Windows Analysis Report
Remittance.html

Overview

General Information

Sample Name: Remittance.html
Analysis ID: 756206
MD5: 2e6a26923a22e7c63a143e11227d4161
SHA1: 8f6857398dfe794b8853efc9e02d57b12a0b3da5
SHA256: 6ff75a1daf291abf72a3be2bb5034b0b0002ed90f7ea9c40ea84b66151fdae7e
Infos:

Detection

Captcha Phish, HTMLPhisher
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Phishing site detected (based on favicon image match)
Yara detected HtmlPhish10
Yara detected Captcha Phish
HTML document with suspicious name
JA3 SSL client fingerprint seen in connection with other malware
HTML body contains low number of good links
Invalid T&C link found
Suspicious form URL found
IP address seen in connection with other malware
No HTML title found

Classification

Phishing
barindex
Phishing site detected (based on favicon image match)
Source: https://svrciviltechnologies.com/qr/main/main/main.php Matcher: Template: microsoft matched with high similarity
Yara detected HtmlPhish10
Source: Yara match File source: 94194.8.pages.csv, type: HTML
Yara detected Captcha Phish
Source: Yara match File source: 73402.1.pages.csv, type: HTML
Source: Yara match File source: 39468.7.pages.csv, type: HTML
HTML body contains low number of good links
Source: https://svrciviltechnologies.com/qr/main/main/main.php HTTP Parser: Number of links: 0
Invalid T&C link found
Source: https://svrciviltechnologies.com/qr/main/main/main.php HTTP Parser: Invalid link: Terms of use
Source: https://svrciviltechnologies.com/qr/main/main/main.php HTTP Parser: Invalid link: Privacy & cookies
Suspicious form URL found
Source: https://svrciviltechnologies.com/qr/main/main/main.php HTTP Parser: Form action: action.php
No HTML title found
Source: https://svrciviltechnologies.com/qr/main/main/main.php HTTP Parser: HTML title missing
Source: https://svrciviltechnologies.com/qr/main/main/main.php HTTP Parser: No <meta name="author".. found
Source: https://svrciviltechnologies.com/qr/main/main/main.php HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater Jump to behavior
Source: unknown HTTPS traffic detected: 51.210.156.152:443 -> 192.168.2.3:49802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.210.156.152:443 -> 192.168.2.3:49801 version: TLS 1.2
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View IP Address: 104.18.10.207 104.18.10.207
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.102Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /qr/main?e=?Facilities@fsbwa.com HTTP/1.1Host: svrciviltechnologies.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /qr/main/?e=?Facilities@fsbwa.com HTTP/1.1Host: svrciviltechnologies.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /qr/main/main HTTP/1.1Host: svrciviltechnologies.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /qr/main/main/ HTTP/1.1Host: svrciviltechnologies.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.3.1/css/bootstrap.min.css HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://svrciviltechnologies.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://svrciviltechnologies.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiTocsBCIurzAEI+7vMAQjWvMwBCJjRzAE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://svrciviltechnologies.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb&co=aHR0cHM6Ly9zdnJjaXZpbHRlY2hub2xvZ2llcy5jb206NDQz&hl=en&v=Km9gKuG06He-isPsP6saG8cn&size=normal&cb=ndxp9hxikqk HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiTocsBCIurzAEI+7vMAQjWvMwBCJjRzAE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://svrciviltechnologies.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=Km9gKuG06He-isPsP6saG8cn HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiTocsBCIurzAEI+7vMAQjWvMwBCJjRzAE=Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb&co=aHR0cHM6Ly9zdnJjaXZpbHRlY2hub2xvZ2llcy5jb206NDQz&hl=en&v=Km9gKuG06He-isPsP6saG8cn&size=normal&cb=ndxp9hxikqkAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=Km9gKuG06He-isPsP6saG8cn&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiTocsBCIurzAEI+7vMAQjWvMwBCJjRzAE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://svrciviltechnologies.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: svrciviltechnologies.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://svrciviltechnologies.com/qr/main/main/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2020/02/cropped-IMG-20200221-WA0039-removebg-preview-32x32.png HTTP/1.1Host: svrciviltechnologies.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://svrciviltechnologies.com/qr/main/main/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/payload?p=06AEkXODD1_BdB7nrMCvTq-x5W-ERRA2trmCU7z6q9Ohx3TZJQz8IBQZNXRTpXomJG04OVLjYiuJG6KMWK7dDdEZVH3HfVlu5Y1MRSCWqvoYZyOTZAJPJBgVTzY1izWleMWQ1DdNyNVyR64t3bez5sDMUahfW9fGzMqb09hVueeaIuKLbXoTcDUNKEKtPgqJx3qSMQ9726-FY5QGW7dHeOBTjK3VDzNLKONA&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiTocsBCIurzAEI+7vMAQjWvMwBCJjRzAE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=Km9gKuG06He-isPsP6saG8cn&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09APvHZ3o1InIvjYBrpCRNQlY1kgn1CgWUnm3L6-j2Zij8X3RhIYkNUiytuwITU8x6ol_mJkV8-w8IrNK0qUdjuKg
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/payload?p=06AEkXODD1_BdB7nrMCvTq-x5W-ERRA2trmCU7z6q9Ohx3TZJQz8IBQZNXRTpXomJG04OVLjYiuJG6KMWK7dDdEZVH3HfVlu5Y1MRSCWqvoYZyOTZAJPJBgVTzY1izWleMWQ1DdNyNVyR64t3bez5sDMUahfW9fGzMqb09hVueeaIuKLbXoTcDUNKEKtPgqJx3qSMQ9726-FY5QGW7dHeOBTjK3VDzNLKONA&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb&id=2 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiTocsBCIurzAEI+7vMAQjWvMwBCJjRzAE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=Km9gKuG06He-isPsP6saG8cn&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09APvHZ3o1InIvjYBrpCRNQlY1kgn1CgWUnm3L6-j2Zij8X3RhIYkNUiytuwITU8x6ol_mJkV8-w8IrNK0qUdjuKg
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/payload?p=06AEkXODDBsSDm1gZwjhI95pI5c4GaymKZ6r6Iw096p69astcTB3G4FXgfiittMYfFWq2EDjyd_PO35Xo8aQWy442eIPrtPQgRcERcH50_bB30vydG3nbQSKX-Ys3S96DPr2GptcX5QBPkLNhhGtPbu7tBPyA0sOZVjaV3W5rwHGPoNmQe61xiRIc3B4oq2HOuxGlnLHV9yMiv34I9yPlTP684ylRSb7h2wg&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiTocsBCIurzAEI+7vMAQjWvMwBCJjRzAE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=Km9gKuG06He-isPsP6saG8cn&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09APvHZ3o1InIvjYBrpCRNQlY1kgn1CgWUnm3L6-j2Zij8X3RhIYkNUiytuwITU8x6ol_mJkV8-w8IrNK0qUdjuKg
Source: global traffic HTTP traffic detected: GET /qr/main/main/css/bootstrap.min.css HTTP/1.1Host: svrciviltechnologies.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://svrciviltechnologies.com/qr/main/main/main.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /qr/main/main/css/style.css HTTP/1.1Host: svrciviltechnologies.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://svrciviltechnologies.com/qr/main/main/main.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /qr/main/main/images/arrow.JPG HTTP/1.1Host: svrciviltechnologies.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://svrciviltechnologies.com/qr/main/main/main.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /qr/main/main/images/ellipsis_white.svg HTTP/1.1Host: svrciviltechnologies.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://svrciviltechnologies.com/qr/main/main/main.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /ajax/libs/jquery/3.3.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://svrciviltechnologies.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://svrciviltechnologies.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fsbwa.com HTTP/1.1Host: logo.clearbit.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://svrciviltechnologies.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /qr/main/main/images/bg.jpg HTTP/1.1Host: svrciviltechnologies.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://svrciviltechnologies.com/qr/main/main/css/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /qr/main/main/images/favicon.ico HTTP/1.1Host: svrciviltechnologies.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://svrciviltechnologies.com/qr/main/main/main.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /qr/main/main/images/arrow.JPG HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: svrciviltechnologies.com
Source: global traffic HTTP traffic detected: GET /qr/main/main/images/favicon.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: svrciviltechnologies.com
Source: global traffic HTTP traffic detected: GET /qr/main/main/images/ellipsis_white.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: svrciviltechnologies.com
Source: global traffic HTTP traffic detected: GET /qr/main/main/main.php HTTP/1.1Host: svrciviltechnologies.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://svrciviltechnologies.com/qr/main/main/main.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9cb51f99c0e1a0dd3a7d236137ff62c9
Source: global traffic HTTP traffic detected: GET /qr/main/main/images/arrow.JPG HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: svrciviltechnologies.comIf-Modified-Since: Fri, 29 Mar 2019 11:05:22 GMT
Source: global traffic HTTP traffic detected: GET /qr/main/main/images/ellipsis_white.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: svrciviltechnologies.comIf-Modified-Since: Fri, 29 Mar 2019 11:05:22 GMT
Source: Remittance.html String found in binary or memory: https://svrciviltechnologies.com/qr/main?e=?$
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E
Source: unknown HTTPS traffic detected: 51.210.156.152:443 -> 192.168.2.3:49802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.210.156.152:443 -> 192.168.2.3:49801 version: TLS 1.2

