www.correos.gob.bo
Open in
urlscan Pro
181.115.203.44
Malicious Activity!
Public Scan
URL:
https://www.correos.gob.bo/system/Bancolombia/EMAIL.php-VyFrqOi1asWqzwR7vrqICrNWqT5Zj3RUzzfmBs.php
Submission: On September 04 via api from TW
Submission: On September 04 via api from TW
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 16 HTTP transactions.
The main IP is 181.115.203.44, located in
Bolivia, Plurinational State Of and
belongs to Entel S.A. - EntelNet, BO.
The main domain is www.correos.gob.bo.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on November 8th 2019. Valid for: a year.
This is the only time www.correos.gob.bo was scanned on urlscan.io!
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on November 8th 2019. Valid for: a year.
This is the only time www.correos.gob.bo was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bancolombia (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 181.115.203.44 181.115.203.44 | 6568 (Entel S.A.) (Entel S.A. - EntelNet) | |
| 16 | 2 |
13
181.115.203.44
(Bolivia, Plurinational State Of)
ASN6568 (Entel S.A. - EntelNet, BO)
ASN6568 (Entel S.A. - EntelNet, BO)
| www.correos.gob.bo |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
correos.gob.bo
www.correos.gob.bo |
219 KB |
| 0 |
bootstrapcdn.com
Failed
maxcdn.bootstrapcdn.com Failed |
|
| 16 | 2 |
| Domain | Requested by | |
|---|---|---|
| 13 | www.correos.gob.bo |
www.correos.gob.bo
|
| 0 | maxcdn.bootstrapcdn.com Failed |
www.correos.gob.bo
|
| 16 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.correos.gob.bo Go Daddy Secure Certificate Authority - G2 |
2019-11-08 - 2020-11-08 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.correos.gob.bo/system/Bancolombia/EMAIL.php-VyFrqOi1asWqzwR7vrqICrNWqT5Zj3RUzzfmBs.php
Frame ID: DE3318AC7253D2594F3E0DD15EF04009
Requests: 13 HTTP requests in this frame
Frame:
https://www.correos.gob.bo/system/Bancolombia/bien_ve_background.html
Frame ID: EA2C9AFAD81484BFA27AFC052BB6DF62
Requests: 3 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
EMAIL.php-VyFrqOi1asWqzwR7vrqICrNWqT5Zj3RUzzfmBs.php
www.correos.gob.bo/system/Bancolombia/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
www.correos.gob.bo/system/Bancolombia/maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
119 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
font-awesome.min.css
www.correos.gob.bo/system/Bancolombia/maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ |
31 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
www.correos.gob.bo/system/Bancolombia/ |
93 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cargando.gif
www.correos.gob.bo/system/Bancolombia/ |
7 KB 7 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
281769.svg
www.correos.gob.bo/system/Bancolombia/images/ |
1 KB 943 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
143648.svg
www.correos.gob.bo/system/Bancolombia/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
732223.svg
www.correos.gob.bo/system/Bancolombia/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tcc_l.combined.1.0.6.min.js
www.correos.gob.bo/img1.wsimg.com/tcc/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
fontawesome-webfont.woff
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
fontawesome-webfont.ttf
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bien_ve_background.html
www.correos.gob.bo/system/Bancolombia/ Frame EA2C |
1 KB 919 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tcc_l.combined.1.0.6.min.js
www.correos.gob.bo/img1.wsimg.com/tcc/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tcc_l.combined.1.0.6.min.js
www.correos.gob.bo/img1.wsimg.com/tcc/ Frame EA2C |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
background_personas.png
www.correos.gob.bo/system/Bancolombia/ Frame EA2C |
133 KB 134 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- maxcdn.bootstrapcdn.com
- URL
- http://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
- Domain
- maxcdn.bootstrapcdn.com
- URL
- http://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff?v=4.7.0
- Domain
- maxcdn.bootstrapcdn.com
- URL
- http://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.ttf?v=4.7.0
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bancolombia (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| $ function| jQuery function| resizeBox object| jQuery172012529475150156322 object| _trfd0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
maxcdn.bootstrapcdn.com
www.correos.gob.bo
maxcdn.bootstrapcdn.com
181.115.203.44
0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8
10efe4965cc735b0d033d5619de0567092fe8302cd6ef205f84fd0c6fceee510
318ffc8f0dbd8a5bd6d41e84b79e2ddefe410b887637daf3ac0994fa4bd34131
79d25a0675d143d5f554edbfdc30552abc9f4bc14b3cf0ceafa8a9d90c200b4d
817c144a7de95c03dd00337f2e6c0011e9afa24044999d4c52615ee90a6765a8
91d8950286fb012fcf78acb530e907d5bd2260187a749f05224e4870fdd627a4
96b781dc1002a753ddff78a23bc776f4db3c7f4f433a9df39ba516f40b3f72c7
a3d5d08e4c778fc48b9d523f1f32a648d37a49653374a74b4da8c6382de2f434
bc1de5a940bb24dc1737eed87e5fff04e6a25b4acde09dec04ee4f67155b7e65
f39df6f3bd16003f0ee7a5a984eb0b02ca3499bc34107949e7edf44a64e82add