sosconsulta.co
Open in
urlscan Pro
190.60.234.17
Malicious Activity!
Public Scan
Submitted URL: https://sosconsulta.co/huntg
Effective URL: https://sosconsulta.co/huntg/huntg/login.php?cmd=login_submit&id=c81324bf60bee10d52dacd6d8b03c177c81324bf60bee10d52dacd...
Submission: On February 12 via api from JP — Scanned from JP
Effective URL: https://sosconsulta.co/huntg/huntg/login.php?cmd=login_submit&id=c81324bf60bee10d52dacd6d8b03c177c81324bf60bee10d52dacd...
Submission: On February 12 via api from JP — Scanned from JP
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 15 HTTP transactions.
The main IP is 190.60.234.17, located in
Bogotá, Colombia and
belongs to IFX18747, US.
The main domain is sosconsulta.co.
TLS certificate: Issued by R3 on December 22nd 2021. Valid for: 3 months.
This is the only time sosconsulta.co was scanned on urlscan.io!
TLS certificate: Issued by R3 on December 22nd 2021. Valid for: 3 months.
This is the only time sosconsulta.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Huntington Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 16 | 190.60.234.17 190.60.234.17 | 18747 (IFX18747) (IFX18747) | |
| 2 | 23.15.14.59 23.15.14.59 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 15 | 3 |
16
190.60.234.17
(Bogotá, Colombia)
ASN18747 (IFX18747, US)
PTR: 17.234.60.190.host.ifxnetworks.com
ASN18747 (IFX18747, US)
PTR: 17.234.60.190.host.ifxnetworks.com
| sosconsulta.co |
2
23.15.14.59
(Tokyo, Japan)
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-15-14-59.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-15-14-59.deploy.static.akamaitechnologies.com
| www.huntington.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 16 |
sosconsulta.co
3 redirects
sosconsulta.co |
990 KB |
| 2 |
huntington.com
www.huntington.com — Cisco Umbrella Rank: 50672 |
3 KB |
| 15 | 2 |
| Domain | Requested by | |
|---|---|---|
| 16 | sosconsulta.co |
3 redirects
sosconsulta.co
|
| 2 | www.huntington.com |
sosconsulta.co
|
| 15 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.huntington.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| emailg.ml R3 |
2021-12-22 - 2022-03-22 |
3 months | crt.sh |
| huntington.com GeoTrust EV RSA CA 2018 |
2020-07-08 - 2022-07-13 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://sosconsulta.co/huntg/huntg/login.php?cmd=login_submit&id=c81324bf60bee10d52dacd6d8b03c177c81324bf60bee10d52dacd6d8b03c177&session=c81324bf60bee10d52dacd6d8b03c177c81324bf60bee10d52dacd6d8b03c177
Frame ID: D757DB4013CF0477FC4A9FCFA099DFAB
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Mobile Banking Login LoginChat with a bankerClose FlagSearchVisit Huntington's Facebook pageVisit Huntington's Twitter feedVisit Huntington's Instagram pageVisit Huntington's YouTube pageVisit Huntington's LinkedIn pageFAB_AskUsPage URL History Show full URLs
-
https://sosconsulta.co/huntg
HTTP 301
https://sosconsulta.co/huntg/ HTTP 302
https://sosconsulta.co/huntg/huntg/index.php?cmd=login_submit&id=841a5220c06578e802dcb089df9f9c4a84... HTTP 302
https://sosconsulta.co/huntg/huntg/login.php?cmd=login_submit&id=c81324bf60bee10d52dacd6d8b03c177c8... Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://www.huntington.com/
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://sosconsulta.co/huntg
HTTP 301
https://sosconsulta.co/huntg/ HTTP 302
https://sosconsulta.co/huntg/huntg/index.php?cmd=login_submit&id=841a5220c06578e802dcb089df9f9c4a841a5220c06578e802dcb089df9f9c4a&session=841a5220c06578e802dcb089df9f9c4a841a5220c06578e802dcb089df9f9c4a HTTP 302
https://sosconsulta.co/huntg/huntg/login.php?cmd=login_submit&id=c81324bf60bee10d52dacd6d8b03c177c81324bf60bee10d52dacd6d8b03c177&session=c81324bf60bee10d52dacd6d8b03c177c81324bf60bee10d52dacd6d8b03c177 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
login.php
sosconsulta.co/huntg/huntg/ Redirect Chain
|
133 KB 27 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
toolkit.css
sosconsulta.co/huntg/huntg/css/ |
336 KB 336 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.4.1.min.js
sosconsulta.co/huntg/huntg/js/ |
86 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
toolkit.min.js
sosconsulta.co/huntg/huntg/js/ |
418 KB 418 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
site-survey.css
sosconsulta.co/huntg/huntg/css/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lockup.svg
sosconsulta.co/huntg/huntg/images/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lockup.svg
www.huntington.com/-/media/hcom/global/logo/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
oo_icon_retina_black.gif
www.huntington.com/Presentation/onlineopinionV5/ |
552 B 997 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
EHL_Black_HouseOnly.svg
sosconsulta.co/huntg/huntg/images/ |
707 B 953 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
muli-v11-latin-700.woff2
sosconsulta.co/huntg/huntg/fonts/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
HuntingtonApexWeb-Medium.woff2
sosconsulta.co/huntg/huntg/fonts/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
muli-v11-latin-300.woff2
sosconsulta.co/huntg/huntg/fonts/ |
16 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
muli-v11-latin-600.woff2
sosconsulta.co/huntg/huntg/fonts/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
HuntingtonApexWeb-Bold.woff2
sosconsulta.co/huntg/huntg/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
HuntingtonApexWeb-Bold.woff
sosconsulta.co/huntg/huntg/fonts/ |
41 KB 42 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Huntington Bank (Banking)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone function| $ function| jQuery object| webpackJsonp object| regeneratorRuntime object| ParsleyExtend object| ParsleyConfig object| psly object| Parsley object| ParsleyUtils object| ParsleyValidator object| ParsleyUI string| inputEventPatched function| objectFitPolyfill3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| sosconsulta.co/ | Name: PHPSESSID Value: 347ce664b536deb95932dfde771f51d0 |
|
| sosconsulta.co/ | Name: loginCookie Value: personalLogin |
|
| sosconsulta.co/ | Name: geolocation Value: null |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
sosconsulta.co
www.huntington.com
190.60.234.17
23.15.14.59
04de03ec90e95f24e347dc8ff91e6354eb0a73288e1431003e9e10de59e12d1d
078f1a721e608fa56e99a3fe3065eb68ce187c5b812c18b7341516ead57caf3b
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
15f5836e52324d46e89eed325a5de5158f0d9bb29d59e1ffc381d961a1f6980d
2709fb1438f80fea093f7dd654993df5b6e3ddca432941c720fd695b0a05441e
31658d5c53adebe945591610f97bfe734f51a1dcaa5c65163a3e78dc8ad36bee
34f3c7445d22c1509aeecc5d020b6d24c9e2f63b3c0514cebbc3813798965273
38c973e72b29d0c5f054034abecb6f92d1f30fac5aeeb5d0300de1cce156ade3
4808c0ca2576dc18bf8df509199edef7a4a2b809fde09ecc6688f998e855486e
62e5b1bb4bc6496956b943374fca10b7fee4af4dc15450b7772469f38b2e06b9
9ce0c7443f6975ac01655f26813947926a374c68f28289dd198fc6299203beed
b7fdacba9d9ba82947b81f97f975c0ce993ef8bccc3c01b5780f799bc15f0d8a
ce2256fea3b65d2843165029106af8b8593facfb956ef62afb5c939999d82650
d09bb7e3de3760ca1d9375090796e4f1cf180f43c6457a874ed22c3b0a0b07ea
f43ea36b900ae7aa4ec07956e9b1223ab00dac1f766d97580b1e2bfe721cdc24