Overview

URLu1951769.cp.regruhosting.ru/
IP 31.31.198.229 (Russia)
ASN#197695 Domain names registrar REG.RU, Ltd
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access lock_open
Report completed2023-03-02 18:36:10 UTC
StatusLoading report..
IDS alerts1
Blocklist alert19
urlquery alerts
14
Phishing - Bancolombia
Suspicious - Suspicious JS code
Tags bancolombia financial phishing suspicious

Domain Summary (14)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
ocsp.pki.goog (2) 175 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 686 1400 142.250.74.131
sucursalpersonas.transaccionesbancolombia.com (2) 190375 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 875 7876 162.159.255.116
api.ipify.org (1) 3267 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 455 224 64.185.227.155
u1951769.cp.regruhosting.ru (19) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 6475 936142 31.31.198.229
ocsp.digicert.com (2) 86 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 682 1540 192.229.221.95
push.services.mozilla.com (1) 2140 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 606 127 35.162.144.216
ajax.googleapis.com (1) 12905 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 402 32005 142.250.74.42
r3.o.lencr.org (8) 344 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 2704 7090 95.101.11.115
content-signature-2.cdn.mozilla.net (1) 1152 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 413 5882 34.160.144.191
contile.services.mozilla.com (1) 1114 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 333 391 34.117.237.239
ipinfo.io (1) 8136 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 439 514 34.117.59.81
firefox.settings.services.mozilla.com (2) 867 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 782 2374 35.241.9.150
ocsp.sectigo.com (1) 487 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 340 963 104.18.32.68
img-getpocket.cdn.mozilla.net (7) 1631 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3801 79004 34.120.237.76

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-03-02 18:35:59 UTC medium Client IP  34.117.59.81 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) 

Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia
2023-03-02 medium u1951769.cp.regruhosting.ru/ Bancolombia

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 31.31.198.229
Date UQ / IDS / BL URL IP
2023-04-08 06:33:22 UTC 1 - 1 - 59 u2010274.cp.regruhosting.ru/sucarsal/index.php 31.31.198.229
2023-04-05 05:34:25 UTC 1 - 0 - 29 http://u1995585.cp.regruhosting.ru/indexm 31.31.198.229
2023-04-05 02:47:51 UTC 1 - 0 - 29 http://u1995585.cp.regruhosting.ru/indexm 31.31.198.229
2023-04-04 01:41:16 UTC 0 - 2 - 0 mobile.de-data-23814938.top/signin_openid.pap (...) 31.31.198.229
2023-04-04 01:38:19 UTC 0 - 2 - 0 mobile.de-data-23814938.top/signin_openid.pap (...) 31.31.198.229


Last 5 reports on ASN: Domain names registrar REG.RU, Ltd
Date UQ / IDS / BL URL IP
2023-05-29 16:17:30 UTC 0 - 1 - 5 shvarcnegerhistory.com/t1s1j1/index/c3/?serve (...) 37.140.198.72
2023-05-29 16:02:25 UTC 0 - 0 - 1 2thai.org/ 194.58.112.165
2023-05-29 14:01:49 UTC 0 - 0 - 3 lkcupid.com/zNtrRG 5.63.153.25
2023-05-29 13:39:35 UTC 0 - 2 - 0 routesearcher.space/MapsAPI.exe 31.31.196.3
2023-05-29 11:11:23 UTC 0 - 0 - 4 www.academy4life.ru/catalog/usa/ 31.31.198.215


No other reports on domain:


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2022-09-15 21:10:49 UTC 0 - 0 - 26 verifibank1.verifibank1.repl.co/ 34.149.204.188
2022-09-15 21:10:10 UTC 0 - 0 - 28 bancolombia-2.bancolombia3232.repl.co/ 34.149.204.188
2022-09-10 08:44:23 UTC 0 - 0 - 30 bancolombi25.bancolombi25.repl.co/ 34.149.204.188
2022-09-10 08:36:02 UTC 0 - 0 - 28 severalovalcables.bancolin.repl.co/ 34.149.204.188
2022-09-04 09:35:50 UTC 0 - 0 - 8 ringedgrizzledunix.sesion247.repl.co/ 34.149.204.188

