Report - guacari.com.co/sc/NOVASCOT/fd654/

Report Overview

Submitted URL
guacari.com.co/sc/NOVASCOT/fd654/
IP
162.241.60.19
ASN
#19871 NETWORK-SOLUTIONS-HOSTING
Submitted
2024-05-04 13:26:10
Access
public
Website Title
Sign in | Scotiabank
Final URL
guacari.com.co/sc/NOVASCOT/fd654/
Tags
scotiabank financial phishing
urlquery detections
Phishing - Scotiabank

Detections

urlquery
12
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
guacari.com.co	unknown	2017-10-23	2019-05-03	2022-10-29	5.4 kB	104 kB	162.241.60.19
dmtags.scotiabank.com	238686	1996-04-09	2019-04-29	2023-12-01	2.6 kB	96 kB	104.66.122.200
ocsp.entrust.net	1208	1997-07-28	2014-01-10	2024-05-03	328 B	2.0 kB	23.38.202.187
somniture.scotiabank.com	112065	1996-04-09	2012-11-14	2023-12-01	614 B	719 B	63.140.62.222
ocsp.r2m03.amazontrust.com	unknown	2007-05-11	2023-02-21	2024-05-03	338 B	942 B	3.164.222.26
dlslhpkfqfglo.cloudfront.net	unknown	2008-04-25	2023-08-30	2024-04-09	2.4 kB	821 kB	143.204.42.77
csf-e58f0d0de3ce9fa5ebc118ad6482af34.memcyco.com	unknown	2021-08-01	2023-09-13	2024-01-15	556 B	3.3 kB	52.210.155.25
assets	597867	unknown	2015-06-13	2020-07-15	417 B	0 B	0.0.0.0

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-04	medium	assets	Sinkholed

ThreatFox

No alerts detected

JavaScript (12)

	URL	Size	First Seen	Last Seen
	dlslhpkfqfglo.cloudfront.net/cdn/ca/mutha-scotia-wrapper.min.js	5.1 kB	2024-05-01	2024-05-09
Pretty URL dlslhpkfqfglo.cloudfront.net/cdn/ca/mutha-scotia-wrapper.min.js IP 143.204.42.77 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-01 03:41:17 Last Seen2024-05-09 08:50:56 Times Seen167 Hash 557b54e8deceb5ce8edbf8676c5a3cf0 4ca2d0e27c87536c561f4b50ac92c8f181450a24 416d9db2d794e184d13131d8fb84940dc4727c158281734eae4120a8637e96d0 Loading...

	dlslhpkfqfglo.cloudfront.net/cdn/ca/jquery-3.6.1.min.js	2.4 MB	2024-05-01	2024-05-09
Pretty URL dlslhpkfqfglo.cloudfront.net/cdn/ca/jquery-3.6.1.min.js IP 143.204.42.77 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-01 03:41:16 Last Seen2024-05-09 08:50:56 Times Seen171 Hash bc2e301ef03e451c268cc3fb283d0113 85fc788f55abd4ce09ae2f15969ec74a67027209 e24b45cf0914dc90c1a41f163118d8baf221ae51ca9c855d7da6071f15661ed6 Loading...

	guacari.com.co/sc/NOVASCOT/fd654/	169 B	2024-05-01	2024-05-09
Pretty URL guacari.com.co/sc/NOVASCOT/fd654/ IP 162.241.60.19 ASN #19871 NETWORK-SOLUTIONS-HOSTING Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-01 03:41:16 Last Seen2024-05-09 08:50:56 Times Seen176 Hash c6688024f007698831b2e4744a7ab707 f278b1dea5459c97e08465f66d1f8406716a75be 16b62b7805d97f47aed8b3c4f8bb3c8234bed8bfbbb7e88481035630a52cfa45 Loading...

	guacari.com.co/main.cafb241d85447b367d0c.chunk.js	0 B	2023-03-07	2024-05-18
Pretty URL guacari.com.co/main.cafb241d85447b367d0c.chunk.js IP 162.241.60.19 ASN #19871 NETWORK-SOLUTIONS-HOSTING Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-18 11:59:24 Times Seen37784235 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	unknown	3.2 kB	2024-05-01	2024-05-09
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-01 03:41:16 Last Seen2024-05-09 08:50:56 Times Seen176 Hash 85d571a1d0b6748e09ced05d6bf9b146 89347e5a4fec83823f9dc2f0c6d7ea3772b05654 37c7d9a153646791579f135946bda00f7a8c0d38bc537bbcc2244d2fa613b10e Loading...

	dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/launch-edbf66c903b6.min.js	259 kB	2024-05-01	2024-05-09
Pretty URL dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/launch-edbf66c903b6.min.js IP 104.66.122.200 ASN #16625 AKAMAI-AS Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-01 03:41:17 Last Seen2024-05-09 08:50:56 Times Seen352 Hash e5954bafa35e730bc024902bc607bd1f c9e02b8d41693266321ccf5df2f195600a700487 432bdcaeac556841bbcae2c2573562ecdd13161fe8fc121fa4e5dc18ec37e707 Loading...

	dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js	35 kB	2023-09-20	2024-05-17
Pretty URL dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js IP 104.66.122.200 ASN #16625 AKAMAI-AS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-20 09:29:32 Last Seen2024-05-17 23:56:48 Times Seen1548 Hash 208eb534ea01036a4fca64e6715ccf3f 90c85649634ff5a627023668b2e10fa01cf30315 6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf Loading...

	guacari.com.co/sc/NOVASCOT/fd654/	8.0 kB	2024-05-01	2024-05-09
Pretty URL guacari.com.co/sc/NOVASCOT/fd654/ IP 162.241.60.19 ASN #19871 NETWORK-SOLUTIONS-HOSTING Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-01 03:41:17 Last Seen2024-05-09 08:50:56 Times Seen176 Hash 4b04be71901ffe5eeadf24da47a35b15 b2b4d4068246bd8d384807a57d2bd5a54eb85ef0 9eaaa8ff1906895e150fc5fbe39933a1b07b45602e242300cbbaccbdd052436f Loading...

	guacari.com.co/sc/NOVASCOT/fd654/	114 B	2024-05-01	2024-05-09
Pretty URL guacari.com.co/sc/NOVASCOT/fd654/ IP 162.241.60.19 ASN #19871 NETWORK-SOLUTIONS-HOSTING Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-01 03:41:17 Last Seen2024-05-09 08:50:56 Times Seen163 Hash fd115c7b909727a3bc64ffcdcc4e1465 6846c005ef292456943403516b0b170672bd81fb 5fec99d156d4af2c4a5fb238b23cb3abe3e0f9fd8cdfffc2f0855b2604a7724d Loading...

	guacari.com.co/sc/NOVASCOT/fd654/	25 kB	2024-05-01	2024-05-09
Pretty URL guacari.com.co/sc/NOVASCOT/fd654/ IP 162.241.60.19 ASN #19871 NETWORK-SOLUTIONS-HOSTING Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-01 03:41:17 Last Seen2024-05-09 08:50:56 Times Seen163 Hash 32915e03f94b3dde36966fa16f09ebb4 e187cdb275e429d696c5a794497db069a8e48426 dac0f6c4f22c620c1a1cf58dcdbcf64e78c57299da355be6aeccb8aaaf6b8977 Loading...

	dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js	3.3 kB	2023-09-20	2024-05-17
Pretty URL dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js IP 104.66.122.200 ASN #16625 AKAMAI-AS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-20 09:29:32 Last Seen2024-05-17 23:56:48 Times Seen1311 Hash f1e098a5dd836ea5fc9726c429c8d71d 9b9371eb2d68b1e71063cf9f848baa07347511ca bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8 Loading...

	dmtags.scotiabank.com/aempublic/Onetrust/scotiabank/oneTrust_production/scripttemplates/otSDKStub.js	21 kB	2023-10-31	2024-05-09
Pretty URL dmtags.scotiabank.com/aempublic/Onetrust/scotiabank/oneTrust_production/scripttemplates/otSDKStub.js IP 104.66.122.200 ASN #16625 AKAMAI-AS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-31 04:12:59 Last Seen2024-05-09 08:50:56 Times Seen6808 Hash cf426cd1788c8356ee58c7abf14c38be 609b5a8f0b4c7b5d3d955152a76db699d0eb5382 6b1fc966c38b12c845f9fd8bdb76027106b776783fd44eeed917663942b5fd16 Loading...

HTTP Transactions (26)

URL IP Response Size

guacari.com.co/runtime.28b2f6d6a26212c51af2.js

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/runtime.28b2f6d6a26212c51af2.js
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /runtime.28b2f6d6a26212c51af2.js HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:45 GMT
server: Apache
X-Firefox-Spdy: h2

guacari.com.co/jeHWnQ/AxRc8Z/Z7Oz/mjbZgY/uk/N15VDLbauruEN7/BS8eYThxBg/Tkk/aJwh5KWcB

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/jeHWnQ/AxRc8Z/Z7Oz/mjbZgY/uk/N15VDLbauruEN7/BS8eYThxBg/Tkk/aJwh5KWcB
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /jeHWnQ/AxRc8Z/Z7Oz/mjbZgY/uk/N15VDLbauruEN7/BS8eYThxBg/Tkk/aJwh5KWcB HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:45 GMT
server: Apache
X-Firefox-Spdy: h2

guacari.com.co/resource-loader.js

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/resource-loader.js
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /resource-loader.js HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:45 GMT
server: Apache
X-Firefox-Spdy: h2

guacari.com.co/main.cafb241d85447b367d0c.chunk.js

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/main.cafb241d85447b367d0c.chunk.js
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /main.cafb241d85447b367d0c.chunk.js HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:45 GMT
server: Apache
X-Firefox-Spdy: h2

guacari.com.co/styles.ef875488df3637535e09.css

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/styles.ef875488df3637535e09.css
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /styles.ef875488df3637535e09.css HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:45 GMT
server: Apache
X-Firefox-Spdy: h2

