munipitipo.gob.pe Open in urlscan Pro
23.82.11.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://munipitipo.gob.pe/up/home-secure-login.html
Submission Tags: @phish_report
Submission: On December 13 via api (December 13th 2023, 1:42:06 pm UTC) from FI — Scanned from FI

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 23.82.11.106, located in Manassas, United States and belongs to LEASEWEB-USA-WDC, US. The main domain is munipitipo.gob.pe.
TLS certificate: Issued by R3 on December 12th 2023. Valid for: 3 months.

This is the only time munipitipo.gob.pe was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banrural (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	23.82.11.106 23.82.11.106	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
1	34.241.172.116 34.241.172.116	16509 (AMAZON-02) (AMAZON-02)
10	2

9 23.82.11.106 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
PTR: sipan.sorcierhosting.com

munipitipo.gob.pe	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.241.172.116 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-241-172-116.eu-west-1.compute.amazonaws.com

wurfl.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	munipitipo.gob.pe munipitipo.gob.pe	69 KB
1	wurfl.io wurfl.io — Cisco Umbrella Rank: 26217	2 KB
10	2

	Domain	Requested by
9	munipitipo.gob.pe	munipitipo.gob.pe
1	wurfl.io	munipitipo.gob.pe
10	2

This site contains no links.

Subject Issuer	Validity	Valid
munipitipo.gob.pe R3	`2023-12-12` - `2024-03-11`	3 months	crt.sh
wurfl.io Amazon RSA 2048 M02	`2023-05-11` - `2024-06-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://munipitipo.gob.pe/up/home-secure-login.html
Frame ID: D274EEED90FA57E77729016540D3ED2C
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Formulario de Inicio de Sesión