JavaScript

Executed Scripts (6)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (49)


Request Response
                                        
                                            GET / HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/html
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:07:20 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (347)
Size:   2420
Md5:    dd94ab61fe80dc3e0e71e1874dcd79ca
Sha1:   1be2fcfc0f479bcef0bcd22306d1937a4fffa8b4
Sha256: a7afd4e4e2c9e9c785ece73488f8ab5874286962c9fe3b1142004a4451c2bd6e

Blocklists:
  - openphish: Bancolombia
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "4B69973AF6E9C5A78D94E8661B08D9349176A515E7BFB3386B10ACE4C6F1AE21"
Last-Modified: Tue, 28 Feb 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5062
Expires: Thu, 02 Mar 2023 20:00:21 GMT
Date: Thu, 02 Mar 2023 18:35:59 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "32C544EF8B8A3FAAF08BDB76F8A387510037DFC15A022FD59457CF45215A6BA8"
Last-Modified: Thu, 02 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16712
Expires: Thu, 02 Mar 2023 23:14:31 GMT
Date: Thu, 02 Mar 2023 18:35:59 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Alert, Content-Type, Retry-After, Backoff, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 02 Mar 2023 18:08:12 GMT
age: 1667
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    7f03faaba3392caae6dae54467bfdf6d
Sha1:   57ea1f14e8bfbcca8190c706d708c9fda12442c1
Sha256: 02ac551ba61fcbc6b04f244df065948b181a8a258db5c2e197aae66fdfcea8ee
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "DE8102626E7960652E844BE721EC8336927886D18957A52474E4BC31A7C1A83B"
Last-Modified: Thu, 02 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19745
Expires: Fri, 03 Mar 2023 00:05:04 GMT
Date: Thu, 02 Mar 2023 18:35:59 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: 83S7f4ioctUREEod54y8GeXfVCPBFhN7Kv5Y069UojnxCtNHK1XMpMYyj1c9vWCBYSVV2m93vUM=
x-amz-request-id: JRCXXBMK2R5VQ001
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 02 Mar 2023 18:15:31 GMT
age: 1228
last-modified: Sat, 18 Feb 2023 20:28:27 GMT
etag: "b5ba6334e73496995e3e3a9ecd0eb323"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    b5ba6334e73496995e3e3a9ecd0eb323
Sha1:   ad80d3b7718c28364e8c2004fb38a13a1747e462
Sha256: aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Thu, 02 Mar 2023 18:35:59 GMT
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 02 Mar 2023 18:35:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1 
Host: ajax.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.42
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                            
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31021
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 24 Feb 2023 13:36:18 GMT
expires: Sat, 24 Feb 2024 13:36:18 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Fri, 08 May 2020 07:05:03 GMT
vary: Accept-Encoding
age: 536381
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65451)
Size:   31021
Md5:    903bc7a7e510f87aa5d0201eb59a0832
Sha1:   ac9aa4dd94cde1bcba9037e94087138b127e41fc
Sha256: 41a7ac8150cc9f38421451d5143c1ffec7a1f1fafbf7a7fc0f51b98ad699cf8f
                                        
                                            GET /index_files/styles.css HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:08:02 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (360)
Size:   15439
Md5:    3215099191a00ef9887e2238ed7c843a
Sha1:   3597f3adc7c9ae91ba65feb0fc27a02488c440ff
Sha256: d9679d904f7e1528c67c95bd9000c3b6dab129f2413c4185a294d4a5766961e9

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /index_files/jquery-ui.css HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:08:01 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (1363)
Size:   6056
Md5:    1cf3099bba722de133fc56accef92b16
Sha1:   1e76944e07a651f8256374a8b8e1e6872b8d8d20
Sha256: 6f210bbd36cf49f817e1a4f0e7e530fa585616212d9743f8d516956703399834

urlquery:
  - Phishing - Bancolombia
  - Phishing - Bancolombia
Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /index_files/ui.css HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:08:01 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text
Size:   2981
Md5:    f5c6c315bfd9e8f25c827bd1d4210234
Sha1:   2e012428b6b1b70366eecda4e0e38bc735effc49
Sha256: af2dafb91bf6fecafe9284000f0f7694f255ac543d08c35095939dd2709f4d55

