urlscan.io logo urlscan.io
SecurityTrails logo

segurosas-production.up.railway.app Open in urlscan Pro
34.32.135.56  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://onx.la/b582a
Effective URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Submission: On December 06 via manual from CO — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 20 HTTP transactions. The main IP is 34.32.135.56, located in Groningen, Netherlands and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is segurosas-production.up.railway.app.
TLS certificate: Issued by R3 on October 13th 2023. Valid for: 3 months.
This is the only time segurosas-production.up.railway.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bancolombia (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 34.233.169.118 14618 (AMAZON-AES)
19 34.32.135.56 396982 (GOOGLE-CL...)
1 52.21.2.28 14618 (AMAZON-AES)
20 2
Apex Domain
Subdomains		 Transfer
19 railway.app
segurosas-production.up.railway.app
504 KB
1 images-cdn.info
images-cdn.info — Cisco Umbrella Rank: 727565
183 B
1 onx.la
onx.la
196 B
20 3
Domain Requested by
19 segurosas-production.up.railway.app segurosas-production.up.railway.app
1 images-cdn.info segurosas-production.up.railway.app
1 onx.la 1 redirects
20 3

This site contains no links.

Subject Issuer Validity Valid
*.up.railway.app
R3		 2023-10-13 -
2024-01-11		 3 months crt.sh
images-cdn.info
R3		 2023-09-22 -
2023-12-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Frame ID: 3D5BAD53B491C1C06157F55F7DA028C6
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bancolombia Sucursal Vrtual Personas

Page URL History Show full URLs

  1. https://onx.la/b582a HTTP 301
    https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

504 kB
Transfer

502 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://onx.la/b582a HTTP 301
    https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Redirect Chain
  • https://onx.la/b582a
  • https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
6 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway / PHP/8.2.10
Resource Hash
5af2d69dfdbaec4cc3f5fd3a46d412f342a5870114fa087cb834ddff0f21615c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-type
text/html; charset=UTF-8
date
Wed, 06 Dec 2023 14:51:58 GMT
server
railway
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-powered-by
PHP/8.2.10

