activacionbancol.gucho2225.repl.co
34.149.204.188
Malicious Activity!
URL:
https://activacionbancol.gucho2225.repl.co/
Submission: On August 10 via api from US — Scanned from DE
Submission: On August 10 via api from US — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 12 HTTP transactions.
The main IP is 34.149.204.188, located in
Kansas City, United States and
belongs to GOOGLE, US.
The main domain is activacionbancol.gucho2225.repl.co.
TLS certificate: Issued by R3 on August 9th 2022. Valid for: 3 months.
This is the only time activacionbancol.gucho2225.repl.co was scanned on urlscan.io!
TLS certificate: Issued by R3 on August 9th 2022. Valid for: 3 months.
This is the only time activacionbancol.gucho2225.repl.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bancolombia (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 34.149.204.188 34.149.204.188 | 15169 (GOOGLE) (GOOGLE) | |
| 12 | 1 |
12
34.149.204.188
(Kansas City, United States)
ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com
ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com
| activacionbancol.gucho2225.repl.co |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
repl.co
activacionbancol.gucho2225.repl.co |
687 KB |
| 12 | 1 |
| Domain | Requested by | |
|---|---|---|
| 12 | activacionbancol.gucho2225.repl.co |
activacionbancol.gucho2225.repl.co
|
| 12 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.grupobancolombia.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| gucho2225.repl.co R3 |
2022-08-09 - 2022-11-07 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://activacionbancol.gucho2225.repl.co/
Frame ID: 8039C05CC842D527081BD7BDF168808C
Requests: 10 HTTP requests in this frame
Frame:
https://activacionbancol.gucho2225.repl.co/zona.html
Frame ID: 058E122EE4463872AD1CD534D21CC5AA
Requests: 2 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Page Statistics
12
Requests
100
%
HTTPS
0
%
IPv6
1
Domains
1
Subdomains
1
IPs
1
Countries
687
kB
Transfer
685
kB
Size
0
Cookies
4 Outgoing links
These are links going to different origins than the main page.
URL: http://www.grupobancolombia.com/home/micrositios/demoSVP/index.html
Title: Demo Sucursal Virtual Personas
Title: Demo Sucursal Virtual Personas
Search URL Search Domain Scan URL
URL: https://www.grupobancolombia.com/wps/portal/personas/aprender-es-facil/seguridad/internet
Title: Aprende sobre Seguridad
Title: Aprende sobre Seguridad
Search URL Search Domain Scan URL
URL: https://www.grupobancolombia.com/wcm/connect/www.grupobancolombia.com15880/cdd7ef14-0302-4906-8913-9313b98e060e/REGLAMENTO+BANCA+POR+INTERNET+a+partir+salida+OTP+06+junio.pdf?MOD=AJPERES&CVID=m82iJ3m
Title: Reglamento Sucursal Virtual
Title: Reglamento Sucursal Virtual
Search URL Search Domain Scan URL
URL: https://www.grupobancolombia.com/wps/portal/personas/documentos-legales/proteccion-datos/bancolombia-sa/
Title: Politica de Privacidad
Title: Politica de Privacidad
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
activacionbancol.gucho2225.repl.co/ |
11 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
styles.css
activacionbancol.gucho2225.repl.co/css/ |
105 KB 105 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.css
activacionbancol.gucho2225.repl.co/css/ |
118 KB 119 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-ui.css
activacionbancol.gucho2225.repl.co/css/ |
31 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ui.css
activacionbancol.gucho2225.repl.co/css/ |
13 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
zona.html
activacionbancol.gucho2225.repl.co/ Frame 058E |
168 B 197 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
imgPublicidad.png
activacionbancol.gucho2225.repl.co/img/ Frame 058E |
47 KB 47 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.svg
activacionbancol.gucho2225.repl.co/images/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
OpenSans-Regular.ttf
activacionbancol.gucho2225.repl.co/fonts/opensans/ |
212 KB 213 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
CIBFontSans-Light.ttf
activacionbancol.gucho2225.repl.co/fonts/opensans/ |
108 KB 108 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon-user.png
activacionbancol.gucho2225.repl.co/images/icons/ |
559 B 559 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon_font_bc.ttf
activacionbancol.gucho2225.repl.co/fonts/iconfont/ |
31 KB 31 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bancolombia (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
activacionbancol.gucho2225.repl.co
34.149.204.188
0265a31c7bea01a32328e09245aad8cf38ba3316a13e93080697b35e338f35b4
09bc8587e8fcc474002263a62784146152f2b1040e6915e335953601a91e6e96
0c386d6f8f8b764f56c0bf1fbb5a41f34c40c6a9451a450a1dfc9e70782f4b3f
13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8
2c7a6ea74a49a6adc3fad622078895e9b2589448214913d8c035764148aca7d0
5e7aacc05a5cfe4d2fa8407d5a885b9c2511e0213fb5abd0599cdef3f0e0e524
6476bf30185e058f938969760b89e216833e1b3927be79ec520c1fc33931868a
7f5e8805214883a207e604cafb951fd1cf84fdcd1ed736de4b1edc786fe986fd
ad0f43b7fd52d2f1574ba930c85ce401f95d69e21ad997ffe8e7ad98fec2ffda
c9eeb55f7cf16683b871600ce998b61b1031629097be96069d5741f33adaf6d1
d02b76ee6198664bc9217a1bd9e08541a05ff4ce35509c1b15130c84bd391edd
decf1c3cb09b3e38d867e0d5cf648220584404c9cf8d18a6c51bdfa2af5047cc