Blocklists:
  - openphish: Bancolombia
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 02 Mar 2023 18:35:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /index_files/bootstrap.css HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:07:59 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  assembler source, ASCII text, with very long lines (540)
Size:   18124
Md5:    2391913ca35538860d04cd7f8f102c62
Sha1:   b707bee1d8c4f35ae1347f9b687563a068d35c59
Sha256: 33c787b5b26bf6affe7349ab4854aa6dc9a9ce648b375cf199adcd57a45894dd

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /css/bootstrap.min.css HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:07:26 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65371)
Size:   19959
Md5:    f09f501d49406e929f3c3c14275bfcbe
Sha1:   29c655b2b6693700798208ac087da1bdbd5622f7
Sha256: 124f7f2898c20ae83402e1c0d2d1d199438fc328faa5ed940667db7300d7207c

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /css/simple-keyboard.css HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:07:32 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text
Size:   871
Md5:    74c851653a170140cea2f0cce2ac0366
Sha1:   c8b12df62cf3e804f9d469be513106b05bd641a0
Sha256: ba935249294ba7df566513d6241dc4a99b939d26d2386d5d96b728bc7f81eadf

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /css/keyboard.css HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:07:31 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text
Size:   275
Md5:    c83a02e7f12bf6eac1878cb25eb77b2c
Sha1:   692e43686ae4231f0992d65822830057701efd24
Sha256: fcfdf09d962ebe7aff5eb17c1e2a28ebc9f03043de4e6a261895d386d215acb5

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /js/FrontFunctions.min.js HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:08:05 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (28360), with no line terminators
Size:   8122
Md5:    8390a3d36dfc56c76c17dd726c00033c
Sha1:   c78abae55142ea045fd90c92fd764cada176effe
Sha256: b218a8296213b074a317fee3497b0a0e56d15daaacbeef78de5a865f7076d078

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /js/sax.js HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:08:05 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text
Size:   545
Md5:    18e6e01b78737ecf9dbabfd684df88d5
Sha1:   ff793e463f3954d0a9fc803215dce3d2c0a8de6d
Sha256: aff478be92a1e150b19676df90da25ef4ac6a8e7d14c6f18dd3e432c29fa7129

urlquery:
  - Suspicious - Suspicious JS code
Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /css/customcarousel.min.css HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:07:25 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (1920)
Size:   629
Md5:    3297c9da340d0643bd856ad6c30f18f1
Sha1:   87d314b7a27c8f181fb42a7c4a2f5de60a3d0479
Sha256: 2758e615be3e23acf7fb0a496fb76d6739f416d072d60d7ef564dd4e7ded5d4f

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /css/default.min.css HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:07:27 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (414)
Size:   142123
Md5:    9f20c4b7a4e01f1b76f7bc1ad67d4c91
Sha1:   cb0d1922455bcfc0b17d9d0720d7730fd32bcf30
Sha256: 6886f8b6812fd87bb6691fbb3ec92a97c2a998887f5e000c1ef10c77f54cc87d

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: ETag, Cache-Control, Expires, Alert, Content-Type, Pragma, Retry-After, Last-Modified, Backoff, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 02 Mar 2023 18:03:36 GMT
age: 1943
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /js/sharedout HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:35:59 GMT
Content-Length: 386613
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:08:08 GMT
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65435), with no line terminators
Size:   386613
Md5:    9861fa51e74a108f05a388c4bc7547ec
Sha1:   6227ce8903aafc40485e4adda69f945bcd25ed4e
Sha256: c4145a9e8ffd7f6e600cb97e9d5b54488499fec84e99b147ee7c48d171314395

urlquery:
  - Phishing - Bancolombia
  - Phishing - Bancolombia
Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /index_files/info.png HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: image/png
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:36:00 GMT
Content-Length: 387
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:08:00 GMT
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Size:   387
Md5:    09c2e3eaa191ec7ac63e73590b472448
Sha1:   ba1a060db2020c45c27b78a979a16976513fbaf2
Sha256: 05f4f47fa82feaff2708307e1ec579ba3027a6409bd2e4b66700faad0fabf657

urlquery:
  - Phishing - Bancolombia
  - Phishing - Bancolombia
Blocklists:
  - openphish: Bancolombia
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "BBA70E7CE85B81A6CA0346956EA2021E29CF94EC13023FA75BD0A7FEC943EB18"
Last-Modified: Thu, 02 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3078
Expires: Thu, 02 Mar 2023 19:27:18 GMT
Date: Thu, 02 Mar 2023 18:36:00 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "5477BBE2F78381887D50B0332FFD960008F046ACD7522E225A4C02E0D4B3E189"
Last-Modified: Thu, 02 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6035
Expires: Thu, 02 Mar 2023 20:16:35 GMT
Date: Thu, 02 Mar 2023 18:36:00 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 71768
Cache-Control: 'max-age=158059'
Date: Thu, 02 Mar 2023 18:36:00 GMT
Last-Modified: Wed, 01 Mar 2023 22:39:52 GMT
Server: ECAcc (amb/6AA6)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 45477
Cache-Control: max-age=155358
Date: Thu, 02 Mar 2023 18:36:00 GMT
Etag: "63fff6c9-1d7"
Expires: Sat, 04 Mar 2023 13:45:17 GMT
Last-Modified: Thu, 02 Mar 2023 01:07:21 GMT
Server: ECAcc (amb/6B0A)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "5477BBE2F78381887D50B0332FFD960008F046ACD7522E225A4C02E0D4B3E189"
Last-Modified: Thu, 02 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6035
Expires: Thu, 02 Mar 2023 20:16:35 GMT
Date: Thu, 02 Mar 2023 18:36:00 GMT
Connection: keep-alive

                                        
                                            GET /mua/images/icons/icon-user.png HTTP/1.1 
Host: sucursalpersonas.transaccionesbancolombia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             162.159.255.116
HTTP/2 200 OK
content-type: image/png
                                            
date: Thu, 02 Mar 2023 18:36:00 GMT
content-length: 447
x-frame-options: sameorigin, sameorigin, SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 27 Apr 2021 13:04:03 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-content-security-policy: default-src 'self';
content-security-policy: default-src 'self'; script-src 'self' https://cdn.siftscience.com *.medallia.com *.kampyle.com https://checkout.wompi.co https://www.google.com *.googleapis.com api.segment.io *.segment.com *.todo1.com *.cloudbancolombia.com *.newrelic.com bam.nr-data.net *.gstatic.com https://www.google-analytics.com https://tagmanager.google.com https://www.googletagmanager.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'unsafe-inline' 'unsafe-eval'; connect-src https://sessions.bugsnag.com *.medallia.com *.kampyle.com api.segment.io *.segment.com *.todo1.com *.newrelic.com bam.nr-data.net https://www.google-analytics.com www.google-analytics.com tagmanager.google.com *.hotjar.com *.hotjar.io *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self'; img-src https://hexagon-analytics.com *.medallia.com *.kampyle.com images-cdn.info https://www.google-analytics.com www.google-analytics.com https://www.google.com *.gstatic.com *.cloudbancolombia.com *.bancolombia.com *.todo1.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self' data:; style-src 'self' *.medallia.com *.kampyle.com 'unsafe-inline' 'unsafe-eval' https://tagmanager.google.com https://fonts.googleapis.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com; frame-src 'self' https://checkout.wompi.co *.medallia.com *.kampyle.com https://www.google.com/ https://*.googleapis.com https://*.gstatic.com *.salesforce.com *.force.com *.visualforce.com *.cloudbancolombia.com *.bancolombia.corp *.bancolombia.com *.transaccionesbancolombia.com *.hotjar.com https://stags.bluekai.com https://www.facebook.com data: blob:; font-src https://*.gstatic.com 'self' data:
access-control-allow-origin: https://c.na7.visual.fo.todo1.com
cf-cache-status: REVALIDATED
expires: Thu, 02 Mar 2023 22:36:00 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
set-cookie: __cf_bm=rWiZ.pG8KAZyY.UiXlzFJq92ykcTaiS4ZLgNcv2DWrU-1677782160-0-AcZlIjacsg/FZHc9+v8Zs9UW2veMKKRHSYFnvBCGGMEKzMq7cEld3sS/jCu1gowKd1q2xVJrBmp2FQwrtQwG45A=; path=/; expires=Thu, 02-Mar-23 19:06:00 GMT; domain=.transaccionesbancolombia.com; HttpOnly; Secure; SameSite=None __cflb=02DiuF7aX6zsQEVJrpNgCqfZ7XAJa8kSyRiarYT8HdCeQ; SameSite=Lax; path=/; expires=Fri, 03-Mar-23 17:36:00 GMT; HttpOnly
vary: Accept-Encoding
server: cloudflare
cf-ray: 7a1bbe25ce21dc2d-LHR
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced\012- data
Size:   447
Md5:    0e3457ed5ea858d1e9287ef66dcbbfe4
Sha1:   006c99b62e141ebbc69f6e06cab757995d3f7417
Sha256: 75d5b455151a3b1a0a5b100041fee37de2daa0b41d1d177deaa863177c5b5b83
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Thu, 02 Mar 2023 18:36:00 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 01 Mar 2023 12:31:12 GMT
Expires: Wed, 08 Mar 2023 12:31:11 GMT
Etag: "fb7e3b3c0cba0ffa60e258070dc7335a7dbf918c"
Cache-Control: max-age=495910,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7a1bbe26bb08b52d-OSL

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: oTnHwjZ+WNTDpmhy4GDuWg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             35.162.144.216
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Xn5J0exja1JxBDXczL2KK3ZFwfk=

                                        
                                            GET /?format=json HTTP/1.1 
Host: api.ipify.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://u1951769.cp.regruhosting.ru
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             64.185.227.155
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: http://u1951769.cp.regruhosting.ru
date: Thu, 02 Mar 2023 18:36:00 GMT
vary: Origin
content-length: 21
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   21
Md5:    7d69c71af0f191e9a72db6153f8018d1
Sha1:   f67c5f2887bc05654b47f76e9621e53a4091aed1
Sha256: 5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "BC111F63BC9E6D8AA52995FCBFAA48C9685693C99A0D69179ECC92811028E804"
Last-Modified: Thu, 02 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2368
Expires: Thu, 02 Mar 2023 19:15:28 GMT
Date: Thu, 02 Mar 2023 18:36:00 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "BC111F63BC9E6D8AA52995FCBFAA48C9685693C99A0D69179ECC92811028E804"
Last-Modified: Thu, 02 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2368
Expires: Thu, 02 Mar 2023 19:15:28 GMT
Date: Thu, 02 Mar 2023 18:36:00 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc9af2f1d-e839-4f99-b9a9-9c955e5173cf.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 10296
x-amzn-requestid: af2af20a-8a87-43d2-a7e8-afc644c8fe7e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BHu01FkKIAMF_Ag=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ffc4eb-7d80f0da69fe038d062a097d;Sampled=0
x-amzn-remapped-date: Wed, 01 Mar 2023 21:34:35 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: JTn-yYrfTFBHTcnPXGxrywZG38nHG8s8EUiSNp03xGG44XST_aCn6A==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 1d0860167e2100a6d1cd9c0213c2b8e8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Mar 2023 21:50:36 GMT
age: 74724
etag: "d5a65572f19b4c371c36b123ad89bcfd44d38df3"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10296
Md5:    3f4713a81636b5d56b676eb46e088d13
Sha1:   d5a65572f19b4c371c36b123ad89bcfd44d38df3
Sha256: d518035a0d2d4a7caaf4d3f430a762b9213af254203d3d9e389e4b007a29542b
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb2508da1-4567-4abe-a1fd-fb1112625c4e.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 12271
x-amzn-requestid: de545cf0-f4a6-4cd6-81dd-7eb29bf92256
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BHu76EA8IAMFiig=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ffc518-7de203e72a78415a0780d6c8;Sampled=0
x-amzn-remapped-date: Wed, 01 Mar 2023 21:35:20 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: 4jz6gy6eI6O0Y94NdaLvc36dBI-W-gVcpxA21d8k5s1SuSCl0uXVYw==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 0906d4887f6625f4a4467d8d4fd268d2.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Mar 2023 21:48:18 GMT
age: 74862
etag: "8f41fe3cbb20bd9e66eb39eedd284c2a18a63955"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12271
Md5:    840d414b9e8187cdc769a303ae74967b
Sha1:   8f41fe3cbb20bd9e66eb39eedd284c2a18a63955
Sha256: 04d7871a2cff1b3a6020907137a7e7bc9b4873adc983ac0ab89d8c0f88ad108e
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd4b6a552-99ee-4553-9f49-e91b95645e26.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 13658
x-amzn-requestid: 66b11a7b-6720-4be4-a874-c52e7e2bc738
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BHwNYGLUIAMFrqg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ffc722-1159cbbf3448ee55435d73bf;Sampled=0