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

71 kB
Transfer

70 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request home-secure-login.html Show response munipitipo.gob.pe/up/	2 KB 2 KB	868ms 157ms	Document text/html	23.82.11.106 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://munipitipo.gob.pe/up/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.82.11.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS sipan.sorcierhosting.com Software Apache / Resource Hash `ffea263b11809896893d90c75b1cf92bd7e41f61ca4c307d1b0f439b7ec96a44` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 2081 Content-Type text/html Date Wed, 13 Dec 2023 13:42:00 GMT Keep-Alive timeout=2, max=100 Last-Modified Fri, 01 Sep 2023 01:09:14 GMT Server Apache
GET H/1.1	200 OK	styles.css munipitipo.gob.pe/up/css/	2 KB 2 KB	158ms 157ms	Stylesheet text/css	23.82.11.106 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://munipitipo.gob.pe/up/css/styles.css Requested by Host: munipitipo.gob.pe URL: https://munipitipo.gob.pe/up/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.82.11.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS sipan.sorcierhosting.com Software Apache / Resource Hash `4dc720e2b2342883f95c6682db391e0f0a549c08f655dcd8e4220851451ab1d3` Request headers accept-language fi-FI,fi;q=0.9 Referer https://munipitipo.gob.pe/up/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers Date Wed, 13 Dec 2023 13:42:00 GMT Last-Modified Thu, 31 Aug 2023 15:29:40 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=99 Content-Length 2086
GET H/1.1	200 OK	logo2.png munipitipo.gob.pe/up/img/	3 KB 3 KB	316ms 158ms	Image image/png	23.82.11.106 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Show image Full URL https://munipitipo.gob.pe/up/img/logo2.png Requested by Host: munipitipo.gob.pe URL: https://munipitipo.gob.pe/up/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.82.11.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS sipan.sorcierhosting.com Software Apache / Resource Hash `a6fe470e9b113281c6a7288dd3fe1798e02044344844162226c530efc3696bdd` Request headers accept-language fi-FI,fi;q=0.9 Referer https://munipitipo.gob.pe/up/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers Date Wed, 13 Dec 2023 13:42:00 GMT Last-Modified Thu, 31 Aug 2023 12:49:54 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=98 Content-Length 2743
GET H/1.1	200 OK	person-fill.svg munipitipo.gob.pe/up/img/	225 B 471 B	459ms 161ms	Image image/svg+xml	23.82.11.106 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Show image Full URL https://munipitipo.gob.pe/up/img/person-fill.svg Requested by Host: munipitipo.gob.pe URL: https://munipitipo.gob.pe/up/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.82.11.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS sipan.sorcierhosting.com Software Apache / Resource Hash `04a8fcd1f1b1d6f7c15c43acde3f3b02f7f051fa23d9405c50e796fc71261047` Request headers accept-language fi-FI,fi;q=0.9 Referer https://munipitipo.gob.pe/up/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers Date Wed, 13 Dec 2023 13:42:01 GMT Last-Modified Thu, 31 Aug 2023 14:34:02 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 225
GET H/1.1	200 OK	lock-fill.svg munipitipo.gob.pe/up/img/	273 B 519 B	462ms 160ms	Image image/svg+xml	23.82.11.106 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Show image Full URL https://munipitipo.gob.pe/up/img/lock-fill.svg Requested by Host: munipitipo.gob.pe URL: https://munipitipo.gob.pe/up/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.82.11.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS sipan.sorcierhosting.com Software Apache / Resource Hash `0f10dddf944201c60f75e896f8504e241b9c2764bcddc3f5041c981fb321e858` Request headers accept-language fi-FI,fi;q=0.9 Referer https://munipitipo.gob.pe/up/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers Date Wed, 13 Dec 2023 13:42:01 GMT Last-Modified Thu, 31 Aug 2023 14:34:46 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 273
GET H/1.1	200 OK	main.js Show response munipitipo.gob.pe/up/js/	121 B 376 B	460ms 158ms	Script application/javascript	23.82.11.106 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://munipitipo.gob.pe/up/js/main.js Requested by Host: munipitipo.gob.pe URL: https://munipitipo.gob.pe/up/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.82.11.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS sipan.sorcierhosting.com Software Apache / Resource Hash `5854a731a3f549a904619a5b9fbf25cfb849bb1d000c93663cf59015dc70a020` Request headers accept-language fi-FI,fi;q=0.9 Referer https://munipitipo.gob.pe/up/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers Date Wed, 13 Dec 2023 13:42:01 GMT Last-Modified Tue, 05 Sep 2023 14:49:08 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 121
GET H/1.1	200 OK	wurfl.js Show response wurfl.io/	4 KB 2 KB	391ms 96ms	Script application/javascript	34.241.172.116 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://wurfl.io/wurfl.js Requested by Host: munipitipo.gob.pe URL: https://munipitipo.gob.pe/up/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.241.172.116 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-241-172-116.eu-west-1.compute.amazonaws.com Software / Resource Hash `d83dca202a4e9e03f699c025878763187e6fe4c79553bab5022474c03b65b5be` Request headers accept-language fi-FI,fi;q=0.9 Referer https://munipitipo.gob.pe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers Date Wed, 13 Dec 2023 13:42:01 GMT Content-Encoding br Accept-Ch Sec-Ch-Ua, Sec-Ch-Ua-Arch, Sec-Ch-Ua-Bitness, Sec-Ch-Ua-Full-Version, Sec-Ch-Ua-Full-Version-List, Sec-Ch-Ua-Mobile, Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version Cross-Origin-Opener-Policy cross-origin Cross-Origin-Embedder-Policy cross-origin Vary accept-encoding, user-agent, sec-ch-ua, sec-ch-ua-arch, sec-ch-ua-bitness, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-mobile, sec-ch-ua-model, sec-ch-ua-platform, sec-ch-ua-platform-version Content-Type application/javascript Cache-Control no-cache Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Length 1443
GET H/1.1	200 OK	form1.js Show response munipitipo.gob.pe/up/js/	14 KB 14 KB	461ms 158ms	Script application/javascript	23.82.11.106 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://munipitipo.gob.pe/up/js/form1.js Requested by Host: munipitipo.gob.pe URL: https://munipitipo.gob.pe/up/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.82.11.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS sipan.sorcierhosting.com Software Apache / Resource Hash `34e38504852233b2bf7824e3b694ede4758516c9624c3ae61b4091dffa24e3b3` Request headers accept-language fi-FI,fi;q=0.9 Referer https://munipitipo.gob.pe/up/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers Date Wed, 13 Dec 2023 13:42:01 GMT Last-Modified Tue, 05 Sep 2023 11:54:50 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 13981
GET H/1.1	200 OK	script.js Show response munipitipo.gob.pe/up/js/	16 KB 16 KB	315ms 156ms	Script application/javascript	23.82.11.106 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://munipitipo.gob.pe/up/js/script.js Requested by Host: munipitipo.gob.pe URL: https://munipitipo.gob.pe/up/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.82.11.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS sipan.sorcierhosting.com Software Apache / Resource Hash `e6e3db44f67f68e91b6541f0afcc0a7ddd34842378101ac88b8411ffb1586edc` Request headers accept-language fi-FI,fi;q=0.9 Referer https://munipitipo.gob.pe/up/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers Date Wed, 13 Dec 2023 13:42:01 GMT Last-Modified Tue, 05 Sep 2023 13:18:16 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=97 Content-Length 15883
GET H/1.1	200 OK	background.jpeg munipitipo.gob.pe/up/img/	30 KB 30 KB	297ms 161ms	Image image/jpeg	23.82.11.106 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Show image Full URL https://munipitipo.gob.pe/up/img/background.jpeg Requested by Host: munipitipo.gob.pe URL: https://munipitipo.gob.pe/up/css/styles.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.82.11.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS sipan.sorcierhosting.com Software Apache / Resource Hash `9298d9a0f05a61fb25d323f61415bc311a032343cda64619792c8f2be3729c32` Request headers accept-language fi-FI,fi;q=0.9 Referer https://munipitipo.gob.pe/up/css/styles.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Response headers Date Wed, 13 Dec 2023 13:42:01 GMT Last-Modified Thu, 31 Aug 2023 14:42:40 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 30840

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banrural (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

munipitipo.gob.pe
wurfl.io
23.82.11.106
34.241.172.116
04a8fcd1f1b1d6f7c15c43acde3f3b02f7f051fa23d9405c50e796fc71261047
0f10dddf944201c60f75e896f8504e241b9c2764bcddc3f5041c981fb321e858
34e38504852233b2bf7824e3b694ede4758516c9624c3ae61b4091dffa24e3b3
4dc720e2b2342883f95c6682db391e0f0a549c08f655dcd8e4220851451ab1d3
5854a731a3f549a904619a5b9fbf25cfb849bb1d000c93663cf59015dc70a020
9298d9a0f05a61fb25d323f61415bc311a032343cda64619792c8f2be3729c32
a6fe470e9b113281c6a7288dd3fe1798e02044344844162226c530efc3696bdd
d83dca202a4e9e03f699c025878763187e6fe4c79553bab5022474c03b65b5be
e6e3db44f67f68e91b6541f0afcc0a7ddd34842378101ac88b8411ffb1586edc
ffea263b11809896893d90c75b1cf92bd7e41f61ca4c307d1b0f439b7ec96a44

munipitipo.gob.pe Open in urlscan Pro 23.82.11.106 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

71 kBTransfer

70 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

Indicators

munipitipo.gob.pe Open in urlscan Pro
23.82.11.106 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

71 kB
Transfer

70 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!