System Summary
barindex
HTML document with suspicious name
Source: Name includes: Remittance.html Initial sample: remit
Source: classification engine Classification label: mal68.phis.winHTML@25/0@16/12
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\Remittance.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1812,i,8274798147493147586,16206874965015421851,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1812,i,8274798147493147586,16206874965015421851,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\GoogleUpdater Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 756206 Sample: Remittance.html Startdate: 29/11/2022 Architecture: WINDOWS Score: 68 13 www.google.com 2->13 15 svrciviltechnologies.com 2->15 17 2 other IPs or domains 2->17 29 Phishing site detected (based on favicon image match) 2->29 31 Yara detected Captcha Phish 2->31 33 Yara detected HtmlPhish10 2->33 35 HTML document with suspicious name 2->35 7 chrome.exe 16 1 2->7         started        signatures3 process4 dnsIp5 19 192.168.2.1 unknown unknown 7->19 21 239.255.255.250 unknown Reserved 7->21 10 chrome.exe 7->10         started        process6 dnsIp7 23 svrciviltechnologies.com 51.210.156.152, 443, 49695, 49697 OVHFR France 10->23 25 d26p066pn2w0s0.cloudfront.net 18.66.30.94, 443, 49788 MIT-GATEWAYSUS United States 10->25 27 10 other IPs or domains 10->27
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.18.10.207
 stackpath.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
142.250.186.36
 www.google.com United States
15169 GOOGLEUS false
104.18.11.207
 maxcdn.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
142.250.186.109
 accounts.google.com United States
15169 GOOGLEUS false
18.66.30.94
 d26p066pn2w0s0.cloudfront.net United States
3 MIT-GATEWAYSUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.186.110
 clients.l.google.com United States
15169 GOOGLEUS false
142.250.186.100
 unknown United States
15169 GOOGLEUS false
51.210.156.152
 svrciviltechnologies.com France
16276 OVHFR false
104.17.25.14
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
stackpath.bootstrapcdn.com 104.18.10.207 true
d26p066pn2w0s0.cloudfront.net 18.66.30.94 true
accounts.google.com 142.250.186.109 true
cdnjs.cloudflare.com 104.17.25.14 true
maxcdn.bootstrapcdn.com 104.18.11.207 true
svrciviltechnologies.com 51.210.156.152 true
www.google.com 142.250.186.36 true
clients.l.google.com 142.250.186.110 true
clients2.google.com unknown unknown
logo.clearbit.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://svrciviltechnologies.com/qr/main?e=?Facilities@fsbwa.com false
  • Avira URL Cloud: safe
 unknown
https://www.google.com/recaptcha/api2/payload?p=06AEkXODD1_BdB7nrMCvTq-x5W-ERRA2trmCU7z6q9Ohx3TZJQz8IBQZNXRTpXomJG04OVLjYiuJG6KMWK7dDdEZVH3HfVlu5Y1MRSCWqvoYZyOTZAJPJBgVTzY1izWleMWQ1DdNyNVyR64t3bez5sDMUahfW9fGzMqb09hVueeaIuKLbXoTcDUNKEKtPgqJx3qSMQ9726-FY5QGW7dHeOBTjK3VDzNLKONA&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb&id=2 false
    		high
    https://svrciviltechnologies.com/wp-content/uploads/2020/02/cropped-IMG-20200221-WA0039-removebg-preview-32x32.png false
    • Avira URL Cloud: safe
    		 unknown
    https://svrciviltechnologies.com/qr/main/main/ false
      		unknown
      https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css false
        		high
        https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css false
          		high
          https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
            		high
            https://svrciviltechnologies.com/qr/main/?e=?Facilities@fsbwa.com false
            • Avira URL Cloud: safe
            		 unknown
            https://www.google.com/recaptcha/api2/userverify?k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb false
              		high
              https://svrciviltechnologies.com/qr/main/main/css/bootstrap.min.css false
              • Avira URL Cloud: safe
              		 unknown
              https://svrciviltechnologies.com/qr/main/main/ false
                		unknown
                https://svrciviltechnologies.com/qr/main/main/action.php false
                • Avira URL Cloud: safe
                		 unknown
                https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=Km9gKuG06He-isPsP6saG8cn false
                  		high
                  https://www.google.com/recaptcha/api2/bframe?hl=en&v=Km9gKuG06He-isPsP6saG8cn&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb false
                    		high
                    https://svrciviltechnologies.com/qr/main/main/images/arrow.JPG false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://svrciviltechnologies.com/qr/main/main/images/ellipsis_white.svg false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://svrciviltechnologies.com/qr/main/main/images/bg.jpg false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://www.google.com/recaptcha/api2/payload?p=06AEkXODDBsSDm1gZwjhI95pI5c4GaymKZ6r6Iw096p69astcTB3G4FXgfiittMYfFWq2EDjyd_PO35Xo8aQWy442eIPrtPQgRcERcH50_bB30vydG3nbQSKX-Ys3S96DPr2GptcX5QBPkLNhhGtPbu7tBPyA0sOZVjaV3W5rwHGPoNmQe61xiRIc3B4oq2HOuxGlnLHV9yMiv34I9yPlTP684ylRSb7h2wg&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb false
                      		high
                      https://svrciviltechnologies.com/favicon.ico false
                      • Avira URL Cloud: safe
                      		 unknown
                      https://svrciviltechnologies.com/qr/main/main/css/style.css false
                      • Avira URL Cloud: safe
                      		 unknown
                      https://www.google.com/recaptcha/api.js false
                        		high
                        https://www.google.com/recaptcha/api2/replaceimage?k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb false
                          		high
                          https://svrciviltechnologies.com/qr/main/main/main.php true
                            		unknown
                            https://svrciviltechnologies.com/qr/main/main false
                            • Avira URL Cloud: safe
                            		 unknown
                            https://logo.clearbit.com/fsbwa.com false
                              		high
                              https://svrciviltechnologies.com/qr/main/main/main.php true
                                		unknown
                                https://www.google.com/recaptcha/api2/bframe?hl=en&v=Km9gKuG06He-isPsP6saG8cn&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb false
                                  		high
                                  https://www.google.com/recaptcha/api2/payload?p=06AEkXODD1_BdB7nrMCvTq-x5W-ERRA2trmCU7z6q9Ohx3TZJQz8IBQZNXRTpXomJG04OVLjYiuJG6KMWK7dDdEZVH3HfVlu5Y1MRSCWqvoYZyOTZAJPJBgVTzY1izWleMWQ1DdNyNVyR64t3bez5sDMUahfW9fGzMqb09hVueeaIuKLbXoTcDUNKEKtPgqJx3qSMQ9726-FY5QGW7dHeOBTjK3VDzNLKONA&k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb false
                                    		high
                                    https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js false
                                      		high
                                      https://www.google.com/recaptcha/api2/reload?k=6LevKEMjAAAAACrP5tlDxBo0GwS2VQ_w4JoD2PKb false
                                        		high
                                        https://svrciviltechnologies.com/qr/main/main/images/favicon.ico false
                                        • Avira URL Cloud: safe
                                        		 unknown
                                        https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 false
                                          		high