x-amzn-remapped-date: Wed, 01 Mar 2023 21:44:02 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: IbJnp3QbzRlqH6eao_8qRAWnsZ0dsE5HmOn2Q8nNQPgJtyU8HslYCg==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 5c35539543902c678280929df206948c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Mar 2023 21:51:16 GMT
etag: "0b832c73eca6a196fe66c4b2f2a95c6440360295"
age: 74684
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   13658
Md5:    25cb830d4f133b58ecf680cadf8801d3
Sha1:   0b832c73eca6a196fe66c4b2f2a95c6440360295
Sha256: 960eef032353ba6c36f7495e1884222536af3c5577e880270be927374738361d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc65f862a-23bb-447f-98c4-c7bdb442e1fe.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 10174
x-amzn-requestid: 477ce38b-e948-4349-9da5-699a19a1d41f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BHuzAHBkIAMFQZg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ffc4df-3c6ab62d47fe8d794da8ecb7;Sampled=0
x-amzn-remapped-date: Wed, 01 Mar 2023 21:34:23 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: LJ38TALPaoEv_JDm5EZ2gzOwrfsk6OjRmvZu_seMp_ZwZrqargo7jA==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 2c6b5dd77f1abe60653ce0454f344b64.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Mar 2023 21:44:01 GMT
age: 75119
etag: "8901a9ae409a2d84b5450599a529d8d27117385f"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10174
Md5:    df30be373b0d59ce754af229b2846059
Sha1:   8901a9ae409a2d84b5450599a529d8d27117385f
Sha256: 4fe8e7f3196851316e5cbcaff1f11fd296914ded9bc53ab4c772d99bc8c91905
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb97e8f2e-6da0-4f8b-b12c-1af676e3e4da.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9093
x-amzn-requestid: f160a6a5-c245-40ab-9e03-ca03ba05863a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BBNUOGorIAMFTlg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fd28e7-74bb8ca33cc8d5ee7e48ad3a;Sampled=0
x-amzn-remapped-date: Mon, 27 Feb 2023 22:04:23 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: OAXdgPPPK_4LyHpQ-v3GLo2UhBtMS9SwSM95pdWa4jhnlB9JzqBSvw==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 e11ee4e3208082d534c251b36bbee268.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Mar 2023 21:42:10 GMT
age: 75230
etag: "3e9b03cc296e954d63526a4e7e75beea3130fc3b"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9093
Md5:    2a5f3d376fe6a3a78a5d1fe136f962fb
Sha1:   3e9b03cc296e954d63526a4e7e75beea3130fc3b
Sha256: c8cf4f1c0352102764247e4dc5a2076921e0eaa18bfd110e5b0b97a55c706690
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F749c9bae-5b66-459e-8826-3e69595a8135.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 11181
x-amzn-requestid: 57b145c4-449e-47bf-b870-c65af509af31
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BHuxKEobIAMFVag=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ffc4d3-3ed3a2f62cd6d2271018e7c0;Sampled=0
x-amzn-remapped-date: Wed, 01 Mar 2023 21:34:12 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: 7MPc8DCN9Z-SFi8nW9v0uK_sz5SEiUxyMXrhT0QQFdr1QePN5aAolw==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 0ec9ddba08fcd99386924593dbdbd44a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Mar 2023 21:51:09 GMT
age: 74691
etag: "eb41ce1c7d4e370d65806c3e33141037c6c5309b"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11181
Md5:    fb6cf25f51d819358cb2cd6a11c033de
Sha1:   eb41ce1c7d4e370d65806c3e33141037c6c5309b
Sha256: 06af18ff07ea35e35e9c527f6ea66aac5ec5b2363825814eaf7859c77ebf8e58
                                        
