www.unicauca.edu.co
Open in
urlscan Pro
2801:12:7000:3f3::114
Malicious Activity!
Public Scan
Effective URL: http://www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/login.php?action=Login&account=Tfj31FdwjtbYNA...
Submission: On March 23 via manual from GB
Summary
This is the only time www.unicauca.edu.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tesco Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 84.1.251.131 84.1.251.131 | 5483 (MAGYAR-TE...) (MAGYAR-TELEKOM-MAIN-AS Magyar Telekom Nyrt.) | |
1 18 | 2801:12:7000:... 2801:12:7000:3f3::114 | 27650 (EMTEL S.A...) (EMTEL S.A. E.S.P.) | |
22 | 3 |
ASN5483 (MAGYAR-TELEKOM-MAIN-AS Magyar Telekom Nyrt., HU)
PTR: www.quasit.net
descoperamehedinti.ro |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
unicauca.edu.co
1 redirects
www.unicauca.edu.co |
395 KB |
1 |
descoperamehedinti.ro
descoperamehedinti.ro |
378 B |
0 |
tescobank.com
Failed
www.tescobank.com Failed |
|
22 | 3 |
Domain | Requested by | |
---|---|---|
18 | www.unicauca.edu.co |
1 redirects
www.unicauca.edu.co
|
1 | descoperamehedinti.ro | |
0 | www.tescobank.com Failed |
www.unicauca.edu.co
|
22 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.tescobank.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/login.php?action=Login&account=Tfj31FdwjtbYNAzCnOPZBuiof
Frame ID: 1B49BB523DC3F9950EAACD656449BE67
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://descoperamehedinti.ro/oi/ Page URL
- http://www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/login.php?action=Login&ac... Page URL
Detected technologies
Debian (Operating Systems) ExpandDetected patterns
- headers server /Debian/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: Cookie Policy
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: Online Banking system requirements
Search URL Search Domain Scan URL
Title: Forgotten your username?
Search URL Search Domain Scan URL
Title: Remember my username help
Search URL Search Domain Scan URL
Title: Online banking help
Search URL Search Domain Scan URL
Title: How to protect yourself online
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://descoperamehedinti.ro/oi/ Page URL
- http://www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/login.php?action=Login&account=Tfj31FdwjtbYNAzCnOPZBuiof Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/ HTTP 302
- http://www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
descoperamehedinti.ro/oi/ |
117 B 378 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/ Redirect Chain
|
0 477 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.php
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/ |
15 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
enc.js
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.min.css
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/css/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-head.js
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/js/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Bootstrap.js
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/js/ |
0 480 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
smart-app-banner.css
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.min.js
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/js/ |
102 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
smart-app-banner.js
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/js/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
security-24.png
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/img/ |
474 B 876 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nbl-bank@1600px.jpg
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/img/ |
116 KB 117 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
roboto-light.woff
www.tescobank.com/assets/website/fonts/Roboto-Light/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tooltip-24.png
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/img/ |
901 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
432 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
roboto-medium.woff
www.tescobank.com/assets/website/fonts/Roboto-Medium/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
tescorg.woff
www.tescobank.com/assets/website/fonts/Tesco/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
tescobd.woff
www.tescobank.com/assets/website/fonts/Tesco/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
close.png
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/img/ |
474 B 876 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tescobd.ttf
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/fonts/ |
59 KB 59 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tescorg.ttf
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/fonts/ |
63 KB 63 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
roboto-light.ttf
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/fonts/ |
45 KB 45 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
roboto-medium.ttf
www.unicauca.edu.co/educoloquio/sites/default/files/webform/tescn/auth/assets/fonts/ |
44 KB 45 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.tescobank.com
- URL
- https://www.tescobank.com/assets/website/fonts/Roboto-Light/roboto-light.woff
- Domain
- www.tescobank.com
- URL
- https://www.tescobank.com/assets/website/fonts/Roboto-Medium/roboto-medium.woff
- Domain
- www.tescobank.com
- URL
- https://www.tescobank.com/assets/website/fonts/Tesco/tescorg.woff
- Domain
- www.tescobank.com
- URL
- https://www.tescobank.com/assets/website/fonts/Tesco/tescobd.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tesco Bank (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| Aes object| Base64 object| Utf8 string| hea2p string| hea2t string| output string| ctrTxt object| Modernizr function| $ function| jQuery object| TB0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
descoperamehedinti.ro
www.tescobank.com
www.unicauca.edu.co
www.tescobank.com
2801:12:7000:3f3::114
84.1.251.131
011c72e74cc32b11395027a60ea6a34c358d20d1e5d75fa159545fc23a0c52fc
28b1d9d43fbead8dcb852206e2b14f626acbbbf01ac6f70179ead078a9da0e8d
35525a12210a46058efd243a57744bd0ebd8cef8cda203918d0bf3f496a7668a
42690b60d8bfa99abf8bd783c5d767757f7e0f6a0a760cf0543e93d9c81d2c85
5370d124bec1842ed02633c151e2cfd572948f4148d88e4bc310ef05cf085c38
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f
71a6cc8d025fe8823506933d2492a199580c877b5a979f904f47029d589a8741
7e990bbf92c2d579324b1fcb946a61d2b8c75bd4f78b6c9847ef8f2cd9ee856a
83ed5cd05fc17e0780264872fa057424c3c54cf82db56fc4b6e9c1e62c734782
9660e4aa4f01bdf2bb161e2ca2477d82777bf0274ee3a160e4b4b73120dfea6c
c58a1c578e9d6327d4713ab56c669aa77e9415d9b2e6fd7a3dfcd76cf97f7824
dec7c05be2d2818f7dfc521f1fbe4be44339cc503094e2cc96db5eff4ecfb160
e2ca599a679b75a5773b7224024f20833e89ebf13e123af40dd6badecc9868fc
e39c7de5251a92be197ed5a063d1054c8a5d7ceae99f611951c31764476c70cb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ece3fe6068014187a416e4a2298d7b11a83c2f3a8db6100a880072982ae86fbf
fa266c1e2a76ede96368a75cc4fb957b702839108d44cdbb9bf4525f33db500f
feb571712c60f84751a6fef49ccede54945beba4917b6e18201a9db0c61d41d9