urlscan.io logo urlscan.io
SecurityTrails logo

lapazmendoza.gob.ar Open in urlscan Pro
200.58.110.143  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://lapazmendoza.gob.ar/ch/index/htdocs/login.html
Submission: On September 29 via api from US — Scanned from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 200.58.110.143, located in Rosario, Argentina and belongs to Dattatec.com, AR. The main domain is lapazmendoza.gob.ar.
TLS certificate: Issued by R3 on August 2nd 2023. Valid for: 3 months.
This is the only time lapazmendoza.gob.ar was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PostFinance (Banking)

Domain & IP information

IP Address AS Autonomous System
1 200.58.110.143 27823 (Dattatec.com)
1 2
Apex Domain
Subdomains		 Transfer
1 lapazmendoza.gob.ar
lapazmendoza.gob.ar
548 KB
1 1
Domain Requested by
1 lapazmendoza.gob.ar
1 1

This site contains no links.

Subject Issuer Validity Valid
*.lapazmendoza.gob.ar
R3		 2023-08-02 -
2023-10-31		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://lapazmendoza.gob.ar/ch/index/htdocs/login.html
Frame ID: C0E7C2B7E2A576BE11D1B8E7E26DBA5A
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

PostFinance - E-finance

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

639 kB
Transfer

1004 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.html
lapazmendoza.gob.ar/ch/index/htdocs/ 		787 KB
548 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://lapazmendoza.gob.ar/ch/index/htdocs/login.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
200.58.110.143 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS
c184.dattaweb.com
Software
Apache /
Resource Hash
817ea1c2cd7963e2389a94ad113800120408076422407c01de1247fc4c451ad3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
de-CH,de;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-type
text/html
date
Fri, 29 Sep 2023 19:22:01 GMT
etag
"c4a85-6064087a9f500-gzip"
last-modified
Tue, 26 Sep 2023 10:28:04 GMT
referrer-policy
no-referrer-when-downgrade
server
Apache
vary
Accept-Encoding
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6e2341a524af81d8b9362e829287bede024d49eb00f2983f39ef3e8675614ac6

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/png
truncated
/ 		53 KB
53 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
56357c655153f3e1fa0b40233b0aaadedaa0293479322c33f8bf2de499278c7d

Request headers

Referer
Origin
https://lapazmendoza.gob.ar
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
application/font-woff2;charset=utf-8
truncated
/ 		119 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f7ab85d108404ce04f57561886170bb64f90ca6ffc0de468508483c52d99171c

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/png
truncated
/ 		942 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
02eb02cdb556defb1b4e160fff6868045f5d2f83fb7da6f8bb6b9b8dda23bb58

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/png
truncated
/ 		38 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
98b2729855b2bb5f1ba5a1873ee019b01fde1e56500d2d83677556f0df3f346b

Request headers

Referer
Origin
https://lapazmendoza.gob.ar
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
application/font-woff2;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PostFinance (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies