serigrafia.com.ar
tds.shur4u.co.il
tds.shur4u.co.il
2800:6c0:2::116
1fe16a32fcc5f88e626cd18256ac7fffe64b0c9f6a21c993c97e02e97cc36b6c
31974d1e4d7235e911151c22a9cef62990bc27452cddb1b22c25a380f1231da3
5318c21e5659d53efe2d092d35ccba921d9864e192da34a3cf54ca9eebf29dab
5ca9e44cda59c6232b2393b76a2e68e36dd7c588e96c4dfefea7363fdd94f322
70761f8ffb9703975c747c54e5c2b990b04966c75afbd989dd430ce4491f801c
8e7948221210e0bff86b70de2a2e893e24e0d9c5a16a5db0aa47834b88bf1998
a1c5ae128a15c00c005f02cab2836792f33932f4ff2b4ffde7dda864641d169e
a6bcbccd8410b2044e7a005c74c71c09c8ffc2021f516b191c84f2744e6f3cc1
d98782d5a8a08c7dc1e3d5be138bd63033805a8e85f2062ef663f613fe18f65b

serigrafia.com.ar Open in urlscan Pro 2800:6c0:2::116 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

2329 kBTransfer

4897 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

serigrafia.com.ar Open in urlscan Pro
2800:6c0:2::116 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

2329 kB
Transfer

4897 kB
Size

0
Cookies

6 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!