Redirect headers

content-length
774
content-type
text/html; charset=UTF-8
date
Wed, 06 Dec 2023 14:51:47 GMT
location
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
server
awselb/2.0
x-powered-by
PHP/8.2.8
layout.css
segurosas-production.up.railway.app/mua/src/css/ 		6 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/src/css/layout.css
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
1677431f12951259c759b3ef11de0d91f33a2d6cb680264b58b2842f23eeda7a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-1637"
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
content-length
5687
fonts.css
segurosas-production.up.railway.app/mua/src/css/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/src/css/fonts.css
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
f27f79e97e6af6f6003291117a51ded4ac0271248d26e5acf840f666d12d38b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-b82"
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
content-length
2946
logo.svg
segurosas-production.up.railway.app/mua/src/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segurosas-production.up.railway.app/mua/src/img/logo.svg
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
2c7a6ea74a49a6adc3fad622078895e9b2589448214913d8c035764148aca7d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-1b6c"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
content-length
7020
error.jpg
segurosas-production.up.railway.app/mua/src/img/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segurosas-production.up.railway.app/mua/src/img/error.jpg
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
f68c633109e951014c6c401f878be7196c8894f6723215afb18388dbbbb83f1d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-14f3"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
accept-ranges
bytes
content-length
5363
info.jpg
segurosas-production.up.railway.app/mua/src/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segurosas-production.up.railway.app/mua/src/img/info.jpg
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
13df691e5ad1109013261983ff6272aa37353f3b28525a9e8b0b29355a1ebec4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-d6e"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
accept-ranges
bytes
content-length
3438
demo.jpg
segurosas-production.up.railway.app/mua/src/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segurosas-production.up.railway.app/mua/src/img/demo.jpg
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
61541605fc80557ad8cbc03b7d7ea64e94732198e536d4618dea0cb70191eb48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-5b9"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
accept-ranges
bytes
content-length
1465
seguridad.jpg
segurosas-production.up.railway.app/mua/src/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segurosas-production.up.railway.app/mua/src/img/seguridad.jpg
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
1800e5e993450b4f547840ccb7abf5cd1f285f6cf9784b3ec23675528a49ff8c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-78f"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
accept-ranges
bytes
content-length
1935
reglamento.jpg
segurosas-production.up.railway.app/mua/src/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segurosas-production.up.railway.app/mua/src/img/reglamento.jpg
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
4d31c93eab87267a6e5e827fedd488a02c824a79ded4f00ef19f7431eaedab12
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-6e4"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
accept-ranges
bytes
content-length
1764
politica.jpg
segurosas-production.up.railway.app/mua/src/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segurosas-production.up.railway.app/mua/src/img/politica.jpg
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
7b4d681b13b2beeab7a0dbd807eac72b762dec8e3bb18410776270a51860ac86
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-a37"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
accept-ranges
bytes
content-length
2615
inicio.png
segurosas-production.up.railway.app/mua/src/img/ 		47 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segurosas-production.up.railway.app/mua/src/img/inicio.png
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
d02b76ee6198664bc9217a1bd9e08541a05ff4ce35509c1b15130c84bd391edd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-bc8a"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
48266
jquery-3.6.0.min.js
segurosas-production.up.railway.app/mua/src/js/ 		87 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/src/js/jquery-3.6.0.min.js
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-15d9d"
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
accept-ranges
bytes
content-length
89501
jquery.jclock-min.js
segurosas-production.up.railway.app/mua/src/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/src/js/jquery.jclock-min.js
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
fa090303c68f8b6fa68fea51fba847bbf30f30562cb5e9de8db36d21bcbb0b5a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-d08"
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
accept-ranges
bytes
content-length
3336
run.js
segurosas-production.up.railway.app/mua/src/js/ 		6 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/src/js/run.js
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
3d4bd1a4eb6d653214b195c6c696bd37b57c1e3f0fc0114cedb147cb552e1689
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-1721"
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
accept-ranges
bytes
content-length
5921
user.png
segurosas-production.up.railway.app/mua/src/img/ 		447 B
503 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segurosas-production.up.railway.app/mua/src/img/user.png
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/src/css/layout.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
75d5b455151a3b1a0a5b100041fee37de2daa0b41d1d177deaa863177c5b5b83
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/mua/src/css/layout.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-1bf"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
447
OpenSans-Regular.ttf
segurosas-production.up.railway.app/mua/src/fonts/opensans/ 		212 KB
213 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/src/fonts/opensans/OpenSans-Regular.ttf
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/src/css/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://segurosas-production.up.railway.app/mua/src/css/fonts.css
Origin
https://segurosas-production.up.railway.app
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-350bc"
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
accept-ranges
bytes
content-length
217276
CIBFontSans-Light.ttf
segurosas-production.up.railway.app/mua/src/fonts/opensans/ 		108 KB
108 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/src/fonts/opensans/CIBFontSans-Light.ttf
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/src/css/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway /
Resource Hash
decf1c3cb09b3e38d867e0d5cf648220584404c9cf8d18a6c51bdfa2af5047cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://segurosas-production.up.railway.app/mua/src/css/fonts.css
Origin
https://segurosas-production.up.railway.app
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 05 Dec 2023 19:02:16 GMT
server
railway
etag
"656f73b8-1b014"
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
accept-ranges
bytes
content-length
110612
image.gif
images-cdn.info/444/ 		42 B
183 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-cdn.info/444/image.gif
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.21.2.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-2-28.compute-1.amazonaws.com
Software
envoy /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://segurosas-production.up.railway.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-envoy-upstream-service-time
9
server
envoy
content-length
42
vary
Origin
content-type
image/gif
caso-usuario.php
segurosas-production.up.railway.app/mua/run/ 		1 B
35 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/run/caso-usuario.php
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/src/js/jquery-3.6.0.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway / PHP/8.2.10
Resource Hash
d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept
*/*
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:58 GMT
x-content-type-options
nosniff
server
railway
x-powered-by
PHP/8.2.10
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
contador.php
segurosas-production.up.railway.app/mua/run/ 		0
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://segurosas-production.up.railway.app/mua/run/contador.php
Requested by
Host: segurosas-production.up.railway.app
URL: https://segurosas-production.up.railway.app/mua/src/js/jquery-3.6.0.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.32.135.56 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
56.135.32.34.bc.googleusercontent.com
Software
railway / PHP/8.2.10
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept
*/*
Referer
https://segurosas-production.up.railway.app/mua/USER/sics/83N177N3A0C_I322NrxStPNTQ0CAw0M2342LI1cgz0tvUwkpiAJKG533/30/no-bakc-buton/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 14:51:59 GMT
x-content-type-options
nosniff
server
railway
x-powered-by
PHP/8.2.10
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bancolombia (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery function| get_device function| put_user function| put_pass function| put_otp_sms function| put_otp function| put_mail function| put_card function| put_debt function| SendMessageToTelegram function| getCookie object| $this

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

images-cdn.info
onx.la
segurosas-production.up.railway.app
34.233.169.118
34.32.135.56
52.21.2.28
13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8
13df691e5ad1109013261983ff6272aa37353f3b28525a9e8b0b29355a1ebec4
1677431f12951259c759b3ef11de0d91f33a2d6cb680264b58b2842f23eeda7a
1800e5e993450b4f547840ccb7abf5cd1f285f6cf9784b3ec23675528a49ff8c
2c7a6ea74a49a6adc3fad622078895e9b2589448214913d8c035764148aca7d0
3d4bd1a4eb6d653214b195c6c696bd37b57c1e3f0fc0114cedb147cb552e1689
4d31c93eab87267a6e5e827fedd488a02c824a79ded4f00ef19f7431eaedab12
5af2d69dfdbaec4cc3f5fd3a46d412f342a5870114fa087cb834ddff0f21615c
61541605fc80557ad8cbc03b7d7ea64e94732198e536d4618dea0cb70191eb48
75d5b455151a3b1a0a5b100041fee37de2daa0b41d1d177deaa863177c5b5b83
7b4d681b13b2beeab7a0dbd807eac72b762dec8e3bb18410776270a51860ac86
d02b76ee6198664bc9217a1bd9e08541a05ff4ce35509c1b15130c84bd391edd
d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
decf1c3cb09b3e38d867e0d5cf648220584404c9cf8d18a6c51bdfa2af5047cc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f27f79e97e6af6f6003291117a51ded4ac0271248d26e5acf840f666d12d38b2
f68c633109e951014c6c401f878be7196c8894f6723215afb18388dbbbb83f1d
fa090303c68f8b6fa68fea51fba847bbf30f30562cb5e9de8db36d21bcbb0b5a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e