                                            GET /css/Inter-Regular.woff2 HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/css/default.min.css

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: font/woff2
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:36:00 GMT
Content-Length: 89212
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:07:31 GMT
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 89212, version 1.0\012- data
Size:   89212
Md5:    bffaed793493dc46bf0789e2275909ac
Sha1:   21178040c070176c06653b76d42b1e19810c2df0
Sha256: 77ca56870309a85759fb7116aef2119a26e358145e808868543ca1fe16c27720

urlquery:
  - Phishing - Bancolombia
  - Phishing - Bancolombia
Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /index_files/imgPublicidad.jpg HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:36:00 GMT
Content-Length: 44169
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 22:07:59 GMT
Accept-Ranges: bytes


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 627x327, components 3\012- data
Size:   44169
Md5:    cdf93f00906db92325ebcd535036f8c3
Sha1:   fb0d05b9dd1938a0c1e21e7006a0eef7f66a9176
Sha256: e1a1946613ce2e000dbc69b8459c9f3afa40b3f190f0f8088f76e8ef8ae6619c

urlquery:
  - Phishing - Bancolombia
  - Phishing - Bancolombia
Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /fonts/opensans/OpenSans-Regular.ttf HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/index_files/styles.css

                                        
                                             31.31.198.229
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=utf-8
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:36:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 07:23:06 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (65519), with no line terminators
Size:   64694
Md5:    0ba7ea56699114d9d7b722edcadff924
Sha1:   c5b9ba281fa908f541f01f770cbe2367a79c889b
Sha256: 1e9bb1b3be3606b68bfe4d70313c2fec866b246d38249f7bc27d126bbb76b782

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/

                                        
                                             31.31.198.229
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=utf-8
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:36:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 07:23:06 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (65519), with no line terminators
Size:   64694
Md5:    0ba7ea56699114d9d7b722edcadff924
Sha1:   c5b9ba281fa908f541f01f770cbe2367a79c889b
Sha256: 1e9bb1b3be3606b68bfe4d70313c2fec866b246d38249f7bc27d126bbb76b782

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /fonts/opensans/CIBFontSans-Light.ttf HTTP/1.1 
Host: u1951769.cp.regruhosting.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/index_files/styles.css

                                        
                                             31.31.198.229
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=utf-8
                                            
Server: nginx
Date: Thu, 02 Mar 2023 18:36:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 07:23:06 GMT
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (65519), with no line terminators
Size:   64694
Md5:    0ba7ea56699114d9d7b722edcadff924
Sha1:   c5b9ba281fa908f541f01f770cbe2367a79c889b
Sha256: 1e9bb1b3be3606b68bfe4d70313c2fec866b246d38249f7bc27d126bbb76b782

Blocklists:
  - openphish: Bancolombia
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4526c24-9a47-49f0-a7c9-25d6f13552b1.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4892
x-amzn-requestid: dfc2b347-d706-41a6-ac05-f3019c5e8cdb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BHu8BH10oAMFcJg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ffc519-0020fcd346a3a2be63ad2bb1;Sampled=0
x-amzn-remapped-date: Wed, 01 Mar 2023 21:35:21 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: opuOOPIAftxTlIeG0fxXTxaBQuyZoTtfb6jd2KbINxDHY9eVc_vtwQ==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 85ee490c179dc0af42b771f11421073e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Mar 2023 22:33:18 GMT
age: 72169
etag: "6bb6430bc838848919570ee0f9ba1d33fe7c18c3"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4892
Md5:    d664a7035f9f7d4ffb76a62e1f675b5f
Sha1:   6bb6430bc838848919570ee0f9ba1d33fe7c18c3
Sha256: 63e25f5317102fc0ee9621e269f6713e00e8402c1481e07d9d07b610d91734b8
                                        
