inducolvi.com
Open in
urlscan Pro
200.69.107.96
Malicious Activity!
Public Scan
URL:
http://inducolvi.com/citis/citifreshnew/citibank/confirm.php?https://online.citi.com/US/login.do?sessionsid424kjasd21...
Submission: On September 11 via automatic, source openphish
Submission: On September 11 via automatic, source openphish
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 200.69.107.96, located in
Colombia and
belongs to ETB - Colombia, CO.
The main domain is inducolvi.com.
This is the only time inducolvi.com was scanned on urlscan.io!
This is the only time inducolvi.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citibank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 200.69.107.96 200.69.107.96 | 19429 (ETB) (ETB - Colombia) | |
| 7 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
inducolvi.com
inducolvi.com |
48 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | inducolvi.com |
inducolvi.com
|
| 7 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://inducolvi.com/citis/citifreshnew/citibank/confirm.php?https://online.citi.com/US/login.do?sessionsid424kjasd21i16873asdafe32
Frame ID: 9E49B3A952DF8458C14BABE370C1D59D
Requests: 7 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
CentOS
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /CentOS/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
confirm.php
inducolvi.com/citis/citifreshnew/citibank/ |
9 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
citiheader.png
inducolvi.com/citis/citifreshnew/citibank/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
confirmmm.png
inducolvi.com/citis/citifreshnew/citibank/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bn1.png
inducolvi.com/citis/citifreshnew/citibank/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bn2.png
inducolvi.com/citis/citifreshnew/citibank/images/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer2.png
inducolvi.com/citis/citifreshnew/citibank/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
verifyyy.png
inducolvi.com/citis/citifreshnew/citibank/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citibank (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| unhideBody number| b string| errmsg string| punct number| min number| max function| formbreeze_email function| formbreeze_filledin function| formbreeze_number function| formbreeze_numseq function| emailCheck function| formbreeze_sub0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
inducolvi.com
200.69.107.96
041b420457b487bb50dabbbec1a41f3d1b0a5776b3b80d5ff93721e3c3385069
052e1a0090477855ab9091a39991688da0847defd1f5762f69da5a4feeb6a5db
29dfaa6bbd92b9612cc8f39b3d519c96fe49ee48fb38da24f0639122163ff05c
4b3069075c952bf8d4b7a42218c30b707e9ffd6587a8d12a97998b9bf521eeba
6e65523dd21ae66094e5c8426f479b91476c471feacb3bc04321b52de6296cd6
a982abe232af61079d842d2d626f733a2b5ffb888d1bc109136faa3da6ef459b
bd0a4d1b7cac90d133eaa57b431798bc9e13e54903c4c55d6641aaf2d8d4f3be