guacari.com.co/assets/8fd30bd010d9e2c7677ec339685f958b.woff

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/assets/8fd30bd010d9e2c7677ec339685f958b.woff
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /assets/8fd30bd010d9e2c7677ec339685f958b.woff HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:45 GMT
server: Apache
X-Firefox-Spdy: h2

guacari.com.co/assets/50805f331bb1b697aafb6f0c28b09212.woff2

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/assets/50805f331bb1b697aafb6f0c28b09212.woff2
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /assets/50805f331bb1b697aafb6f0c28b09212.woff2 HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:45 GMT
server: Apache
X-Firefox-Spdy: h2

dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/launch-edbf66c903b6.min.js

104.66.122.200

200 OK

68 kB

URL GET HTTP/1.1
dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/launch-edbf66c903b6.min.js
IP
104.66.122.200:443
ASN
#16625 AKAMAI-AS

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerEntrust, Inc.
Subjectapps.scotiabank.com
Fingerprint0D:54:C6:33:4D:69:83:6F:15:A0:C6:B0:AC:82:4E:7C:14:D1:D8:88
ValidityTue, 21 Nov 2023 14:23:22 GMT - Sat, 21 Dec 2024 14:23:21 GMT

File type
JavaScript source, ASCII text, with very long lines (32757)
Size
68 kB (67765 bytes)
Hash
e5954bafa35e730bc024902bc607bd1f
c9e02b8d41693266321ccf5df2f195600a700487
432bdcaeac556841bbcae2c2573562ecdd13161fe8fc121fa4e5dc18ec37e707

HTTP Headers

GET /launch/novaweb/27c34d6e7144/094054a424e3/launch-edbf66c903b6.min.js HTTP/1.1
Host: dmtags.scotiabank.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-javascript
ETag: "661438e0-3f579"
Last-Modified: Mon, 08 Apr 2024 18:35:12 GMT
Server: nginx/1.23.3
X-Vcap-Request-Id: 773864d7-2485-4256-5a57-f15ba41a0207
X-Xss-Protection: 1; mode=block
Content-Encoding: gzip
Content-Length: 67765
Date: Sat, 04 May 2024 13:25:45 GMT
Connection: keep-alive
Access-Control-Allow-Origin: https://scotiabank.com
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://*.scotiabank.com https://www.scotiaitrade.com/ https://www.scotialifefinancial.com/ https://www.scotiafunds.com/ http://*.bns https://*.bns ;
X-Frame-Options: SAMEORIGIN
Cache-Control: private
Vary: Accept-Encoding, origin
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js

104.66.122.200

200 OK

13 kB

URL GET HTTP/1.1
dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js
IP
104.66.122.200:443
ASN
#16625 AKAMAI-AS

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerEntrust, Inc.
Subjectapps.scotiabank.com
Fingerprint0D:54:C6:33:4D:69:83:6F:15:A0:C6:B0:AC:82:4E:7C:14:D1:D8:88
ValidityTue, 21 Nov 2023 14:23:22 GMT - Sat, 21 Dec 2024 14:23:21 GMT

File type
JavaScript source, ASCII text, with very long lines (32730)
Size
13 kB (12687 bytes)
Hash
208eb534ea01036a4fca64e6715ccf3f
90c85649634ff5a627023668b2e10fa01cf30315
6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf

HTTP Headers

GET /launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js HTTP/1.1
Host: dmtags.scotiabank.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-javascript
ETag: "661438ab-8996"
Last-Modified: Mon, 08 Apr 2024 18:34:19 GMT
Server: nginx/1.23.3
X-Vcap-Request-Id: e61856c7-d650-42dc-532c-9003683bddfd
X-Xss-Protection: 1; mode=block
Content-Encoding: gzip
Content-Length: 12687
Date: Sat, 04 May 2024 13:25:45 GMT
Connection: keep-alive
Access-Control-Allow-Origin: https://scotiabank.com
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://*.scotiabank.com https://www.scotiaitrade.com/ https://www.scotialifefinancial.com/ https://www.scotiafunds.com/ http://*.bns https://*.bns ;
X-Frame-Options: SAMEORIGIN
Cache-Control: private
Vary: Accept-Encoding, origin
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

guacari.com.co/favicon.ico

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/favicon.ico
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:45 GMT
server: Apache
X-Firefox-Spdy: h2

dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js

104.66.122.200

200 OK

1.6 kB

URL GET HTTP/1.1
dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js
IP
104.66.122.200:443
ASN
#16625 AKAMAI-AS

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerEntrust, Inc.
Subjectapps.scotiabank.com
Fingerprint0D:54:C6:33:4D:69:83:6F:15:A0:C6:B0:AC:82:4E:7C:14:D1:D8:88
ValidityTue, 21 Nov 2023 14:23:22 GMT - Sat, 21 Dec 2024 14:23:21 GMT

