promo-personas-clientes-linea.site Open in urlscan Pro
2606:4700:3030::6815:2159 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://promo-personas-clientes-linea.site/
Effective URL:
https://promo-personas-clientes-linea.site/
Submission: On September 23 via automatic, source openphish (September 23rd 2024, 1:02:59 pm UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3030::6815:2159, located in United States and belongs to CLOUDFLARENET, US. The main domain is promo-personas-clientes-linea.site.
TLS certificate: Issued by WE1 on September 18th 2024. Valid for: 3 months.

This is the only time promo-personas-clientes-linea.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco de Venezuela (Banking)

Domain & IP information

	IP Address		AS Autonomous System
9	2606:4700:303... 2606:4700:3030::6815:2159		13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	1

9 2606:4700:3030::6815:2159 (United States)

ASN13335 (CLOUDFLARENET, US)

promo-personas-clientes-linea.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	promo-personas-clientes-linea.site promo-personas-clientes-linea.site	140 KB
9	1

	Domain	Requested by
9	promo-personas-clientes-linea.site	promo-personas-clientes-linea.site
9	1

This site contains no links.

Subject Issuer	Validity	Valid
promo-personas-clientes-linea.site WE1	`2024-09-18` - `2024-12-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://promo-personas-clientes-linea.site/
Frame ID: 15F9BAA28CD5B9B2163FAE8C03BE12AF
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BDVenlínea personas

Page URL History Show full URLs

http://promo-personas-clientes-linea.site/ HTTP 307
https://promo-personas-clientes-linea.site/ Page URL

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

140 kB
Transfer

468 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://promo-personas-clientes-linea.site/ HTTP 307
https://promo-personas-clientes-linea.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response promo-personas-clientes-linea.site/ Redirect Chain http://promo-personas-clientes-linea.site/ https://promo-personas-clientes-linea.site/	22 KB 5 KB	733ms 669ms	Document text/html	2606:4700:3030::6815:2159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://promo-personas-clientes-linea.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:2159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4e454df8323f3361f68ca84d5edcbf6c4b08a850fee5c7874bc1a27c8e5e7070` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cf-cache-status DYNAMIC cf-ray 8c7abb538afc3643-FRA content-encoding br content-type text/html; charset=UTF-8 date Mon, 23 Sep 2024 13:02:54 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lmISvlPwse0cdxCBaIYoGbEn4FpTEAJbYkD6Mz76orQuDBVcj6fHmGMT3ce0%2BfR1jScDju7h03eF6NQtjn6JpuZC1nUmqavauwDFjR2EtH0eNnCMbVtuyjK9Psf3JJ6VuF%2FYhXDuhxXXtCdkitfu1qMBGMCSoZFpiampH2wrr2vc"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation" vary Accept-Encoding Redirect headers Location https://promo-personas-clientes-linea.site/ Non-Authoritative-Reason HttpsUpgrades
GET H2	200	speculation promo-personas-clientes-linea.site/cdn-cgi/	128 B 498 B	32ms 32ms	Other application/speculationrules+json	2606:4700:3030::6815:2159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://promo-personas-clientes-linea.site/cdn-cgi/speculation Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:2159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://promo-personas-clientes-linea.site Referer https://promo-personas-clientes-linea.site/ Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LTbF0INxzKt%2BGNKCoklz6lW7eAbFaEo4wFz3TsgPaFCSjEJgAuvbIcUvLGXo6duVsnyPjgcswQV3rpdQnGXNyLtDIccKXkxmWMYjtcLTSL1kSSZiT%2FYtTW8S93ctsxRtmlziuWCnx2qkEnSwVyq0MStaIh2JJkgMACNbRNzOMZsE"}],"group":"cf-nel","max_age":604800} cf-ray 8c7abb57d8a33643-FRA access-control-allow-origin https://promo-personas-clientes-linea.site content-length 128 date Mon, 23 Sep 2024 13:02:54 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H2	200	style.css promo-personas-clientes-linea.site/assets/	341 KB 32 KB	448ms 447ms	Stylesheet text/css	2606:4700:3030::6815:2159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://promo-personas-clientes-linea.site/assets/style.css Requested by Host: promo-personas-clientes-linea.site URL: https://promo-personas-clientes-linea.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:2159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `1c7e5ca6564d2c5ab24dc7c975ae30f32dc1df6b5ee848be3cfad40968a3a22c` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://promo-personas-clientes-linea.site/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding gzip cf-cache-status EXPIRED etag "55522-61ba48ded7580-gzip" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gs7ib%2BhcDDCpwHzON9CSAox4NLe1ZshC7ATFEhm61f62NMeBrImDt8wZNU2v26s6ORL4NmOQjXZJT0KbwaAl%2BWxwLt6EueHoNFINxM0e%2FjSDpes3kuN4RVdcEcXV42nbRf8pHhQCqVZsZdJGcQS87qmwwdbOFhyfD9JFRH2k462a"}],"group":"cf-nel","max_age":604800} cf-ray 8c7abb57d8aa3643-FRA accept-ranges bytes content-length 32230 date Mon, 23 Sep 2024 13:02:55 GMT content-type text/css last-modified Mon, 24 Jun 2024 15:37:10 GMT vary Accept-Encoding server cloudflare
GET H2	200	asi.css promo-personas-clientes-linea.site/assets/	52 B 411 B	259ms 259ms	Stylesheet text/css	2606:4700:3030::6815:2159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://promo-personas-clientes-linea.site/assets/asi.css Requested by Host: promo-personas-clientes-linea.site URL: https://promo-personas-clientes-linea.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:2159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `93af24c01c94473fc782ea883a4ee554e3e06f2ca0b004af10181ada7fc2e141` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://promo-personas-clientes-linea.site/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status REVALIDATED etag W/"34-61ba1a0d0ff80" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eRKM2DORTPF%2FxPjrdZtsLypxXeaz%2FAz7bttAITgnlvLwycP6vtgOxdG48SPM49bC25se7nMZjUnOJXIg%2FUb3HRcpOnK6%2Fwn5PpMMN6DzxAqtR%2FUUth%2Bxu0rkMylVv2gDwi1iEdP63uW%2Fra4RB7CwJ%2BKJetLrdy1sE0V%2B4eKHq3MN"}],"group":"cf-nel","max_age":604800} cf-ray 8c7abb57d8ad3643-FRA date Mon, 23 Sep 2024 13:02:54 GMT content-type text/css last-modified Mon, 24 Jun 2024 12:07:42 GMT vary Accept-Encoding server cloudflare
GET H2	200	logo.png promo-personas-clientes-linea.site/assets/	31 KB 32 KB	34ms 34ms	Image image/png	2606:4700:3030::6815:2159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://promo-personas-clientes-linea.site/assets/logo.png Requested by Host: promo-personas-clientes-linea.site URL: https://promo-personas-clientes-linea.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:2159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2db48f3bb76be4f40a324525d4e872882f59208122f0ea552759eb76beb97d3a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://promo-personas-clientes-linea.site/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT etag "7da2-61ba23c9f7900" age 2649 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Y7eXYo6kHxzDDmofl%2FRIH530o50c8sd6H4zBgTBBAQqXgmPlvA4fVo68YHbCAEJB6zDMs7LNAy5FyQir%2BiaJeO7L%2F85les2MyAuwPVZJKDKuhqnU%2F9DMr4J7P4M3U%2BIov3AR0%2FeUu8xpezOrsd15QLTvlOOE%2FToXGck3%2B3MX6T4"}],"group":"cf-nel","max_age":604800} cf-ray 8c7abb57d8ae3643-FRA accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 32162 date Mon, 23 Sep 2024 13:02:54 GMT content-type image/png last-modified Mon, 24 Jun 2024 12:51:16 GMT vary Accept-Encoding server cloudflare
GET H2	200	jav2.js Show response promo-personas-clientes-linea.site/assets/	262 B 510 B	303ms 303ms	Script application/javascript	2606:4700:3030::6815:2159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://promo-personas-clientes-linea.site/assets/jav2.js Requested by Host: promo-personas-clientes-linea.site URL: https://promo-personas-clientes-linea.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:2159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6c0b5af07d620812297ecaef34a583767b98dfde7e1baea19caac49618128e30` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://promo-personas-clientes-linea.site/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding gzip cf-cache-status EXPIRED etag "106-61ba1a0d0ff80-gzip" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g4sK2bvdbjl4x%2F7BRE2nviDoO%2F8KqNdSrc9yPJH0A8uK6GVRh8idxw%2BBvS8%2B5i5P2EEiNxDM3Wwjqa8cCJJn1S4Zj7Ro66hnl0fG6vnFavXAOFOkZxJ9mZMMnDksU3%2FA94h6LmfCaF7tyibBRc6BfrqXIKgloBZTHELQbCFfVqXF"}],"group":"cf-nel","max_age":604800} cf-ray 8c7abb57d8b13643-FRA accept-ranges bytes content-length 154 date Mon, 23 Sep 2024 13:02:54 GMT content-type application/javascript last-modified Mon, 24 Jun 2024 12:07:42 GMT vary Accept-Encoding server cloudflare
GET H2	200	app.js Show response promo-personas-clientes-linea.site/assets/	5 KB 2 KB	255ms 255ms	Script application/javascript	2606:4700:3030::6815:2159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://promo-personas-clientes-linea.site/assets/app.js Requested by Host: promo-personas-clientes-linea.site URL: https://promo-personas-clientes-linea.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:2159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `da4a7edddf188612214ccd48281a20e1fd884b8ad98ff0dea912db8234e2288c` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://promo-personas-clientes-linea.site/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding gzip cf-cache-status EXPIRED etag "15f3-61ba505da2480-gzip" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c9ikZyZxWtAuSgNr81uqqAQDuzUA1djM9snhCkkqeLvyMy9CLAlkjUJ6lF4cBmAs8PRRpwkAPZ8MTWm%2FdLmzdVoCCgkCJwkcQ4lTwwJnsLgICBfxVQ8ZyFJQRAV%2F6vnu71EObX2AB3uQMsrkqfao%2FfTglSL8FDuIkQHkpfeSq6nJ"}],"group":"cf-nel","max_age":604800} cf-ray 8c7abb5849553643-FRA accept-ranges bytes content-length 1291 date Mon, 23 Sep 2024 13:02:54 GMT content-type application/javascript last-modified Mon, 24 Jun 2024 16:10:42 GMT vary Accept-Encoding server cloudflare
GET H3	200	background.webp promo-personas-clientes-linea.site/assets/	68 KB 68 KB	36ms 36ms	Image image/webp	2606:4700:3030::6815:2159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://promo-personas-clientes-linea.site/assets/background.webp Requested by Host: promo-personas-clientes-linea.site URL: https://promo-personas-clientes-linea.site/assets/style.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:2159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fb0cb7f47385dc36d0e23bb39ae5b0e4e6cf9f9538e6f157f224975ad45776c4` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://promo-personas-clientes-linea.site/assets/style.css Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT etag "10e52-61ba23af43a00" age 3370 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BVygEa1Qyw0n%2F72lb%2Bote7LSw2yw%2BcU2Lj01rHHqgax1Duauvq9eIrqiJcRgLZnRuzqKAsyYK3oC7QgoVaX7E8w5hAtvxO65bD9Ki3wMxSElJNmQeLtk%2FCsL6ttjDFj5jbK9tvEnYH1GeeI36SO3Bc3o26ddRRxPUgmwewt6aK9h"}],"group":"cf-nel","max_age":604800} cf-ray 8c7abb5abac6d386-FRA accept-ranges bytes content-length 69202 date Mon, 23 Sep 2024 13:02:55 GMT last-modified Mon, 24 Jun 2024 12:50:48 GMT vary Accept-Encoding server cloudflare
GET H3	404	favicon.ico promo-personas-clientes-linea.site/	296 B 701 B	254ms 254ms	Other text/html	2606:4700:3030::6815:2159 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://promo-personas-clientes-linea.site/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:2159 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `49a782f264fa23a1ebae8424f16466d0ba0590a27aebedbfd095b1ef27fbec3d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://promo-personas-clientes-linea.site/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status EXPIRED speculation-rules "/cdn-cgi/speculation" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mtOdrHqjEBWpE%2BK3m0OCKETlWUKW1sXd7JWbpPMTZDVU8fnenIGNSd55GCsNQDSJna5xOY5d%2BKugEk1F%2FehQO7ZemeL8ozgtDeyeOq%2F7k0Tw5yPd9Zl4pz%2Fc72Tvkencjs6rmNnQx33Axou9hgH8sF7BpxMS2ylTdv8ACwaS6LNz"}],"group":"cf-nel","max_age":604800} cf-ray 8c7abb5b3ca8d386-FRA date Mon, 23 Sep 2024 13:02:55 GMT content-type text/html; charset=iso-8859-1 vary Accept-Encoding server cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco de Venezuela (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://promo-personas-clientes-linea.site/ Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://promo-personas-clientes-linea.site/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

promo-personas-clientes-linea.site
2606:4700:3030::6815:2159
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
1c7e5ca6564d2c5ab24dc7c975ae30f32dc1df6b5ee848be3cfad40968a3a22c
2db48f3bb76be4f40a324525d4e872882f59208122f0ea552759eb76beb97d3a
49a782f264fa23a1ebae8424f16466d0ba0590a27aebedbfd095b1ef27fbec3d
4e454df8323f3361f68ca84d5edcbf6c4b08a850fee5c7874bc1a27c8e5e7070
6c0b5af07d620812297ecaef34a583767b98dfde7e1baea19caac49618128e30
93af24c01c94473fc782ea883a4ee554e3e06f2ca0b004af10181ada7fc2e141
da4a7edddf188612214ccd48281a20e1fd884b8ad98ff0dea912db8234e2288c
fb0cb7f47385dc36d0e23bb39ae5b0e4e6cf9f9538e6f157f224975ad45776c4

promo-personas-clientes-linea.site Open in urlscan Pro 2606:4700:3030::6815:2159 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

140 kBTransfer

468 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

promo-personas-clientes-linea.site Open in urlscan Pro
2606:4700:3030::6815:2159 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

140 kB
Transfer

468 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!