cesba.com.ar Open in urlscan Pro
66.128.53.196 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cesba.com.ar/https/34.237.113.1131395/sucursalpersonas.transaccionesbancolombia.com/mua/index.html
Effective URL:
https://cesba.com.ar/cgi-sys/suspendedpage.cgi
Submission: On February 23 via automatic, source phishtank (February 23rd 2020, 6:16:25 am UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 11 HTTP transactions. The main IP is 66.128.53.196, located in United States and belongs to GLOBAL-IP-NETWORKS, US. The main domain is cesba.com.ar.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 28th 2019. Valid for: 3 months.

This is the only time cesba.com.ar was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 3	66.128.53.196 66.128.53.196		7819 (GLOBAL-IP...) (GLOBAL-IP-NETWORKS)
11	2

3 66.128.53.196 (United States) 1 redirects

ASN7819 (GLOBAL-IP-NETWORKS, US)
PTR: server1.koiron.com

cesba.com.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kozub.com.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	cesba.com.ar 1 redirects cesba.com.ar	4 KB
1	kozub.com.ar kozub.com.ar	76 KB
0	googleapis.com Failed fonts.googleapis.com Failed
11	3

	Domain	Requested by
2	cesba.com.ar	1 redirects
1	kozub.com.ar	cesba.com.ar
0	fonts.googleapis.com Failed	cesba.com.ar
11	3

This site contains no links.

Subject Issuer	Validity	Valid
cesba.com.ar cPanel, Inc. Certification Authority	`2019-12-28` - `2020-03-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cesba.com.ar/cgi-sys/suspendedpage.cgi
Frame ID: 5AE1FE6B90B12AE80D052DA417A5AFD6
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://cesba.com.ar/https/34.237.113.1131395/sucursalpersonas.transaccionesbancolombia.com/mua/i... HTTP 302
https://cesba.com.ar/cgi-sys/suspendedpage.cgi Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

9 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

80 kB
Transfer

79 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cesba.com.ar/https/34.237.113.1131395/sucursalpersonas.transaccionesbancolombia.com/mua/index.html HTTP 302
https://cesba.com.ar/cgi-sys/suspendedpage.cgi Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request suspendedpage.cgi Show response cesba.com.ar/cgi-sys/ Redirect Chain https://cesba.com.ar/https/34.237.113.1131395/sucursalpersonas.transaccionesbancolombia.com/mua/index.html https://cesba.com.ar/cgi-sys/suspendedpage.cgi	3 KB 4 KB	158ms 158ms	Document text/html	66.128.53.196 GLOBAL-IP-NETWORKS
General Check archive.org Show headers Download Go to Full URL https://cesba.com.ar/cgi-sys/suspendedpage.cgi Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 66.128.53.196 , United States, ASN7819 (GLOBAL-IP-NETWORKS, US), Reverse DNS server1.koiron.com Software Apache / Resource Hash `ac20b5cdd945a4055614ac1317a453830e7b1301436b9fcdf061f21f57e8045a` Request headers Host cesba.com.ar Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest document Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest document Response headers Date Sun, 23 Feb 2020 06:16:13 GMT Server Apache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html Redirect headers Date Sun, 23 Feb 2020 06:16:12 GMT Server Apache Location https://cesba.com.ar/cgi-sys/suspendedpage.cgi Content-Length 293 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	guardian.gif kozub.com.ar/404/assets/img/	76 KB 76 KB	417ms 262ms	Image image/gif	66.128.53.196 GLOBAL-IP-NETWORKS
General Check archive.org Show headers Download Go to Show image Full URL http://kozub.com.ar/404/assets/img/guardian.gif Requested by Host: cesba.com.ar URL: https://cesba.com.ar/cgi-sys/suspendedpage.cgi Protocol HTTP/1.1 Server 66.128.53.196 , United States, ASN7819 (GLOBAL-IP-NETWORKS, US), Reverse DNS server1.koiron.com Software Apache / Resource Hash `b959321f67d9544fff58f5dd7db05047527c737c26cb284c7a1bc933aa1d76cd` Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Response headers Date Sun, 23 Feb 2020 06:16:13 GMT Last-Modified Mon, 02 Nov 2015 19:42:38 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 77444
GET		bootstrap.min.css kozub.com.ar/404/assets/bootstrap/css/	0 0

GET		style.css kozub.com.ar/404/assets/css/	0 0

GET		respons.css kozub.com.ar/404/assets/css/	0 0

GET		css fonts.googleapis.com/	0 0

GET		jquery-2.1.1.min.js kozub.com.ar/404/assets/js/	0 0

GET		bootstrap.min.js kozub.com.ar/404/assets/bootstrap/js/	0 0

GET		modernizr.custom.js kozub.com.ar/404/assets/js/	0 0

GET		jquery.nicescroll.min.js kozub.com.ar/404/assets/js/	0 0

GET		scripts.js kozub.com.ar/404/assets/js/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: kozub.com.ar
URL: http://kozub.com.ar/404/assets/bootstrap/css/bootstrap.min.css

Domain: kozub.com.ar
URL: http://kozub.com.ar/404/assets/css/style.css

Domain: kozub.com.ar
URL: http://kozub.com.ar/404/assets/css/respons.css

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Raleway

Domain: kozub.com.ar
URL: http://kozub.com.ar/404/assets/js/jquery-2.1.1.min.js

Domain: kozub.com.ar
URL: http://kozub.com.ar/404/assets/bootstrap/js/bootstrap.min.js

Domain: kozub.com.ar
URL: http://kozub.com.ar/404/assets/js/modernizr.custom.js

Domain: kozub.com.ar
URL: http://kozub.com.ar/404/assets/js/jquery.nicescroll.min.js

Domain: kozub.com.ar
URL: http://kozub.com.ar/404/assets/js/scripts.js

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cesba.com.ar
fonts.googleapis.com
kozub.com.ar
fonts.googleapis.com
kozub.com.ar
66.128.53.196
ac20b5cdd945a4055614ac1317a453830e7b1301436b9fcdf061f21f57e8045a
b959321f67d9544fff58f5dd7db05047527c737c26cb284c7a1bc933aa1d76cd