File type
JavaScript source, ASCII text, with very long lines (3138)
Size
1.6 kB (1597 bytes)
Hash
f1e098a5dd836ea5fc9726c429c8d71d
9b9371eb2d68b1e71063cf9f848baa07347511ca
bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8

HTTP Headers

GET /launch/novaweb/27c34d6e7144/094054a424e3/e9f01630ebd7/hostedLibFiles/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js HTTP/1.1
Host: dmtags.scotiabank.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-javascript
ETag: "661438ab-cd4"
Last-Modified: Mon, 08 Apr 2024 18:34:19 GMT
Server: nginx/1.23.3
X-Vcap-Request-Id: 566d5112-7b3e-4a90-4e42-51eb2dd04904
X-Xss-Protection: 1; mode=block
Content-Encoding: gzip
Content-Length: 1597
Date: Sat, 04 May 2024 13:25:45 GMT
Connection: keep-alive
Access-Control-Allow-Origin: https://scotiabank.com
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://*.scotiabank.com https://www.scotiaitrade.com/ https://www.scotialifefinancial.com/ https://www.scotiafunds.com/ http://*.bns https://*.bns ;
X-Frame-Options: SAMEORIGIN
Cache-Control: private
Vary: Accept-Encoding, origin
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

dmtags.scotiabank.com/aempublic/Onetrust/scotiabank/oneTrust_production/scripttemplates/otSDKStub.js

104.66.122.200

200 OK

6.8 kB

URL GET HTTP/1.1
dmtags.scotiabank.com/aempublic/Onetrust/scotiabank/oneTrust_production/scripttemplates/otSDKStub.js
IP
104.66.122.200:443
ASN
#16625 AKAMAI-AS

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerEntrust, Inc.
Subjectapps.scotiabank.com
Fingerprint0D:54:C6:33:4D:69:83:6F:15:A0:C6:B0:AC:82:4E:7C:14:D1:D8:88
ValidityTue, 21 Nov 2023 14:23:22 GMT - Sat, 21 Dec 2024 14:23:21 GMT

File type
JavaScript source, ASCII text, with very long lines (21066)
Size
6.8 kB (6793 bytes)
Hash
cf426cd1788c8356ee58c7abf14c38be
609b5a8f0b4c7b5d3d955152a76db699d0eb5382
6b1fc966c38b12c845f9fd8bdb76027106b776783fd44eeed917663942b5fd16

HTTP Headers

GET /aempublic/Onetrust/scotiabank/oneTrust_production/scripttemplates/otSDKStub.js HTTP/1.1
Host: dmtags.scotiabank.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-javascript
ETag: "6556797d-524b"
Last-Modified: Thu, 16 Nov 2023 20:20:13 GMT
Server: nginx/1.23.3
X-Vcap-Request-Id: e8ed5c2b-47b3-46ef-7fd0-80e5a726ad83
X-Xss-Protection: 1; mode=block
Content-Encoding: gzip
Content-Length: 6793
Date: Sat, 04 May 2024 13:25:45 GMT
Connection: keep-alive
Access-Control-Allow-Origin: https://scotiabank.com
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://*.scotiabank.com https://www.scotiaitrade.com/ https://www.scotialifefinancial.com/ https://www.scotiafunds.com/ http://*.bns https://*.bns ;
X-Frame-Options: SAMEORIGIN
Cache-Control: private
Vary: Accept-Encoding, origin
Strict-Transport-Security: max-age=31536000 ; includeSubDomains

guacari.com.co/assets/8fd30bd010d9e2c7677ec339685f958b.woff

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/assets/8fd30bd010d9e2c7677ec339685f958b.woff
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /assets/8fd30bd010d9e2c7677ec339685f958b.woff HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:45 GMT
server: Apache
X-Firefox-Spdy: h2

guacari.com.co/assets/50805f331bb1b697aafb6f0c28b09212.woff2

162.241.60.19

200 OK

0 B

URL GET HTTP/2
guacari.com.co/assets/50805f331bb1b697aafb6f0c28b09212.woff2
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /assets/50805f331bb1b697aafb6f0c28b09212.woff2 HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/sc/NOVASCOT/fd654/
Cookie: AMCV_0AAF22CE52827A080A490D4D%40AdobeOrg=179643557%7CMCIDTS%7C19848%7CMCMID%7C91854109722439298567809598730342592686%7CvVersion%7C5.5.0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 04 May 2024 13:25:46 GMT
server: Apache
X-Firefox-Spdy: h2

ocsp.entrust.net/

23.38.202.187

1.6 kB

URL
ocsp.entrust.net/
IP
23.38.202.187:0
ASN
#16625 AKAMAI-AS

File type
data
Size
1.6 kB (1588 bytes)
Hash
44b439ca015f0ada1e2d4be3d45107ff
4beae40896f983d56bb19034c3a1f9a819d07a4b
518fd38ac0564fe78468e8d0155664a97c0db4e5bd24c1f429b7a8c96bc50fa9

