campusvirtual.foremsur.com Open in urlscan Pro
37.153.88.110 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://campusvirtual.foremsur.com/ban3/index2.php
Effective URL:
https://campusvirtual.foremsur.com/ban3/index.php
Submission: On June 27 via manual (June 27th 2023, 5:51:08 pm UTC) from GT — Scanned from ES

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 37.153.88.110, located in Spain and belongs to UNELINK, ES. The main domain is campusvirtual.foremsur.com.
TLS certificate: Issued by R3 on June 20th 2023. Valid for: 3 months.

This is the only time campusvirtual.foremsur.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banreservas (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 12	37.153.88.110 37.153.88.110		60494 (UNELINK) (UNELINK)
11	1

12 37.153.88.110 (Spain) 1 redirects

ASN60494 (UNELINK, ES)
PTR: s11.dred.es

campusvirtual.foremsur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	foremsur.com 1 redirects campusvirtual.foremsur.com	297 KB
11	1

	Domain	Requested by
12	campusvirtual.foremsur.com	1 redirects campusvirtual.foremsur.com
11	1

This site contains no links.

Subject Issuer	Validity	Valid
campusvirtual.foremsur.com R3	`2023-06-20` - `2023-09-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://campusvirtual.foremsur.com/ban3/index.php
Frame ID: 79EA30A4BAB579F9C029B0A404DDFF93
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

index

Page URL History Show full URLs

https://campusvirtual.foremsur.com/ban3/index2.php HTTP 302
https://campusvirtual.foremsur.com/ban3/index.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

