urlscan.io logo urlscan.io
SecurityTrails logo

minsaude.gov.cv Open in urlscan Pro
213.150.196.37  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://minsaude.gov.cv/wp-images/dhl_top/source/content/login.php?email=LydiaNguyen@LFSourcing.com
Submission: On January 24 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 213.150.196.37, located in Cabo Verde and belongs to NOSi, CV. The main domain is minsaude.gov.cv.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 3rd 2021. Valid for: 3 months.
This is the only time minsaude.gov.cv was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
2 213.150.196.37 327862 (NOSi)
2 1
Apex Domain
Subdomains		 Transfer
2 gov.cv
minsaude.gov.cv
14 KB
2 1
Domain Requested by
2 minsaude.gov.cv minsaude.gov.cv
2 1

This site contains no links.

Subject Issuer Validity Valid
minsaude.gov.cv
cPanel, Inc. Certification Authority		 2021-01-03 -
2021-04-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://minsaude.gov.cv/wp-images/dhl_top/source/content/login.php?email=LydiaNguyen@LFSourcing.com
Frame ID: FDE9FA82D8FCD45EBB398F4B68326584
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

14 kB
Transfer

14 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
minsaude.gov.cv/wp-images/dhl_top/source/content/ 		10 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://minsaude.gov.cv/wp-images/dhl_top/source/content/login.php?email=LydiaNguyen@LFSourcing.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.150.196.37 , Cabo Verde, ASN327862 (NOSi, CV),
Reverse DNS
bvc.frameworks.gov.cv
Software
Apache /
Resource Hash
c03a565bc2719082ae9c38df8a37329e963c3a2e1b75883d3a90ad9b5e72bcc1

Request headers

:method
GET
:authority
minsaude.gov.cv
:scheme
https
:path
/wp-images/dhl_top/source/content/login.php?email=LydiaNguyen@LFSourcing.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 24 Jan 2021 13:25:40 GMT
server
Apache
content-type
text/html; charset=UTF-8
logo.jpg
minsaude.gov.cv/wp-images/dhl_top/source/content/photos/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://minsaude.gov.cv/wp-images/dhl_top/source/content/photos/logo.jpg
Requested by
Host: minsaude.gov.cv
URL: https://minsaude.gov.cv/wp-images/dhl_top/source/content/login.php?email=LydiaNguyen@LFSourcing.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.150.196.37 , Cabo Verde, ASN327862 (NOSi, CV),
Reverse DNS
bvc.frameworks.gov.cv
Software
Apache /
Resource Hash
26933abb67839e269d8fc9d49b5ff722a1f48646776a8bdfb25e572d10996b41

Request headers

Referer
https://minsaude.gov.cv/wp-images/dhl_top/source/content/login.php?email=LydiaNguyen@LFSourcing.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 24 Jan 2021 13:25:40 GMT
last-modified
Fri, 17 Jan 2020 01:21:40 GMT
server
Apache
accept-ranges
bytes
content-length
3902
content-type
image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

minsaude.gov.cv
213.150.196.37
26933abb67839e269d8fc9d49b5ff722a1f48646776a8bdfb25e572d10996b41
c03a565bc2719082ae9c38df8a37329e963c3a2e1b75883d3a90ad9b5e72bcc1