HTTP Headers

POST / HTTP/1.1
Host: ocsp.entrust.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
ETag: "518FD38AC0564FE78468E8D0155664A97C0DB4E5BD24C1F429B7A8C96BC50FA9"
Last-Modified: Sat, 04 May 2024 11:00:00 UTC
Content-Length: 1588
Cache-Control: public, no-transform, must-revalidate, max-age=2962
Expires: Sat, 04 May 2024 14:15:08 GMT
Date: Sat, 04 May 2024 13:25:46 GMT
Connection: keep-alive

somniture.scotiabank.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=0AAF22CE52827A080A490D4D%40AdobeOrg&mid=91854109722439298567809598730342592686&ts=1714829145890

63.140.62.222

200 OK

48 B

URL GET HTTP/2
somniture.scotiabank.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=0AAF22CE52827A080A490D4D%40AdobeOrg&mid=91854109722439298567809598730342592686&ts=1714829145890
IP
63.140.62.222:443
ASN
#16509 AMAZON-02

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerEntrust, Inc.
Subjectsomniture.scotiabank.com
FingerprintF2:96:F0:FC:08:90:5F:AC:1D:FE:74:A6:47:5F:DC:1E:0E:61:D7:1E
ValidityMon, 21 Aug 2023 20:22:41 GMT - Sat, 21 Sep 2024 20:22:40 GMT

File type
JSON text data
Size
48 B (48 bytes)
Hash
e95ad6deb2a661b3aedf143ca51c6bb3
0e55607a5f328bf7c7fc99913c334c03a7c6eec9
068536bb8d43c96769f62a0754d7367f17dad2154eb818a34991b64c7cbba019

HTTP Headers

GET /id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=0AAF22CE52827A080A490D4D%40AdobeOrg&mid=91854109722439298567809598730342592686&ts=1714829145890 HTTP/1.1
Host: somniture.scotiabank.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://guacari.com.co
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-origin: https://guacari.com.co
access-control-allow-credentials: true
date: Sat, 04 May 2024 13:25:46 GMT
p3p: CP="This is not a P3P policy"
server: jag
set-cookie: s_ecid=MCMID%7C91854109722439298567809598730342592686; Path=/; Domain=scotiabank.com; Max-Age=63072000; Expires=Mon, 04 May 2026 13:25:25 GMT; SameSite=Lax;
vary: Origin
content-type: application/x-javascript;charset=utf-8
content-length: 48
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2

dmtags.scotiabank.com/aempublic/Onetrust/scotiabank/oneTrust_production/consent/4fbad486-5e37-45d2-bcbc-b89a6d33ea60/4fbad486-5e37-45d2-bcbc-b89a6d33ea60.json

104.66.122.200

200 OK

1.7 kB

URL GET HTTP/1.1
dmtags.scotiabank.com/aempublic/Onetrust/scotiabank/oneTrust_production/consent/4fbad486-5e37-45d2-bcbc-b89a6d33ea60/4fbad486-5e37-45d2-bcbc-b89a6d33ea60.json
IP
104.66.122.200:443
ASN
#16625 AKAMAI-AS

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerEntrust, Inc.
Subjectapps.scotiabank.com
Fingerprint0D:54:C6:33:4D:69:83:6F:15:A0:C6:B0:AC:82:4E:7C:14:D1:D8:88
ValidityTue, 21 Nov 2023 14:23:22 GMT - Sat, 21 Dec 2024 14:23:21 GMT

File type
JSON text data
Size
1.7 kB (1663 bytes)
Hash
a5c83dd0c55b426a3c30b19e3a9995a0
59b982ba2cb9efd68339d546486096e553ea4b20
de125b3c6b2e6c0d7aafdca50a9d0324506829b4497bc099c167fc7d1c2fe806

HTTP Headers

GET /aempublic/Onetrust/scotiabank/oneTrust_production/consent/4fbad486-5e37-45d2-bcbc-b89a6d33ea60/4fbad486-5e37-45d2-bcbc-b89a6d33ea60.json HTTP/1.1
Host: dmtags.scotiabank.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://guacari.com.co
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/plain
ETag: "6556797d-129c"
Last-Modified: Thu, 16 Nov 2023 20:20:13 GMT
Server: nginx/1.23.3
X-Vcap-Request-Id: 1373ee26-d8fd-4746-4856-174091607da2
X-Xss-Protection: 1; mode=block
Content-Encoding: gzip
Date: Sat, 04 May 2024 13:25:46 GMT
Content-Length: 1663
Connection: keep-alive
Access-Control-Allow-Origin: https://scotiabank.com
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://*.scotiabank.com https://www.scotiaitrade.com/ https://www.scotialifefinancial.com/ https://www.scotiafunds.com/ http://*.bns https://*.bns ;
X-Frame-Options: SAMEORIGIN
Cache-Control: private
Vary: Accept-Encoding, origin
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Set-Cookie: _abck=2F76A5CD1131C991F89AC14D68504405~-1~YAAQFloDF7cLxymPAQAAwDjIQwuRFx4vgl/X5wXUx178KifJ67lOyxGjQMg/ThYZ2gMLC/ICK7ClKDEYUcxlS8WFVcKCo+qBLhtuDtoGUSK/aT7QKWgnmZRLkc6jid14Ku7ht8act6gbrzXAKeLCuEdB9GYysDnLS56cf3cQM+PdJp/7ecexGhlLMmqBVyv9IksGQMbaiPMrUdpWwyCSoNZPr5Cf0oubOoTAKrtIvgC5TzxsiTxKARL2xmS/1yQkrwl6QaV2Q9SV9HnSnICL83SG4+YiH300leeNDL9731a1jNll9JEgyxTSu3nYsr3ot18nNmdEWJW2t2agzLbuJL9el6V49Ia/mOgv7yrUK7c4MgyCBA6bKMJMocS0IvxVJeICh/D4yWzOHII=~-1~-1~-1; Domain=.scotiabank.com; Path=/; Expires=Sun, 04 May 2025 13:25:46 GMT; Max-Age=31536000; Secure
ak_bmsc=43BCF1C1FE03F36CDBF8621130E5772B~000000000000000000000000000000~YAAQFloDF7gLxymPAQAAwDjIQxemdkznU3QwBVL7dCisPAQu340b/CJBfn+mW6B4aIC+RGAFm1MSj6Nq+4kGsn3m/krWvv4myHJANc2sC0kFn290+YN6nObcNAIxGjHy5+HZW2BmlXRGMeKpslVX5mpwgxheDupjb2mceZp5yFbjLDpJi4F6QH2DPToKqHMr09oR654RRSUZBen6GqRVSGppICVwNmmKWpqPynz9CrW5T0SMxpmSTFRwlOVszADO0n2/R4qc8nHgnTQ2Q7jBunMnJ2WdLa5MDZlmxDZ5RUFHB+A9K8l30GgqwukiDx0b6NdHRM974HbwiA3vBP1F/0kYHVEt5AFaxA9D6Uh4BFV2i8iv5Ys6NLOpnj9OR1IsvhWB; Domain=.scotiabank.com; Path=/; Expires=Sat, 04 May 2024 15:25:46 GMT; Max-Age=7200; HttpOnly
bm_sz=CB3C83ED89985E2C1A88577C67046DDB~YAAQFloDF7kLxymPAQAAwDjIQxdtja/5W34+sHcSqFQ1p6gv7lHQ5V0ll+/DqkizZK++eI2xC7JmeIvwdB25CE4dBwZE307wdVwSVV7BI/0CVZvFf/p8seGnE0kSm3+du14NAizizfVNNhqaGf06eiGp8BdzpAwX/zclkY/4bWDK8+AUzFelTUgImoRqwpW0kRmOlgnk7wetVmUERvbLf1xNAnV8P5UjZsEGNdRAz8tP+NZxrwfBFPQvIXjfvTF9798jPnpX6XObVe7Vy5XczGRSmmhaoCvDwuPDOH0PMQmOvdhlJxCwVpACSQm45qLk9DZRCgsPe26kAN/laKQKR7UtQzcqmoQrpgMXm6vuI9A=~4538680~4538929; Domain=.scotiabank.com; Path=/; Expires=Sat, 04 May 2024 17:25:46 GMT; Max-Age=14400

ocsp.r2m03.amazontrust.com/

3.164.222.26

471 B

URL
ocsp.r2m03.amazontrust.com/
IP
3.164.222.26:0
ASN
#0

File type
data
Size
471 B (471 bytes)
Hash
d9dfa21bc3fa6ec2882460b95172c141
26b7da8a968b2f7e1a04212f80e9e179dfe18425
d173c5f9ed616b97555a4214e1d61a9cf570b926a6bbbd6de3e098c2de9fb777

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sat, 04 May 2024 13:25:46 GMT
Last-Modified: Sat, 04 May 2024 12:33:11 GMT
Server: ECAcc (amb/6B43)
X-Cache: Miss from cloudfront
Via: 1.1 42bac5f1aabdd1402109b9e5f2ab1414.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN53-P1
X-Amz-Cf-Id: bq_Cu_JkNtnVUZOImRRE994PYa6UF_yxOrAfbQAgNOAWWfF3tA6NFw==
Age: 3155

dlslhpkfqfglo.cloudfront.net/cdn/ca/mutha-scotia-wrapper.min.js

143.204.42.77

200 OK

2.5 kB

URL GET HTTP/2
dlslhpkfqfglo.cloudfront.net/cdn/ca/mutha-scotia-wrapper.min.js
IP
143.204.42.77:443
ASN
#16509 AMAZON-02

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT

File type
gzip compressed data, max speed, from Unix
Size
2.5 kB (2544 bytes)
Hash
414871099bd63d54bc6e325607b07368
5b60fc4bc0a6c0dd833cd4ca866f292a91962a55
93462b595944919ef5a9242f2f9f6c3f00a3b9042c9d27ae31dbb1e5be39a08b

HTTP Headers

GET /cdn/ca/mutha-scotia-wrapper.min.js HTTP/1.1
Host: dlslhpkfqfglo.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://guacari.com.co/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
date: Fri, 03 May 2024 17:39:44 GMT
server: nginx/1.18.0 (Ubuntu)
set-cookie: aphishCookie-1714757984020-SCOTIA=0; Max-Age=60; Expires=Fri, 03 May 2024 17:40:44 GMT; SameSite=None; Path=/; Secure
access-control-allow-credentials: true
content-security-policy: frame-ancestors https://*
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
content-encoding: gzip
x-cache: Hit from cloudfront
via: 1.1 76c917e0bb0ba45eb834d25d76ee125e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: wZGT3BFot98fl8hLVplyMQ8RQkccTmoPlqL32gvcSMcD4SVqJisRaQ==
age: 71161
X-Firefox-Spdy: h2

dlslhpkfqfglo.cloudfront.net/cdn/cd/l

143.204.42.77

200 OK

88 B

URL POST HTTP/2
dlslhpkfqfglo.cloudfront.net/cdn/cd/l
IP
143.204.42.77:443
ASN
#16509 AMAZON-02

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT

File type
ASCII text, with no line terminators
Size
88 B (88 bytes)
Hash
3429836d9b063d91eb81f15ee548c5bb
3da508e2aa9d0c02a1e595586340680dd0bf0b4e
a856df6b3d4289cd097436aeec4e219d3d7f5b152b65856d040040cde56630dd

HTTP Headers

POST /cdn/cd/l HTTP/1.1
Host: dlslhpkfqfglo.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 961
Origin: https://guacari.com.co
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: text/plain; charset=UTF-8
content-length: 88
date: Sat, 04 May 2024 13:25:47 GMT
server: nginx/1.18.0 (Ubuntu)
access-control-allow-origin: https://guacari.com.co
access-control-allow-credentials: true
content-security-policy: frame-ancestors https://*
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
x-cache: Miss from cloudfront
via: 1.1 76c917e0bb0ba45eb834d25d76ee125e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: llwXTOUytholcg_hLPCJClblg-Op817LYg32T8IKrydVPwVxkx9C5Q==
X-Firefox-Spdy: h2

dlslhpkfqfglo.cloudfront.net/cdn/ca/jquery-3.6.1.min.js

143.204.42.77

200 OK

806 kB

URL GET HTTP/2
dlslhpkfqfglo.cloudfront.net/cdn/ca/jquery-3.6.1.min.js
IP
143.204.42.77:443
ASN
#16509 AMAZON-02

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT

File type
gzip compressed data, max speed, from Unix
Size
806 kB (806141 bytes)
Hash
ad76dc3f696c74a1b43fecc8e3909a90
fe9eb72981c224417fbaf929effd93a935151178
f2f01fc7c3a3e815185d513f7644f76dc08137042c3e3c32f96438f99a562238

HTTP Headers

GET /cdn/ca/jquery-3.6.1.min.js HTTP/1.1
Host: dlslhpkfqfglo.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://guacari.com.co/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
date: Fri, 03 May 2024 17:39:44 GMT
server: nginx/1.18.0 (Ubuntu)
access-control-allow-credentials: true
content-security-policy: frame-ancestors https://*
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
content-encoding: gzip
x-cache: Hit from cloudfront
via: 1.1 76c917e0bb0ba45eb834d25d76ee125e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: ltts7VsUdretNCsJ17YkphVorgrl0yBcl9A9OpO_lAH0--_9c4FfNQ==
age: 71161
X-Firefox-Spdy: h2

dlslhpkfqfglo.cloudfront.net/cdn/cd/gwf

143.204.42.77

200 OK

7.9 kB

URL POST HTTP/2
dlslhpkfqfglo.cloudfront.net/cdn/cd/gwf
IP
143.204.42.77:443
ASN
#16509 AMAZON-02

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT

File type
ASCII text, with very long lines (7872), with no line terminators
Size
7.9 kB (7872 bytes)
Hash
45e609af90fa1a1f731ee0c7f3ec7ec7
ed4541ea72487ee0aad72bd1fc5a9015b2760bf7
a619a7dc7931f6e8c9045e97787f60f76878460af70b524f97fe8a094824a56b

HTTP Headers

POST /cdn/cd/gwf HTTP/1.1
Host: dlslhpkfqfglo.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 911
Origin: https://guacari.com.co
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/plain; charset=UTF-8
date: Sat, 04 May 2024 13:25:47 GMT
server: nginx/1.18.0 (Ubuntu)
access-control-allow-origin: https://guacari.com.co
access-control-allow-credentials: true
content-security-policy: frame-ancestors https://*
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 76c917e0bb0ba45eb834d25d76ee125e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: Rdjvim3lhOjYmQgcgR151YtU--vnqdqL472_6jReLTO4OaEVydklCw==
X-Firefox-Spdy: h2

guacari.com.co/sc/NOVASCOT/fd654/

162.241.60.19

200 OK

102 kB

URL User Request GET HTTP/2
guacari.com.co/sc/NOVASCOT/fd654/
IP
162.241.60.19:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Certificate
IssuerLet's Encrypt
Subjectguacari.com.co
Fingerprint35:C0:E1:01:4B:BC:93:2C:1B:B6:66:87:7F:9E:6D:92:DD:63:88:8B
ValidityMon, 04 Mar 2024 16:19:47 GMT - Sun, 02 Jun 2024 16:19:46 GMT