296 kB
Transfer

294 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://campusvirtual.foremsur.com/ban3/index2.php HTTP 302
https://campusvirtual.foremsur.com/ban3/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response campusvirtual.foremsur.com/ban3/ Redirect Chain https://campusvirtual.foremsur.com/ban3/index2.php https://campusvirtual.foremsur.com/ban3/index.php	10 KB 10 KB	77ms 76ms	Document text/html	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Full URL https://campusvirtual.foremsur.com/ban3/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `3d8e357f645bf035a4177174fc65a4193e3e381c1bcaebf1a1f4bad191447051` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language es-ES,es;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 27 Jun 2023 17:51:04 GMT Keep-Alive timeout=5, max=99 Server Apache Transfer-Encoding chunked Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Tue, 27 Jun 2023 17:51:04 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache location index.php
GET H/1.1	200 OK	estilo.css campusvirtual.foremsur.com/ban3/archivero/	143 KB 143 KB	46ms 45ms	Stylesheet text/css	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Full URL https://campusvirtual.foremsur.com/ban3/archivero/estilo.css Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `3343ffa408cfd418b8be6951fca77309ff602f37855e93629ce831db5bc8ab24` Request headers accept-language es-ES,es;q=0.9 Referer https://campusvirtual.foremsur.com/ban3/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Last-Modified Wed, 10 May 2023 13:28:34 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 146499
GET H/1.1	200 OK	opciones.png campusvirtual.foremsur.com/ban3/archivero/	4 KB 4 KB	135ms 52ms	Image image/png	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Show image Full URL https://campusvirtual.foremsur.com/ban3/archivero/opciones.png Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `f068cfdbd467327e75a52909f2ad8d2649d0849209621a2d7fe496866e196a58` Request headers accept-language es-ES,es;q=0.9 Referer https://campusvirtual.foremsur.com/ban3/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Last-Modified Wed, 10 May 2023 13:13:06 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3845
GET H/1.1	200 OK	logo.png campusvirtual.foremsur.com/ban3/archivero/	14 KB 14 KB	131ms 48ms	Image image/png	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Show image Full URL https://campusvirtual.foremsur.com/ban3/archivero/logo.png Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `b57ab0866f889d8aad9959f6fdf867c1672de5e89d7dd37c8bcfb15124707730` Request headers accept-language es-ES,es;q=0.9 Referer https://campusvirtual.foremsur.com/ban3/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Last-Modified Wed, 10 May 2023 12:55:36 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 14370
GET H/1.1	200 OK	linkis.png campusvirtual.foremsur.com/ban3/archivero/	4 KB 4 KB	133ms 47ms	Image image/png	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Show image Full URL https://campusvirtual.foremsur.com/ban3/archivero/linkis.png Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `e6b9f409b1d031da6f3d23f3500323df5836b7ed24573b1e28cd205c4473dd2a` Request headers accept-language es-ES,es;q=0.9 Referer https://campusvirtual.foremsur.com/ban3/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Last-Modified Wed, 10 May 2023 13:17:46 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3904
GET H/1.1	200 OK	teclado_virtual_chico_ac.gif campusvirtual.foremsur.com/ban3/archivero/	439 B 681 B	134ms 48ms	Image image/gif	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Show image Full URL https://campusvirtual.foremsur.com/ban3/archivero/teclado_virtual_chico_ac.gif Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `dd2a63cd72110e84ba59d6b102179f1aac916692ab52f6cbb4c44a217d6264f6` Request headers accept-language es-ES,es;q=0.9 Referer https://campusvirtual.foremsur.com/ban3/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Last-Modified Wed, 10 May 2023 12:55:36 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 439
GET H/1.1	200 OK	sello_superintendencia.png campusvirtual.foremsur.com/ban3/archivero/	11 KB 11 KB	183ms 46ms	Image image/png	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Show image Full URL https://campusvirtual.foremsur.com/ban3/archivero/sello_superintendencia.png Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `a936d90c691883cba76f192043ea982a2e5b31bbe723bff7240d1faa0abbe01c` Request headers accept-language es-ES,es;q=0.9 Referer https://campusvirtual.foremsur.com/ban3/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Last-Modified Wed, 10 May 2023 12:55:36 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 11471
GET H/1.1	200 OK	fondo.jpg campusvirtual.foremsur.com/ban3/archivero/	35 KB 35 KB	46ms 46ms	Image image/jpeg	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Show image Full URL https://campusvirtual.foremsur.com/ban3/archivero/fondo.jpg Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/archivero/estilo.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `4db0b654f3d83e85b669c60ae37ad734cde96c66c75397034f755512f945e508` Request headers accept-language es-ES,es;q=0.9 Referer https://campusvirtual.foremsur.com/ban3/archivero/estilo.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Last-Modified Wed, 10 May 2023 13:28:24 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 35941
GET H/1.1	200 OK	requerido.png campusvirtual.foremsur.com/ban3/archivero/	159 B 400 B	44ms 44ms	Image image/png	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Show image Full URL https://campusvirtual.foremsur.com/ban3/archivero/requerido.png Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/archivero/estilo.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `dbe6f66cc201d8295c331aafe6429e46ec26640feb4b95c6d0ff142992e13a89` Request headers accept-language es-ES,es;q=0.9 Referer https://campusvirtual.foremsur.com/ban3/archivero/estilo.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Last-Modified Wed, 10 May 2023 13:25:26 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 159
GET H/1.1	404 Not Found	OpenSans.woff campusvirtual.foremsur.com/ban3/Fonts/	0 0	43ms 43ms	Font text/html	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Full URL https://campusvirtual.foremsur.com/ban3/Fonts/OpenSans.woff Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/archivero/estilo.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash Request headers Referer https://campusvirtual.foremsur.com/ban3/archivero/estilo.css Origin https://campusvirtual.foremsur.com accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	personas.jpg campusvirtual.foremsur.com/ban3/archivero/	73 KB 73 KB	43ms 43ms	Image image/jpeg	37.153.88.110 UNELINK
General Check archive.org Show headers Download Go to Show image Full URL https://campusvirtual.foremsur.com/ban3/archivero/personas.jpg Requested by Host: campusvirtual.foremsur.com URL: https://campusvirtual.foremsur.com/ban3/archivero/estilo.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 37.153.88.110 , Spain, ASN60494 (UNELINK, ES), Reverse DNS s11.dred.es Software Apache / Resource Hash `5c7ffd97d5d655fa6fb8a33baab29b2fa5945b5df29491bd9c890c20125cf792` Request headers accept-language es-ES,es;q=0.9 Referer https://campusvirtual.foremsur.com/ban3/archivero/estilo.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 27 Jun 2023 17:51:04 GMT Last-Modified Wed, 10 May 2023 13:43:34 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 74656

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banreservas (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			campusvirtual.foremsur.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 47d1c9b4fd042b466bd22200d6c1e7a9

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://campusvirtual.foremsur.com/ban3/Fonts/OpenSans.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

campusvirtual.foremsur.com
37.153.88.110
3343ffa408cfd418b8be6951fca77309ff602f37855e93629ce831db5bc8ab24
3d8e357f645bf035a4177174fc65a4193e3e381c1bcaebf1a1f4bad191447051
4db0b654f3d83e85b669c60ae37ad734cde96c66c75397034f755512f945e508
5c7ffd97d5d655fa6fb8a33baab29b2fa5945b5df29491bd9c890c20125cf792
a936d90c691883cba76f192043ea982a2e5b31bbe723bff7240d1faa0abbe01c
b57ab0866f889d8aad9959f6fdf867c1672de5e89d7dd37c8bcfb15124707730
dbe6f66cc201d8295c331aafe6429e46ec26640feb4b95c6d0ff142992e13a89
dd2a63cd72110e84ba59d6b102179f1aac916692ab52f6cbb4c44a217d6264f6
e6b9f409b1d031da6f3d23f3500323df5836b7ed24573b1e28cd205c4473dd2a
f068cfdbd467327e75a52909f2ad8d2649d0849209621a2d7fe496866e196a58

campusvirtual.foremsur.com Open in urlscan Pro 37.153.88.110 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

296 kBTransfer

294 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

campusvirtual.foremsur.com Open in urlscan Pro
37.153.88.110 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

296 kB
Transfer

294 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!