                                            GET / HTTP/1.1 
Host: ipinfo.io
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://u1951769.cp.regruhosting.ru
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.59.81
HTTP/2 200 OK
content-type: application/json; charset=utf-8
                                            
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
date: Thu, 02 Mar 2023 18:36:00 GMT
x-envoy-upstream-service-time: 1
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /mua/images/logo.svg HTTP/1.1 
Host: sucursalpersonas.transaccionesbancolombia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://u1951769.cp.regruhosting.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             162.159.255.116
HTTP/2 200 OK
content-type: image/svg+xml
                                            
date: Thu, 02 Mar 2023 18:36:00 GMT
x-frame-options: sameorigin, sameorigin, SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 27 Apr 2021 13:03:56 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-content-security-policy: default-src 'self';
content-security-policy: default-src 'self'; script-src 'self' https://cdn.siftscience.com *.medallia.com *.kampyle.com https://checkout.wompi.co https://www.google.com *.googleapis.com api.segment.io *.segment.com *.todo1.com *.cloudbancolombia.com *.newrelic.com bam.nr-data.net *.gstatic.com https://www.google-analytics.com https://tagmanager.google.com https://www.googletagmanager.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'unsafe-inline' 'unsafe-eval'; connect-src https://sessions.bugsnag.com *.medallia.com *.kampyle.com api.segment.io *.segment.com *.todo1.com *.newrelic.com bam.nr-data.net https://www.google-analytics.com www.google-analytics.com tagmanager.google.com *.hotjar.com *.hotjar.io *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self'; img-src https://hexagon-analytics.com *.medallia.com *.kampyle.com images-cdn.info https://www.google-analytics.com www.google-analytics.com https://www.google.com *.gstatic.com *.cloudbancolombia.com *.bancolombia.com *.todo1.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self' data:; style-src 'self' *.medallia.com *.kampyle.com 'unsafe-inline' 'unsafe-eval' https://tagmanager.google.com https://fonts.googleapis.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com; frame-src 'self' https://checkout.wompi.co *.medallia.com *.kampyle.com https://www.google.com/ https://*.googleapis.com https://*.gstatic.com *.salesforce.com *.force.com *.visualforce.com *.cloudbancolombia.com *.bancolombia.corp *.bancolombia.com *.transaccionesbancolombia.com *.hotjar.com https://stags.bluekai.com https://www.facebook.com data: blob:; font-src https://*.gstatic.com 'self' data:
access-control-allow-origin: https://c.na7.visual.fo.todo1.com
cf-cache-status: REVALIDATED
expires: Thu, 02 Mar 2023 22:36:00 GMT
cache-control: public, max-age=14400
set-cookie: __cf_bm=wmKWV36VJjgxfuzkr7tOLWbFqiZMDixKbZ3wedh0jk4-1677782160-0-ASlgwjsZihHHbgtMtVlfWXrP0a1JqKbHrRy7Wd2xumoklon+fr0VUTynLTQ6TRFE6iw3NlFAYqBeyMpJ/QkXw/0=; path=/; expires=Thu, 02-Mar-23 19:06:00 GMT; domain=.transaccionesbancolombia.com; HttpOnly; Secure; SameSite=None __cflb=02DiuF7aX6zsQEVJrpLFnY2iwbTBSnCE6ANV3FFKzKMmW; SameSite=Lax; path=/; expires=Fri, 03-Mar-23 17:36:00 GMT; HttpOnly
vary: Accept-Encoding
server: cloudflare
cf-ray: 7a1bbe25ce3cdc2d-LHR
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: