![](/screenshots/d3578ccd-6274-41c4-86c6-3f18efb08492.png)
fibranet.com.gt
Open in
urlscan Pro
66.225.241.54
Malicious Activity!
Public Scan
Effective URL: https://fibranet.com.gt/gtbnrurralwebbsrvcio/index.html
Submission Tags: @phish_report
Submission: On September 13 via api from FI — Scanned from PT
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 24th 2023. Valid for: 3 months.
This is the only time fibranet.com.gt was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banrural (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 213.13.28.100 213.13.28.100 | 3243 (MEO-RESID...) (MEO-RESIDENCIAL) | |
1 1 | 172.67.171.63 172.67.171.63 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 66.225.241.54 66.225.241.54 | 23352 (SERVERCEN...) (SERVERCENTRAL) | |
1 | 104.16.88.20 104.16.88.20 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 2 |
ASN3243 (MEO-RESIDENCIAL, PT)
PTR: dyndns-lis01.ns.sapo.pt
14au.ap.xsl.pt |
ASN23352 (SERVERCENTRAL, US)
PTR: priva26.privatednsorg.com
fibranet.com.gt |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
fibranet.com.gt
fibranet.com.gt |
570 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 364 |
11 KB |
1 |
citly.me
1 redirects
citly.me — Cisco Umbrella Rank: 933019 |
523 B |
1 |
xsl.pt
1 redirects
14au.ap.xsl.pt |
231 B |
9 | 4 |
Domain | Requested by | |
---|---|---|
8 | fibranet.com.gt |
fibranet.com.gt
|
1 | cdn.jsdelivr.net |
fibranet.com.gt
|
1 | citly.me | 1 redirects |
1 | 14au.ap.xsl.pt | 1 redirects |
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
fibranet.com.gt cPanel, Inc. Certification Authority |
2023-08-24 - 2023-11-22 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://fibranet.com.gt/gtbnrurralwebbsrvcio/index.html
Frame ID: 6074EEA4EDF29AD60A853B16FB0CFF52
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/d3578ccd-6274-41c4-86c6-3f18efb08492.png)
Page Title
Ban RuralPage URL History Show full URLs
-
http://14au.ap.xsl.pt/
HTTP 302
https://citly.me/9LyYA HTTP 307
https://fibranet.com.gt/gtbnrurralwebbsrvcio/index.html Page URL
Detected technologies
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://14au.ap.xsl.pt/
HTTP 302
https://citly.me/9LyYA HTTP 307
https://fibranet.com.gt/gtbnrurralwebbsrvcio/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
fibranet.com.gt/gtbnrurralwebbsrvcio/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logoizquierda.png
fibranet.com.gt/gtbnrurralwebbsrvcio/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
derecha.png
fibranet.com.gt/gtbnrurralwebbsrvcio/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo1.png
fibranet.com.gt/gtbnrurralwebbsrvcio/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
usuario.jpg
fibranet.com.gt/gtbnrurralwebbsrvcio/ |
9 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
boton.JPG
fibranet.com.gt/gtbnrurralwebbsrvcio/ |
17 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
campos.jpg
fibranet.com.gt/gtbnrurralwebbsrvcio/ |
43 KB 43 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdn.jsdelivr.net/npm/axios@1.1.2/dist/ |
26 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg-login-1.jpg
fibranet.com.gt/gtbnrurralwebbsrvcio/ |
470 KB 471 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banrural (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| axios0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
14au.ap.xsl.pt
cdn.jsdelivr.net
citly.me
fibranet.com.gt
104.16.88.20
172.67.171.63
213.13.28.100
66.225.241.54
0763760f370e096602956e45b03af9581c5946adf6b022e703c0f548972e21c6
1a717b0f7fa42f60869fca0eee8a720542cf657f8fc3459208d96f7400378805
2b4012d9b3a69a58f63311ee5b8cad2ad054cb677f595e6781f43f42592c4688
356e39b83843058e39836d3242a43f3ecc233e4741df501e7562fae07615d510
9e42b2dae3df4833052b4b5a38ee2444176ee58052cdbfa582ecdebf2ff84735
a6fe470e9b113281c6a7288dd3fe1798e02044344844162226c530efc3696bdd
d49169c29e5fb4fee4848ad548905594d99d94870a0babe56a1513165169aae6
e536b255406eb828518117bffb980d7c009128cc6b7240736c280b0e1ec00f8d
ffb6e270a7bbb1ea1b797965ae85e35760b38b98744478a4151ddee79a31d215