File type

Size
102 kB (101816 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /sc/NOVASCOT/fd654/ HTTP/1.1
Host: guacari.com.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Sat, 04 May 2024 12:55:21 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
date: Sat, 04 May 2024 13:25:44 GMT
server: Apache
X-Firefox-Spdy: h2

dlslhpkfqfglo.cloudfront.net/cdn/cd/gpk?orgID=81f541cd2f4ea9c2908b9e39b03e0a80

143.204.42.77

200 OK

767 B

URL GET HTTP/2
dlslhpkfqfglo.cloudfront.net/cdn/cd/gpk?orgID=81f541cd2f4ea9c2908b9e39b03e0a80
IP
143.204.42.77:443
ASN
#16509 AMAZON-02

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT

File type
troff or preprocessor input, ASCII text, with very long lines (775), with no line terminators
Size
767 B (767 bytes)
Hash
52300238c7aa600c8f27d6c23f8f3f6f
ce6b1815177d77af4d326b993531e07a66de478e
d3373a03cdc388b5c74279490bd3eb5c1020575bb7aa59bb4e310580d58d5c40

HTTP Headers

GET /cdn/cd/gpk?orgID=81f541cd2f4ea9c2908b9e39b03e0a80 HTTP/1.1
Host: dlslhpkfqfglo.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://guacari.com.co
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/json
date: Fri, 03 May 2024 17:39:45 GMT
server: nginx/1.18.0 (Ubuntu)
access-control-allow-origin: https://guacari.com.co
access-control-allow-credentials: true
content-security-policy: frame-ancestors https://*
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
content-encoding: gzip
x-cache: Hit from cloudfront
via: 1.1 76c917e0bb0ba45eb834d25d76ee125e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 9j10FGuRBtQhz5xi8hhGqE5-rdQ1LMMW5ChSKbakjI2vPfXbJQ_tbw==
age: 71161
X-Firefox-Spdy: h2

csf-e58f0d0de3ce9fa5ebc118ad6482af34.memcyco.com/cdn/cd/csframe.html

52.210.155.25

200 OK

2.6 kB

URL GET HTTP/2
csf-e58f0d0de3ce9fa5ebc118ad6482af34.memcyco.com/cdn/cd/csframe.html
IP
52.210.155.25:443
ASN
#16509 AMAZON-02

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/
Certificate
IssuerAmazon
Subject*.memcyco.com
FingerprintDC:2A:FA:45:92:DC:C8:0C:1D:66:96:34:6A:FC:E1:4F:09:ED:40:3E
ValiditySun, 25 Feb 2024 00:00:00 GMT - Tue, 25 Mar 2025 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (2876), with no line terminators
Size
2.6 kB (2579 bytes)
Hash
0d5c8d9c1cf625be880f87d6f071d845
4890153d870cd9694b8068932509376013fff605
46f092fc499a2cb8358e39972167fa44134a99a9d38ea1fe9fabc10711216c9c

HTTP Headers

GET /cdn/cd/csframe.html HTTP/1.1
Host: csf-e58f0d0de3ce9fa5ebc118ad6482af34.memcyco.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://guacari.com.co/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 04 May 2024 13:25:46 GMT
content-type: text/html; charset=UTF-8
set-cookie: AWSALB=DC7O+glIBNvPBh8qUWKwpMbemBZ9AmStIpjavzPsqEoSk6z1/TRgcY+PKPFYSzpvRV9xC2RCop1a52suOAJpc7XmbhrUBWWGg9jHsKn26fCtheu+oPlnOWlQSMPb; Expires=Sat, 11 May 2024 13:25:46 GMT; Path=/
AWSALBCORS=DC7O+glIBNvPBh8qUWKwpMbemBZ9AmStIpjavzPsqEoSk6z1/TRgcY+PKPFYSzpvRV9xC2RCop1a52suOAJpc7XmbhrUBWWGg9jHsKn26fCtheu+oPlnOWlQSMPb; Expires=Sat, 11 May 2024 13:25:46 GMT; Path=/; SameSite=None; Secure
server: nginx/1.23.3
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
content-encoding: gzip
X-Firefox-Spdy: h2

assets/images/%20.jpg

0.0.0.0

0 B

URL GET
assets/images/%20.jpg
IP
0.0.0.0:0
ASN
#0

Requested by
https://guacari.com.co/sc/NOVASCOT/fd654/

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/%20.jpg HTTP/1.1
Host: assets
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://guacari.com.co/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL