literatura.edu.bo - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 62.171.169.185, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is literatura.edu.bo.
TLS certificate: Issued by R3 on December 3rd 2022. Valid for: 3 months.

This is the only time literatura.edu.bo was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AOL (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	62.171.169.185 62.171.169.185	51167 (CONTABO) (CONTABO)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1288:80:... 2a00:1288:80:807::1	203220 (YAHOO-DEB) (YAHOO-DEB)
6	3

4 62.171.169.185 (Nuremberg, Germany)

ASN51167 (CONTABO, DE)
PTR: vmi1011371.contaboserver.net

literatura.edu.bo	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	literatura.edu.bo literatura.edu.bo	502 KB
1	yimg.com s.yimg.com — Cisco Umbrella Rank: 484	646 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 206	28 KB
6	3

	Domain	Requested by
4	literatura.edu.bo	literatura.edu.bo
1	s.yimg.com	literatura.edu.bo
1	cdnjs.cloudflare.com	literatura.edu.bo
6	3

This site contains no links.

Subject Issuer	Validity	Valid
*.literatura.edu.bo R3	`2022-12-03` - `2023-03-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-11-28` - `2023-01-18`	2 months	crt.sh

This page contains 1 frames:

Primary Page: https://literatura.edu.bo/A/aol/mail/challenge.php?email=
Frame ID: 3D7A0EFB4ADC3262171FD8891C75DC7F
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

AOL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

1175 kB
Transfer

1445 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request challenge.php Show response
literatura.edu.bo/A/aol/mail/ 5 KB
5 KB 327ms
19ms Document
text/html 62.171.169.185
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://literatura.edu.bo/A/aol/mail/challenge.php?email=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.171.169.185 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi1011371.contaboserver.net
Software: Apache /
Resource Hash: 0d221f98608e3f2375993a07088bd42b159ec8728fcb0aa9266e70460acce57a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 09 Dec 2022 01:21:58 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200
OK aol-main.css
literatura.edu.bo/A/aol/libraries/css/ 476 KB
476 KB 14ms
13ms Stylesheet
text/css 62.171.169.185
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://literatura.edu.bo/A/aol/libraries/css/aol-main.css
Requested by: Host: literatura.edu.bo
URL: https://literatura.edu.bo/A/aol/mail/challenge.php?email=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.171.169.185 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi1011371.contaboserver.net
Software: Apache /
Resource Hash: e2cc3e072062ab1f74c2f27f27141d584bd27c3208cf35df0430c06b98624328

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://literatura.edu.bo/A/aol/mail/challenge.php?email=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Fri, 09 Dec 2022 01:21:58 GMT
Last-Modified: Wed, 17 Nov 2021 13:00:22 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 487238

GET
H/1.1 200
OK aol-logo-black-v.0.0.2.png
literatura.edu.bo/A/aol/libraries/img/ 16 KB
16 KB 43ms
17ms Image
image/png 62.171.169.185
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://literatura.edu.bo/A/aol/libraries/img/aol-logo-black-v.0.0.2.png
Requested by: Host: literatura.edu.bo
URL: https://literatura.edu.bo/A/aol/mail/challenge.php?email=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.171.169.185 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi1011371.contaboserver.net
Software: Apache /
Resource Hash: f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://literatura.edu.bo/A/aol/mail/challenge.php?email=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Fri, 09 Dec 2022 01:21:58 GMT
Last-Modified: Wed, 17 Nov 2021 13:00:24 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 16340

GET
H/1.1 200
OK aol-logo-white-v0.0.4.png
literatura.edu.bo/A/aol/libraries/img/ 4 KB
4 KB 40ms
14ms Image
image/png 62.171.169.185
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://literatura.edu.bo/A/aol/libraries/img/aol-logo-white-v0.0.4.png
Requested by: Host: literatura.edu.bo
URL: https://literatura.edu.bo/A/aol/mail/challenge.php?email=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.171.169.185 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi1011371.contaboserver.net
Software: Apache /
Resource Hash: d0ecaea4f4b91a678f16b572dbe3c9dc7212d1437a97a31f84ae74c167d5a4db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://literatura.edu.bo/A/aol/mail/challenge.php?email=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Fri, 09 Dec 2022 01:21:58 GMT
Last-Modified: Wed, 17 Nov 2021 13:00:24 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4314

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ 85 KB
28 KB 29ms
12ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: literatura.edu.bo
URL: https://literatura.edu.bo/A/aol/mail/challenge.php?email=

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://literatura.edu.bo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 09 Dec 2022 01:21:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 11428426
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27433
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-1538f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KTrCtkj%2BZQ6wM%2BmfBVdV5QZytzHRiKUmPApBe0nEmJmiogydMvPyGFkVJO0zookLAb7XOSrQReg7SzMD2WdD2MvqirQGnM%2BP7TWIJSM7ut2%2FLytzmpaNR0LDwZMUDKc1MrYUTre5Y4bD5pXx6zqUxZdz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7769ed538ffc9a15-FRA
expires: Wed, 29 Nov 2023 01:21:58 GMT

GET
H2 200 hide-v0.0.1.svg
s.yimg.com/wm/mbr/images/ 860 KB
646 KB 30ms
9ms Image
image/svg+xml 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/wm/mbr/images/hide-v0.0.1.svg

Requested by

Host: literatura.edu.bo
URL: https://literatura.edu.bo/A/aol/libraries/css/aol-main.css

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

119acd68e288f17e86722a67e341ec74f7f6a377ec8e15b3914245f57caf6fbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://literatura.edu.bo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 15:59:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=15552000
x-amz-request-id: MD47QNWT1DG20YK6
age: 120139
x-amz-server-side-encryption: AES256
x-amz-id-2: aQaVe7dxy6qgboulreBrAWrvOBhc6h9D2BMxWf9J3Fo6GdwN61MJ+et/QA27vNVqT58VgwLPhhE=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 16 Jul 2019 23:13:44 GMT
server: ATS
etag: "6bd15a1456d985027ba5ca91528e4b1e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: image/svg+xml
cache-control: public,max-age=315360000
accept-ranges: bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AOL (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			literatura.edu.bo/	1969-12-31 23:59:59	Name: PHPSESSID Value: b37dc81577340474226083334f89f7c7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
literatura.edu.bo
s.yimg.com
2606:4700::6811:190e
2a00:1288:80:807::1
62.171.169.185
0d221f98608e3f2375993a07088bd42b159ec8728fcb0aa9266e70460acce57a
119acd68e288f17e86722a67e341ec74f7f6a377ec8e15b3914245f57caf6fbf
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
d0ecaea4f4b91a678f16b572dbe3c9dc7212d1437a97a31f84ae74c167d5a4db
e2cc3e072062ab1f74c2f27f27141d584bd27c3208cf35df0430c06b98624328
f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690

literatura.edu.bo Open in urlscan Pro 62.171.169.185 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

1175 kBTransfer

1445 kBSize

1 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

literatura.edu.bo Open in urlscan Pro
62.171.169.185 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

1175 kB
Transfer

1445 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!