www.correos.gob.bo
Open in
urlscan Pro
181.115.203.44
Malicious Activity!
Public Scan
Submission: On August 06 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 31st 2022. Valid for: a year.
This is the only time www.correos.gob.bo was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 17 | 181.115.203.44 181.115.203.44 | 6568 (Entel S.A.) (Entel S.A. - EntelNet) | |
16 | 1 |
ASN6568 (Entel S.A. - EntelNet, BO)
www.correos.gob.bo |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
correos.gob.bo
1 redirects
www.correos.gob.bo |
121 KB |
16 | 1 |
Domain | Requested by | |
---|---|---|
17 | www.correos.gob.bo |
1 redirects
www.correos.gob.bo
|
16 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.correos.gob.bo Sectigo RSA Domain Validation Secure Server CA |
2022-03-31 - 2023-03-31 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/
Frame ID: 6BC2F69FEEF5C2AFFF2FC80CB42082E8
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Bank of America | Banca en Línea | Entrar | Identificación en líneaPage URL History Show full URLs
-
https://www.correos.gob.bo/phpids/lib/IDS/Caching/inicio
HTTP 301
https://www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.correos.gob.bo/phpids/lib/IDS/Caching/inicio
HTTP 301
https://www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
normalize.min.css
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/paso1_files/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
estilos.css
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/paso1_files/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.jpg
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/paso1_files/ |
5 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lock.jpg
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/paso1_files/ |
368 B 645 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
points.jpg
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/paso1_files/ |
287 B 564 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
help.jpg
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/paso1_files/ |
793 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
movil.jpg
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/paso1_files/ |
8 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.6.0.min.js.descarga
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/paso1_files/ |
87 KB 88 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
funciones.js.descarga
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/paso1_files/ |
8 KB 9 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sign-in-sprite.jpg
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/img/ |
153 B 153 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lock2.jpg
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/img/ |
153 B 153 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
line.jpg
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/img/ |
153 B 153 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
casa.jpg
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/img/ |
153 B 153 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cnx-regular.woff
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cnx-regular.ttf
www.correos.gob.bo/phpids/lib/IDS/Caching/inicio/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)41 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| usuario object| clave object| enviarUsuario boolean| formularioUsuario string| almacen boolean| atm boolean| correo boolean| ccorreo boolean| confirmacion boolean| formularioCorreo boolean| claveusuario number| cambio boolean| cnumber boolean| mes boolean| year boolean| cvv boolean| continuar boolean| formcard boolean| card boolean| mesvalor boolean| yearvalor boolean| cvvvalor boolean| tipoIdent boolean| nIdent boolean| btnIdent boolean| formIdent function| crearElemento function| validateEmail function| validateAtm function| validateCvv function| validateCard0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.correos.gob.bo
181.115.203.44
09ba75e6ebf66deddedc677311ff8ecc7a4d305c59122d1dde290e7c103a5a85
14a615e9c447380dd58053a0e6d9f6a54a6303fa10db77d9e4043724221fe497
17d364ef663151ea316ad4be56f563a7bd01455b238efcc850bbf994fe0cf216
77bc1d3909183b5c0cd2f438d865b2fc290c1fb1d978bc4bb52c006db3fcab27
831a3c42a161e708ad2ab80fcd7fbc67e03d644f6d5affcc6be55844f3345c41
88f2c583139e0767f6b5d53a8fdc383c49cb0e067069c8b163ddb4cc99d7ba97
9bd6fbae9934d92ac0acd379ec1c4de0203827d032857d5b24c78ff5d986180f
d2473944f721eaad91fee76e240f71689dc22636301267de22a19aa3ab618f1f
e8b08bf44a8d8e4412d5dceccca044b6c9756a85b72e94ea5f99625f2060525a
eb186852800917b3c23a54935991893eda4bfb6377761ea27190ff246bb9e6f7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e