{"report_id":"bcfe4e4f-519c-4a6a-83f4-3ccc80bbb26e","version":6,"status":"done","tags":["bancolombia","financial","phishing"],"date":"2026-01-06T14:23:28Z","url":{"schema":"http","addr":"bancolombiacreditodirecto.zeabur.app","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"zeabur.app","tld":"app"},"ip":{"addr":"43.159.166.10","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/a/login.php","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"title":"Bancolombia Sucursal Virtual Personas","dom":{"size":103198,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (39750)","md5":"2ae49e6246dcacd3d2bf7b293d8bca68","sha1":"54e7fc97e6db31350290aa5e72863466da5b2efa","sha256":"3dc49ea09467f2d44cb01a549dc8bd1cafa99e83f7d200a9639bf31a4ea30b56","sha512":"ff2fd19a9e63ef6088259d92af32dd9ff904728789761e034f5f0dd43277984954bdca185fd8947f99c0dfdf323296d7a67126b27e8c67c8513b432d4d3d40d5","ssdeep":"1536:neUO6kCtRrM1MvMaMfMRQdm0grfT/QypZhzZHp6jA691rP:OYIlgrLXzZJo191r","tlshash":"eba3fc065e88415bb0594c7f7881bf346af2eb195ad14895f1396d807ef38ae318fb32","dom_hash":"domhash85594a80e51610c9819ad05745b45287","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"bancolombiacreditodirecto.zeabur.app","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"zeabur.app","tld":"app"},"ip":{"addr":"43.159.166.10","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-10T14:23:28Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"images-cdn.info","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"images-cdn.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"images-cdn.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"images-cdn.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]},"summary":[{"fqdn":"ka-f.fontawesome.com","ip":{"addr":"172.67.139.119","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-10-18","domain_rank":58377,"first_seen":"2019-12-17T06:36:13Z","last_seen":"2026-01-05T04:31:07.491285Z","alert_count":0,"request_count":4,"received_data":102046,"sent_data":2151,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-04T22:17:15.216142Z","alert_count":0,"request_count":1,"received_data":12714,"sent_data":491,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"kit.fontawesome.com","ip":{"addr":"104.18.40.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-10-18","domain_rank":16651,"first_seen":"2019-03-29T02:12:52Z","last_seen":"2026-01-05T00:42:08.5129Z","alert_count":0,"request_count":1,"received_data":15812,"sent_data":493,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"bancolombiacreditodirecto.zeabur.app","ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"domain_registered":"2022-09-27","domain_rank":0,"first_seen":"2026-01-06T03:39:09.81484Z","last_seen":"2026-01-06T03:39:09.81484Z","alert_count":72,"request_count":24,"received_data":860695,"sent_data":11886,"comment":"","tags":null,"fingerprints":[{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]}]},{"fqdn":"images-cdn.info","ip":{"addr":"52.21.2.28","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2018-02-25","domain_rank":1983003,"first_seen":"2020-06-19T23:31:03Z","last_seen":"2026-01-06T03:39:10.247417Z","alert_count":4,"request_count":1,"received_data":300,"sent_data":459,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"72c849f4e961e28f1b808e494aeb74fc","sha1":"fc8dac259db80d9b7726d9879c87bf215da0c998","sha256":"e9a8b6953d544e0ecbcaceb9bf82f0d6fff65278545f11d0ee580072e52a66b1","sha512":"8a7283ddd117af134b92deaeb88909e9a434a2675d0cbc5af60ca0bfb61a7f0d228c428e75f10f29e175c05eff4762b39b5f6dfc092c666bf257c0f0ce0bba5d","ssdeep":"","tlshash":"f5a0220b203e30e32002e0ac382f0020eeb2c0bf0c28cbc0800a0880b8802380232e8c","size":73,"data":"","first_seen":"2023-03-07T12:11:26Z","last_seen":"2026-06-14T13:31:18.865811Z","times_seen":795,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/jquery.jclock-min.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"71722c7314fed201941f23bc1fe9604e","sha1":"1d1c35c3b25ea4056bd39ba290523e70bd2f8038","sha256":"93bf1714fd8d4cad23861f0017d5b3335f8b009f59d2bd654dcf0c29b7f36031","sha512":"f0c56d414d56bcb50a3264783781dedfb7401a553069a2d96b6b62289fb4246dc1fe601a6fdb8acd069e43c382788592ceafcc31ce799f6c1cc1025ca89ce6ea","ssdeep":"","tlshash":"f161366d307856a52abf6439387f0363ca2a5d36080af56c7d4f96c0686c85f94bbf70","size":3337,"data":"","first_seen":"2023-03-07T12:11:26Z","last_seen":"2026-06-14T13:31:18.860145Z","times_seen":716,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/jquery-3.6.0.min.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-07-27T03:51:13.658413Z","times_seen":494473,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/ready.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"e1e43873eee1eb287ba027da6f43c62b","sha1":"38a391a475f595fd6a3a77e803b5f0575727461c","sha256":"a213383b1b2b09366a7705aa520ea1914acf8b0edab2a8ce685af4875ac4146a","sha512":"53361bb8cba2cbf8ce9aeadcc86b98f5639228042eda8bb388a59dfe45c98e71f882504fec54f4ae1d01bdd767c786eef2363717811ded5c7d073a375181da75","ssdeep":"192:cugb0dgtVqhPhqBOy8n83prMg4nZwgoGh/og8hA1B:cugbDVqhPhqBG83prMg4nagoyggIM","tlshash":"0fb29a1cf118035895fb72318d66c60adf75842f4426ae54bd6c9dc46f3dfbaca82e09","size":25003,"data":"","first_seen":"2024-11-22T16:10:23.428854Z","last_seen":"2026-06-14T13:31:18.860789Z","times_seen":95,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/a/login.php","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"72c849f4e961e28f1b808e494aeb74fc","sha1":"fc8dac259db80d9b7726d9879c87bf215da0c998","sha256":"e9a8b6953d544e0ecbcaceb9bf82f0d6fff65278545f11d0ee580072e52a66b1","sha512":"8a7283ddd117af134b92deaeb88909e9a434a2675d0cbc5af60ca0bfb61a7f0d228c428e75f10f29e175c05eff4762b39b5f6dfc092c666bf257c0f0ce0bba5d","ssdeep":"","tlshash":"f5a0220b203e30e32002e0ac382f0020eeb2c0bf0c28cbc0800a0880b8802380232e8c","size":73,"data":"","first_seen":"2023-03-07T12:11:26Z","last_seen":"2026-06-14T13:31:18.865811Z","times_seen":795,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/functions.js?v1","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5de2174c1416a7109101f47c1ada42df","sha1":"3c6d474c191862634de02876d55ae298e7c78e34","sha256":"fa41971985dea092b3f122ff8f185774f329e308eb4ffde4049bdb79f4c1248a","sha512":"74c9a85cf92606c09944b5b3f9a81f26c665577a461179ff02f92248c46a10f4f4d0ba1a72c55a90dea3e3e409d535eb408598891078bd285175b5a414093409","ssdeep":"","tlshash":"2a71f59d6006100916f36f355a1b7204e8b340a74f1da800bd5cced4af3c7bf9aa6ead","size":3604,"data":"","first_seen":"2025-12-29T10:24:05.584096Z","last_seen":"2026-05-09T03:07:33.781173Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/jquery-3.6.0.min.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-07-27T03:51:13.658413Z","times_seen":494473,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/ready.js?v2","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e1e43873eee1eb287ba027da6f43c62b","sha1":"38a391a475f595fd6a3a77e803b5f0575727461c","sha256":"a213383b1b2b09366a7705aa520ea1914acf8b0edab2a8ce685af4875ac4146a","sha512":"53361bb8cba2cbf8ce9aeadcc86b98f5639228042eda8bb388a59dfe45c98e71f882504fec54f4ae1d01bdd767c786eef2363717811ded5c7d073a375181da75","ssdeep":"192:cugb0dgtVqhPhqBOy8n83prMg4nZwgoGh/og8hA1B:cugbDVqhPhqBG83prMg4nagoyggIM","tlshash":"0fb29a1cf118035895fb72318d66c60adf75842f4426ae54bd6c9dc46f3dfbaca82e09","size":25003,"data":"","first_seen":"2024-11-22T16:10:23.428854Z","last_seen":"2026-06-14T13:31:18.860789Z","times_seen":95,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"5f021a6f8aa3bbdca4a6740329ef1255","sha1":"a4540efb5c6ac528bbc1489bf8dff965e1731155","sha256":"82c693fe6348eeb82669dfd9110cf128bca9611240fb60454a153ed7beaf13d0","sha512":"087c1941c5596441cf66549b177e29f17e2b3d79a902c872cc1eb6b07b409a107b00bc33fc9c58afcbef139fd8655f9ebfa07c9ae8a5a88b81b4623ea11e9859","ssdeep":"","tlshash":"84b0126d20dd0104097320140ea77100343370a72009d940bb1c99900f1c31e4157644","size":122,"data":"","first_seen":"2025-04-07T10:58:28.402253Z","last_seen":"2026-04-01T02:45:03.877614Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/jquery.jclock-min.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"71722c7314fed201941f23bc1fe9604e","sha1":"1d1c35c3b25ea4056bd39ba290523e70bd2f8038","sha256":"93bf1714fd8d4cad23861f0017d5b3335f8b009f59d2bd654dcf0c29b7f36031","sha512":"f0c56d414d56bcb50a3264783781dedfb7401a553069a2d96b6b62289fb4246dc1fe601a6fdb8acd069e43c382788592ceafcc31ce799f6c1cc1025ca89ce6ea","ssdeep":"","tlshash":"f161366d307856a52abf6439387f0363ca2a5d36080af56c7d4f96c0686c85f94bbf70","size":3337,"data":"","first_seen":"2023-03-07T12:11:26Z","last_seen":"2026-06-14T13:31:18.860145Z","times_seen":716,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/a/login.php","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3ad13bb8ddafadce00651b2a3b11b160","sha1":"36e7483d66f26d3a096b7ada8116a09fcc674244","sha256":"a992f73eb5cb0ec2c709b7cb18f9bae74d1c6beaa3a46cca4360bb9ffd1adca2","sha512":"d75fdbacf80744660d514e9c72a41957b9da53c713c99d9c58feda65c02f0d731e7473fcfdec88b69619de97b8de6c7d3e86295ab266cd5525a74e0c3f5f67d3","ssdeep":"","tlshash":"36a00229705c7100053331341c27950469237427210298403a4c64d00f297144506904","size":68,"data":"","first_seen":"2025-11-17T01:45:59.493208Z","last_seen":"2026-05-09T03:07:33.808995Z","times_seen":38,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kit.fontawesome.com/45b9078c9f.js","fqdn":"kit.fontawesome.com","domain":"fontawesome.com","tld":"com"},"ip":{"addr":"104.18.40.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"204d14aeef728724788a52da3985fe47","sha1":"8d93886d354d997e3413ea4d1f95cfc565de312b","sha256":"60de65ec6d827b1c30278dbee917b6a8783ee54d4f49c1880291bdf00fd62f35","sha512":"89c3ca3a92edd2baea15976cc21dbe9c5db1e5756b20c4af08da7e1a4d809bf89a42bdbc7dc94bd76d94914b51e0bceb7f7f202875d1e4c44803c2c33869065b","ssdeep":"192:FkGliHAgdNpCpjebuSRDIbCpgeMvhhvlLoN6IQEZcJZuKwPXUxbUmVvh3uYXyl8o:FkKCClPCChhtqVUMFw1h3uYXyl8Y1e6","tlshash":"0362f91d7a81b43a86af7192843f670fb275353b30129461e25cd9e46c7ce9ea123f1d","size":15204,"data":"","first_seen":"2026-01-02T06:14:41.669964Z","last_seen":"2026-01-07T21:05:45.342849Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/jquery-3.6.0.min.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bancolombiacreditodirecto.zeabur.app/","date":"2026-01-06T14:23:08.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /js/jquery-3.6.0.min.js HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Tue, 06 Jan 2026 14:23:08 GMT\r\netag: \"69594405-15d9d\"\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nserver: nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\nx-zeabur-request-id: sjc1::bb3ed06c-39ff-43c0-8f95-2d7c27385c0d\r\ncontent-length: 89501\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89501,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-07-27T03:51:13.658413Z","times_seen":494473,"resource_available":true,"data":null}},"time_used":510,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":356,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/run.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bancolombiacreditodirecto.zeabur.app/","date":"2026-01-06T14:23:08.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /js/run.js HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Tue, 06 Jan 2026 14:23:08 GMT\r\nserver: nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\nx-zeabur-request-id: sjc1::840f9792-db28-4cb3-9d04-98e16dd82cc3\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T03:50:56.498462Z","times_seen":17555199,"resource_available":true,"data":null}},"time_used":510,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":510,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/ready.js?v2","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /js/ready.js?v2 HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 25003\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\netag: \"69594405-61ab\"\r\naccept-ranges: bytes\r\nserver: nginx\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nx-content-type-options: nosniff\r\nx-zeabur-request-id: sjc1::c95e969f-cf25-4f0c-8043-e20a39d9e9bc\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":25003,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"e1e43873eee1eb287ba027da6f43c62b","sha1":"38a391a475f595fd6a3a77e803b5f0575727461c","sha256":"a213383b1b2b09366a7705aa520ea1914acf8b0edab2a8ce685af4875ac4146a","sha512":"53361bb8cba2cbf8ce9aeadcc86b98f5639228042eda8bb388a59dfe45c98e71f882504fec54f4ae1d01bdd767c786eef2363717811ded5c7d073a375181da75","ssdeep":"192:cugb0dgtVqhPhqBOy8n83prMg4nZwgoGh/og8hA1B:cugbDVqhPhqBG83prMg4nagoyggIM","tlshash":"0fb29a1cf118035895fb72318d66c60adf75842f4426ae54bd6c9dc46f3dfbaca82e09","first_seen":"2024-11-22T16:10:23.428854Z","last_seen":"2026-06-14T13:31:18.860789Z","times_seen":95,"resource_available":true,"data":null}},"time_used":447,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":292,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"images-cdn.info/444/image.gif","fqdn":"images-cdn.info","domain":"images-cdn.info","tld":"info"},"ip":{"addr":"52.21.2.28","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:10.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images-cdn.info","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 14 Nov 2025 22:59:56 GMT","end":"Thu, 12 Feb 2026 22:59:55 GMT"},"fingerprint":{"sha1":"47:EC:49:25:A6:91:75:4B:57:FD:24:52:7B:8A:06:FA:AD:9C:75:C7","sha256":"0C:67:BF:BF:75:2C:46:90:74:6D:24:69:70:53:CF:1F:F2:C0:CC:33:A9:0C:06:55:7B:C2:DB:31:46:3A:B5:1D"}}},"request":{"raw":"GET /444/image.gif HTTP/1.1\r\nHost: images-cdn.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/gif\r\nserver: envoy\r\nvary: Origin\r\ndate: Tue, 06 Jan 2026 14:23:12 GMT\r\ncontent-length: 42\r\nx-envoy-upstream-service-time: 2210\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":42,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-07-27T03:51:31.328826Z","times_seen":1010106,"resource_available":true,"data":null}},"time_used":2702,"timings":{"blocked":198,"dns":1,"connect":94,"send":0,"wait":2305,"receive":1,"ssl":101},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"images-cdn.info","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"images-cdn.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"images-cdn.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"images-cdn.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/fonts/opensans/CIBFontSans-Light.ttf","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:10.326Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /fonts/opensans/CIBFontSans-Light.ttf HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/css/stylesheet.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/octet-stream\r\ncontent-length: 110612\r\nx-zeabur-ip-country: \r\netag: \"69594405-1b014\"\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nx-frame-options: SAMEORIGIN\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 14:23:10 GMT\r\nx-content-type-options: nosniff\r\nx-zeabur-request-id: sjc1::2e8b9110-2cb7-4ebe-97d1-d55668251a3e\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":110612,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 18 tables, 1st \"DSIG\", 33 names, Macintosh, Copyright (c) 2019 by Vasava Studio. All rights reserved.\tCIBFont SansLight1.300;UKWN;CIBFontSan","md5":"69096387df83ff65381f8ee25006b0aa","sha1":"89689ed7f7547a3815d9fa2d0a2c11513480086e","sha256":"decf1c3cb09b3e38d867e0d5cf648220584404c9cf8d18a6c51bdfa2af5047cc","sha512":"37aac063f5b5fb01f5e02497ec70e01ea7837feeb4167c5e8820cf02167445f4df90305db680568f45137de3e70c90a15bac5b723df0d83c6fdf390d0ce59d35","ssdeep":"3072:Po1/vxSHr+yjrdSiQTuicg4D47RiDEU3nlKXjY:PolO+8jiBDRiDE3X8","tlshash":"5ab37d07f353e609d41a8e381472d766f7e5b43aaf7b034b657a6539fcca5e08c2a180","first_seen":"2023-04-05T04:08:00Z","last_seen":"2026-06-13T09:58:15.918805Z","times_seen":1004,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":156,"receive":121,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/img/ico-u.jpg","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.611Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /img/ico-u.jpg HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-zeabur-request-id: sjc1::c4dfae5a-0350-469a-bac8-04be92177191\r\ncontent-length: 2810\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\netag: \"69594405-afa\"\r\nx-content-type-options: nosniff\r\nserver: nginx\r\ncontent-type: image/jpeg\r\naccept-ranges: bytes\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2810,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 63x63, components 3","md5":"fed5a59a7026be0e995872254bf433d7","sha1":"e14bcb4b66323873bfd6a50de74fbb215dfd7b8a","sha256":"ec20346782562801faae510a8e80579566b41c55eabbb223825eeda40e4dfb5c","sha512":"c8b79ef3d4889222c04f3bf5659fe28e76283453cc6809c91fa80b02ba07dc52cc411a2cbec1468136c4065a204f80a828162e242d32b1298f5eebeffe516164","ssdeep":"","tlshash":"85512935cb134c77e8fb1f70bf68e67591a82c143045d69f34952f89eaa10911ac4734","first_seen":"2025-01-15T12:57:33.210456Z","last_seen":"2026-05-09T03:07:33.804503Z","times_seen":43,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":174,"receive":106,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/css/fonts.css","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bancolombiacreditodirecto.zeabur.app/","date":"2026-01-06T14:23:08.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /css/fonts.css HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Tue, 06 Jan 2026 14:23:08 GMT\r\nserver: nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\nx-zeabur-request-id: sjc1::38776fb8-faca-4df8-9cd8-b379dc59e467\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T03:50:56.498462Z","times_seen":17555199,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/jquery-3.6.0.min.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /js/jquery-3.6.0.min.js HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\netag: \"69594405-15d9d\"\r\naccept-ranges: bytes\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nx-zeabur-request-id: sjc1::2a54e077-8c8e-4c74-80c2-9578f93d3f9b\r\nx-content-type-options: nosniff\r\nx-zeabur-ip-country: \r\ncontent-length: 89501\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: application/javascript; charset=utf-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":89501,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-07-27T03:51:13.658413Z","times_seen":494473,"resource_available":true,"data":null}},"time_used":602,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":445,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/css/layout.css","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bancolombiacreditodirecto.zeabur.app/","date":"2026-01-06T14:23:08.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /css/layout.css HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Tue, 06 Jan 2026 14:23:08 GMT\r\nserver: nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\nx-zeabur-request-id: sjc1::df8d9361-beff-42c8-a93a-a2a5f763d49e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T03:50:56.498462Z","times_seen":17555199,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/img/load2.gif","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.604Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /img/load2.gif HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\netag: \"69594405-148c1\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncontent-length: 84161\r\nx-zeabur-request-id: sjc1::fed38099-7a69-4aad-8fdb-46379ff6ddd4\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver: nginx\r\ncontent-type: image/gif\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\naccept-ranges: bytes\r\nx-zeabur-ip-country: \r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":84161,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 98 x 98","md5":"edba91d36ea2c27dc4b1816a97e69dc0","sha1":"66b4c78d96cfb26fb652fbb83817284e367d6916","sha256":"3948d809ecb004386fb76288a98d0e1e91eabb075de90f288c8a9d37a73fcd02","sha512":"9eeb4d00e6f83638a34705dfb3ff028af2ef5f21ea29fa8223e3d41e3d27e2242c6cbe61af99c94ae7c42215fa270157637ed80172f88e25d8dea3c002e23ada","ssdeep":"768:ePqgQMM71vLPqgQp7003HCaGsAPhgHka:+o5joqogRk","tlshash":"9d83ea15c122804ff10b26b53b220ea38af89d587496d3177f44bbef12f7d9654f4aa2","first_seen":"2023-05-11T18:57:57Z","last_seen":"2026-05-09T03:07:33.782458Z","times_seen":79,"resource_available":false,"data":null}},"time_used":594,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":405,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ka-f.fontawesome.com/releases/v6.7.2/css/free-v4-font-face.min.css?token=45b9078c9f","fqdn":"ka-f.fontawesome.com","domain":"fontawesome.com","tld":"com"},"ip":{"addr":"172.67.139.119","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:10.283Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ka-f.fontawesome.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Dec 2025 02:24:19 GMT","end":"Mon, 16 Mar 2026 03:24:16 GMT"},"fingerprint":{"sha1":"10:37:4B:A2:03:B2:49:7B:74:EE:F5:0F:E4:6F:20:31:F4:40:E6:40","sha256":"FF:BB:59:CA:F2:7C:B0:C5:C3:4F:A0:3A:15:57:65:B0:B1:D4:85:84:06:A0:CB:80:9C:53:7F:C1:24:0C:17:74"}}},"request":{"raw":"GET /releases/v6.7.2/css/free-v4-font-face.min.css?token=45b9078c9f HTTP/1.1\r\nHost: ka-f.fontawesome.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nOrigin: https://bancolombiacreditodirecto.zeabur.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 14:23:10 GMT\r\ncontent-type: text/css\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccess-control-max-age: 3000\r\nlast-modified: Mon, 16 Dec 2024 16:06:36 GMT\r\netag: W/\"3e20aa01a74cb21290faa04e29684ce4\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: max-age=31556926\r\nserver: cloudflare\r\naccess-control-allow-headers: fa-kit-token\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 e6220bd7bee9300eb5b87a282645e6ec.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: YsNHJO-89flKUp8dKVfaH5yMMkE3HB9gRH3LTpm1LVmZ8HqVMhPyXQ==\r\nage: 38665\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=olv7uo29MK2FdHU56n1ubZrV5%2BYoYNlq8vyGmV1xqQdTlvLoNOy5nRWzA4ckLya2fCDobcLPWsCO%2BUqXYeryxYfuc9jRg0yit5z5Wmc4CpcTsg%3D%3D\"}]}\r\ncf-ray: 9b9bdf29ce23b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1775,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1560)","md5":"3e20aa01a74cb21290faa04e29684ce4","sha1":"9279c7200c52d95369427e5a9dd013a327e4c8b3","sha256":"e855bc2e1c23e76ebb884cb182a037c64af2cacc49eac782dd43fa0454ee1f27","sha512":"22dbdda00c128ae18ee4f2c09d6d2316bfacc58fea0749207905cdcad0fe1c3725754200d9182916d3e08e2a333c15de9d8f143fcdc482ead539fef21ccbb147","ssdeep":"","tlshash":"2231f02846d401b0b0313f193ac77125eeae74669bb95e63d62b88140dfec55f3d5f48","first_seen":"2025-04-07T02:17:37.738288Z","last_seen":"2026-07-27T03:28:02.263477Z","times_seen":6798,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":84,"dns":47,"connect":4,"send":0,"wait":8,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Open+Sans:wght@700;800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=Open+Sans:wght@700;800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 06 Jan 2026 14:23:09 GMT\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12028,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"9b3eaa7d392ca463e536941006caad51","sha1":"54cd84a181084b930f471b5e67137fc849e0934c","sha256":"a3df021d4f09c37d780dcc66a96666508128d5ab95ca15f253180a718b52aac1","sha512":"62af34a8661dce5196688ef1c9435c48a19d281071b548bdff1012f8133ab3aeae1c9ad853e55e937177918839977998f09785103368abe4d6fd501900f31b2a","ssdeep":"192:LC77u2mIrqUnbqGIwV4y9ztfCWWD2LBrqVnbqGIwV4/Mz8Y:uuOqY4VptqY46","tlshash":"ff421b9000171850aa475de233ce7e34ee0f92667044c0ba6bfd8b9bdedad6963b431d","first_seen":"2025-09-21T20:45:54.060249Z","last_seen":"2026-06-27T01:09:29.210862Z","times_seen":62,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":52,"dns":1,"connect":7,"send":0,"wait":18,"receive":0,"ssl":61},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/css/stylesheet.css","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.591Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /css/stylesheet.css HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\netag: \"69594405-b82\"\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\ncontent-type: text/css\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nx-zeabur-ip-country: \r\ncontent-length: 2946\r\nx-zeabur-request-id: sjc1::936798d6-0c86-4f85-8561-5409dd9788cd\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":2946,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (360)","md5":"a310982fb888be050fb3ab09d40d7ffc","sha1":"b4a86966fec0a29c9bae72c1279a762cc009bf21","sha256":"f27f79e97e6af6f6003291117a51ded4ac0271248d26e5acf840f666d12d38b2","sha512":"13df75f25b4827fa911f8700005d3c48d7acfb68ea4de57f244ac720b80e3bdfaf2fc4e36dfe795ca314a19cf4a38fb696d4501a934f91e21d11b9163b7d3b69","ssdeep":"","tlshash":"e1514960d14a799345583c5733db7f244f8d286670048457a23489afecf2a6a92d6f0f","first_seen":"2023-04-05T04:08:00Z","last_seen":"2026-05-09T03:07:33.796606Z","times_seen":611,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/css/style-app.css?v2","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /css/style-app.css?v2 HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nx-zeabur-request-id: sjc1::2cb13a56-b6dd-4dc5-b29e-32965d9a0844\r\netag: \"69594405-21c8\"\r\nx-zeabur-ip-country: \r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\ncontent-length: 8648\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver: nginx\r\ncontent-type: text/css\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":8648,"size_decoded":0,"mime_type":"text/css","magic":"assembler source, ASCII text, with CRLF line terminators","md5":"1afef4a728bfb40fc4d189e7607fee42","sha1":"98f74aa6113bfff6c9f8b07b45ab337e0bca1987","sha256":"6b196ad86d52ff1cc5c4e87174d443c68de2b1c748676d44ab57b0ca2e07ab24","sha512":"680da288a85e1c9ba61f930e9cc814d3596d1959ad39d3c415ebaab947e2521442c8129fcdbaa08e15953b955ebd2ce304423053dc7511e2f23e9cce22ac8457","ssdeep":"192:/IBjV7qfL2WtnQ8f43fBeSCF8Bu1GyWQg2k:U57KhP16L","tlshash":"cd021219de4b018bb23664a9fb726f66ed680003970b47717ae073129fb51b85a647cc","first_seen":"2024-11-22T16:10:23.424148Z","last_seen":"2026-05-09T03:07:33.798598Z","times_seen":68,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/img/logo.svg","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /img/logo.svg HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\nx-frame-options: SAMEORIGIN\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7020\r\nx-zeabur-ip-country: \r\nserver: nginx\r\ncontent-type: image/svg+xml\r\nx-zeabur-request-id: sjc1::47258713-b175-493f-a2d5-e216cc161ca2\r\netag: \"69594405-1b6c\"\r\naccept-ranges: bytes\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":7020,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c049dccd21049cb237daabdb645ec648","sha1":"e29af3f65a8312efd3ea4c3b66d4bd86657dde1b","sha256":"2c7a6ea74a49a6adc3fad622078895e9b2589448214913d8c035764148aca7d0","sha512":"844c7a9d9b8863e1b7b7cd5aadee4ee65f7ac48a8b4b603ca57bf18662c0d331057dc19f5c72ca69f6cabe402f20bd7cc9ad8cad7717ea17ba0d89e63f2bc24d","ssdeep":"192:T2qGoTy+MilvndjzUy+3TIq9YCdXkY/rPCu:TQKgw6/D","tlshash":"04e176ed33b0c6d06c43e7f5ca2a11f9316a68fd5bc7d69582b0ed8575502b9488ccc6","first_seen":"2023-05-03T14:04:56Z","last_seen":"2026-07-26T11:39:30.697704Z","times_seen":861,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":173,"receive":160,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/img/btn-cerrar.jpg","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /img/btn-cerrar.jpg HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4384\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nx-zeabur-request-id: sjc1::9778f002-95fe-420e-aed9-7d86d260a925\r\netag: \"69594405-1120\"\r\nx-frame-options: SAMEORIGIN\r\ncontent-type: image/jpeg\r\nx-content-type-options: nosniff\r\nserver: nginx\r\naccept-ranges: bytes\r\nx-zeabur-ip-country: \r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4384,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 181x71, components 3","md5":"cd5317f7798c33d7d213afdd15a7d8c0","sha1":"228c39b621d187b43132c86c8f9a7d09f0883dd6","sha256":"c6f44dbcbdecb0ce867f3d73355ae4db97d5bd32d30aa93d27df890fab59250c","sha512":"f4be7d0c6959024ac0a8f1f75390a5e6a16f866dad1f51271c1b26f00773f1b37860714b07ef1779fd5a019821673f434bbee9246fb1d33e95ab8cf09010f2f7","ssdeep":"96:rD9AvFSpw4MvfrdMZkKhHIkN6N/6xf6NafJ8GNgw7a1nP:rDfpi3fK6g6N/1U6w7UnP","tlshash":"bc912a6994b38943c3701e370b5056be2650fcd1e23682a70dd4bfcaecb3d93596c266","first_seen":"2025-01-15T12:57:33.208856Z","last_seen":"2026-05-09T03:07:33.784775Z","times_seen":50,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":187,"receive":119,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/img/logo-app.jpg","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.608Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /img/logo-app.jpg HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ncontent-type: image/jpeg\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\nx-zeabur-request-id: sjc1::ccf65e90-6da7-433a-8270-3e73c08e5d42\r\netag: \"69594405-e0f\"\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3599\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":3599,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 79x71, components 3","md5":"b99c33631de8eaccdadf7f5774635bac","sha1":"ba977adcafa855eac2dd77fe1e1a3682fd898d08","sha256":"2e2650f0142ed7886f37eba5d7a1ec55958db545ffbf163feffb92ce3cf8530c","sha512":"eb90921de53662c1398a6ef0edb763cd0bccf79fb99631da1db6a342c54ea29fcf6054e3f203f70228015375a0bb2599bbdeb8cf6a5491698ebfdb6d45a50a7c","ssdeep":"","tlshash":"cc717e19581791abf6fab7fd201ef42bd3b2937c2d31cc183c12981acc51145aa60989","first_seen":"2025-01-15T12:57:33.213916Z","last_seen":"2026-05-09T03:07:33.802007Z","times_seen":45,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":187,"receive":106,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/img/btn-continuar-off.jpg","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /img/btn-continuar-off.jpg HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\nx-zeabur-request-id: sjc1::f95bdce9-c377-4c26-97f7-486aa705e411\r\nx-frame-options: SAMEORIGIN\r\nserver: nginx\r\ncontent-length: 4190\r\netag: \"69594405-105e\"\r\nx-zeabur-ip-country: \r\ncontent-type: image/jpeg\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":4190,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 250x71, components 3","md5":"6928f4e09ed532c1c6d00ca270232784","sha1":"cceadbb01d63bace49e0008f07bd1ab174349209","sha256":"cfe3a253e151120ce141e3bcbdc7d6f51f7fee091912b7ff37f1391f6987860b","sha512":"b399b5b4548413566a8e7adceaf692a26dc19201b1da48fa470f5cb355000ab4d4270b7d6bc9c22acddc41d727a8687f8c10654fd905fc16cf131657629ac50f","ssdeep":"96:DBNLhstdlYiIbTMQpgT5dXDXi8nC81UuIYHM9l47M+j6E3BXS:FNLWdlYhnMQGT5dE8+uIoIS7Mog","tlshash":"f4812bad8f0d3775ccb241714d3e9560a706a3061da1450f163adcecee5bc861623b97","first_seen":"2025-01-15T12:57:33.216483Z","last_seen":"2026-05-09T03:07:33.805909Z","times_seen":44,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":144,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ka-f.fontawesome.com/releases/v6.7.2/css/free-v4-shims.min.css?token=45b9078c9f","fqdn":"ka-f.fontawesome.com","domain":"fontawesome.com","tld":"com"},"ip":{"addr":"172.67.139.119","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:10.277Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ka-f.fontawesome.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Dec 2025 02:24:19 GMT","end":"Mon, 16 Mar 2026 03:24:16 GMT"},"fingerprint":{"sha1":"10:37:4B:A2:03:B2:49:7B:74:EE:F5:0F:E4:6F:20:31:F4:40:E6:40","sha256":"FF:BB:59:CA:F2:7C:B0:C5:C3:4F:A0:3A:15:57:65:B0:B1:D4:85:84:06:A0:CB:80:9C:53:7F:C1:24:0C:17:74"}}},"request":{"raw":"GET /releases/v6.7.2/css/free-v4-shims.min.css?token=45b9078c9f HTTP/1.1\r\nHost: ka-f.fontawesome.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nOrigin: https://bancolombiacreditodirecto.zeabur.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 14:23:10 GMT\r\ncontent-type: text/css\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccess-control-max-age: 3000\r\nlast-modified: Mon, 16 Dec 2024 16:06:36 GMT\r\netag: W/\"43c494a755b81101cd0097c73bf4bd42\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: max-age=31556926\r\nserver: cloudflare\r\naccess-control-allow-headers: fa-kit-token\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 53019ee090f087ca6c6fa860098bcd80.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: xnTRg4nAKvqKMYQPj3yGXTwnudLW6K7xWg4i_Pk_Wg1-N50OsFYDMA==\r\nage: 38665\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7jiwcTkwISbGffLWmCNtsJY9QgjG%2BFMIj1P4M05j6DxRs4sfIv%2FTALJjcvq1WjeO50aDJRjl%2FvnqMfSG7Lo6ebYIuNkvXOzazxJlf2VP3L8ZYQ%3D%3D\"}]}\r\ncf-ray: 9b9bdf29ce22b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":21210,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (20995)","md5":"43c494a755b81101cd0097c73bf4bd42","sha1":"f4102ef32474a0629d2989a777ee5e738af6a6ec","sha256":"c723bc4b9c56380b5ccc209f6c288c26028e2ecad0d27795f665fb01a9f4e9ac","sha512":"7839dd420acce148a9ca85b74bdf7995ce7640eeb0cfacc26eb83e78154b0a59e7ea0ddfe63ebb6becec3b2821b53696a1120c3edcf720d2fe870697bd61418a","ssdeep":"384:/Wl6sTnnbF+PJeQlGngUHPAHyw5+E9mu1t:/O60OJigUHPAHyCtb","tlshash":"199258051b2d90a3b2dc3c6bb4417ee42776278919d64c51e3273c84bee789b31eeb61","first_seen":"2024-12-18T04:50:29.505919Z","last_seen":"2026-07-27T03:28:02.248633Z","times_seen":7236,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":90,"dns":52,"connect":3,"send":0,"wait":8,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/jquery.jclock-min.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bancolombiacreditodirecto.zeabur.app/","date":"2026-01-06T14:23:08.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /js/jquery.jclock-min.js HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Tue, 06 Jan 2026 14:23:08 GMT\r\netag: \"69594405-d09\"\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nserver: nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\nx-zeabur-request-id: sjc1::6fd082e1-23bc-4472-a951-9e9615edb2a1\r\ncontent-length: 3337\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":3337,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2957), with CRLF line terminators","md5":"71722c7314fed201941f23bc1fe9604e","sha1":"1d1c35c3b25ea4056bd39ba290523e70bd2f8038","sha256":"93bf1714fd8d4cad23861f0017d5b3335f8b009f59d2bd654dcf0c29b7f36031","sha512":"f0c56d414d56bcb50a3264783781dedfb7401a553069a2d96b6b62289fb4246dc1fe601a6fdb8acd069e43c382788592ceafcc31ce799f6c1cc1025ca89ce6ea","ssdeep":"","tlshash":"f161366d307856a52abf6439387f0363ca2a5d36080af56c7d4f96c0686c85f94bbf70","first_seen":"2023-03-07T12:11:26Z","last_seen":"2026-06-14T13:31:18.860145Z","times_seen":716,"resource_available":true,"data":null}},"time_used":510,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":510,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/fonts/opensans/OpenSans-Regular.ttf","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:10.319Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /fonts/opensans/OpenSans-Regular.ttf HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/css/stylesheet.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\netag: \"69594405-350bc\"\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ndate: Tue, 06 Jan 2026 14:23:10 GMT\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nserver: nginx\r\nx-zeabur-request-id: sjc1::ae2c6548-844c-4e31-bdd3-937b1074a8f3\r\nx-zeabur-ip-country: \r\ncontent-type: application/octet-stream\r\ncontent-length: 217276\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":217276,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 19 tables, 1st \"DSIG\", 26 names, Macintosh, Digitized data copyright � 2010-2011, Google Corporation.Open SansRegular1.10;1ASC;OpenSans-Regu","md5":"d7d5d4588a9f50c99264bc12e4892a7c","sha1":"513966e260bb7610d47b2329dba194143831893e","sha256":"13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8","sha512":"ce9f98208cd818e486a12848b2d64bd14e12d42d84b2e47436a3c4420a242583eefc4a9b42401b51cc204146c6133645975682e4bb5d48527b3796770efa3397","ssdeep":"6144:GLpzdD/rIJXiQTutgCNktQFvmnoxXTS4u8sl:c9FrIJJaqCNktA+SXfJsl","tlshash":"62242879b20139e6df11d4b7c261fe80281a7863a73f802b64e3477a88575cdbe53e49","first_seen":"2023-04-05T04:08:00Z","last_seen":"2026-07-22T02:05:42.760512Z","times_seen":4580,"resource_available":false,"data":null}},"time_used":312,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":154,"receive":158,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ka-f.fontawesome.com/releases/v6.7.2/css/free.min.css?token=45b9078c9f","fqdn":"ka-f.fontawesome.com","domain":"fontawesome.com","tld":"com"},"ip":{"addr":"172.67.139.119","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:10.276Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ka-f.fontawesome.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Dec 2025 02:24:19 GMT","end":"Mon, 16 Mar 2026 03:24:16 GMT"},"fingerprint":{"sha1":"10:37:4B:A2:03:B2:49:7B:74:EE:F5:0F:E4:6F:20:31:F4:40:E6:40","sha256":"FF:BB:59:CA:F2:7C:B0:C5:C3:4F:A0:3A:15:57:65:B0:B1:D4:85:84:06:A0:CB:80:9C:53:7F:C1:24:0C:17:74"}}},"request":{"raw":"GET /releases/v6.7.2/css/free.min.css?token=45b9078c9f HTTP/1.1\r\nHost: ka-f.fontawesome.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nOrigin: https://bancolombiacreditodirecto.zeabur.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 14:23:10 GMT\r\ncontent-type: text/css\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccess-control-max-age: 3000\r\nlast-modified: Mon, 16 Dec 2024 16:06:36 GMT\r\nx-amz-server-side-encryption: AES256\r\nserver: cloudflare\r\naccess-control-allow-headers: fa-kit-token\r\ncontent-encoding: gzip\r\ncache-control: max-age=31556926\r\netag: W/\"14f5eecc946f901d192b02550e4dad67\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 c99d057689db169d0b27b6e562e255c2.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: pb4c4vAAxUXGHSbwE7c-dxn9GXUhUD4KAaG154rWPDwIgvJ1lecu1Q==\r\nage: 38664\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BDANmKvNMQmH9h3EQojFbQIbyVCe%2B%2FCwFeIDQ%2FnTnl8ltF3kWcgIILntNFDk%2FiJ478eDpLujBIxrjoIf1dEnzo%2BD8toM2XVPgVjbqGgobMGlNw%3D%3D\"}]}\r\ncf-ray: 9b9bdf29ce19b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":73986,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65321)","md5":"14f5eecc946f901d192b02550e4dad67","sha1":"45d6a10e09484d078cad37282708d611e19a06e6","sha256":"8f13446769cd1916cbbbdc2be7eb5be4b331bc7ef9ed8b799ecb4674e48095bf","sha512":"82e20fec5704c5784624775facba87c0c85893707e6905e44390ca6671b3a3e212a0bbf7161bf5c779aaefc22a71be24c38043d3077aedfd2e53483cde032072","ssdeep":"1536:/rM1MvMaMfMRQdm0grfT/QypZhzZHpSjA691Q:ilgrLXzZJg191Q","tlshash":"3f731f16ad84019bb4568d7f3885bf34a6f2eb28aad14495e4344d847ef28fd314fb32","first_seen":"2024-12-18T04:50:29.606533Z","last_seen":"2026-07-27T03:28:02.259219Z","times_seen":7276,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":86,"dns":54,"connect":1,"send":0,"wait":6,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T14:23:06.965Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Tue, 06 Jan 2026 14:23:08 GMT\r\nserver: nginx\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\nx-zeabur-request-id: sjc1::5e65ec31-59ad-4f07-b62a-17e05bd0121a\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":1080,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"fc8434a3a07f73aa757edffde3eb41fc","sha1":"721f2a5752f740e9085fd09bf74402f4baede2f9","sha256":"d33971db1d933c21b952569de61281b7db47483995000c61e84b3eaefc90e403","sha512":"be5a9df3207e6e1470c15c9fa01e65b3f73bf27c639d036851ab072343859a60a1462f0b713df12314cee837f11fc42bf1cf53e3f4432a296c53bda733af5cf9","ssdeep":"","tlshash":"4a11235aacc5c80991300aa5d8f3f428dd66b603a305cc88b58c11bf2fb9b888cd7994","first_seen":"2025-04-07T11:12:52.03754Z","last_seen":"2026-06-14T13:31:18.863259Z","times_seen":16,"resource_available":true,"data":null}},"time_used":2792,"timings":{"blocked":1318,"dns":369,"connect":158,"send":0,"wait":155,"receive":0,"ssl":788},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/a/login.php","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T14:23:09.361Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /a/login.php HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nserver: nginx\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-zeabur-request-id: sjc1::70fa5591-a976-4234-9d51-f0c597ab5520\r\nx-zeabur-ip-country: \r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Font Awesome","description":"Font Awesome is a font and icon toolkit based on CSS and Less.","website":"https://fontawesome.com/","common_platform_enumeration":"","icon":"Font Awesome.svg","categories":["Font scripts"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":3643,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"83832b4066c020ba83a3523ee5cb3ca6","sha1":"e0a17164423c961e7cec68a45027da05e37c737f","sha256":"1977f6445626037d3340c15f82b6e4989e91284b8b70542513fa172b9275ab91","sha512":"2c413c24533173594266a6ddbf0cafe5c0f24478038ea8f9602f69cbadd7e2861bcf346b5135871883f70c29b03c9e3915765ecdf974cd2e2f38317ff3472b26","ssdeep":"","tlshash":"c2712f122cf4958a92024494dee1fd2a9fc1d507d3166c48b0ad42ee5fc9fcd8ce7a1c","first_seen":"2025-12-29T10:24:05.573059Z","last_seen":"2026-05-09T03:07:33.769742Z","times_seen":33,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/jquery.jclock-min.js","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /js/jquery.jclock-min.js HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\netag: \"69594405-d09\"\r\nx-zeabur-ip-country: \r\nalt-svc: h3=\":443\"; ma=86400\r\nserver: nginx\r\nx-zeabur-request-id: sjc1::90f1185e-84ec-4fc8-8f26-9f4c422059a3\r\naccept-ranges: bytes\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nx-frame-options: SAMEORIGIN\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 3337\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3337,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2957), with CRLF line terminators","md5":"71722c7314fed201941f23bc1fe9604e","sha1":"1d1c35c3b25ea4056bd39ba290523e70bd2f8038","sha256":"93bf1714fd8d4cad23861f0017d5b3335f8b009f59d2bd654dcf0c29b7f36031","sha512":"f0c56d414d56bcb50a3264783781dedfb7401a553069a2d96b6b62289fb4246dc1fe601a6fdb8acd069e43c382788592ceafcc31ce799f6c1cc1025ca89ce6ea","ssdeep":"","tlshash":"f161366d307856a52abf6439387f0363ca2a5d36080af56c7d4f96c0686c85f94bbf70","first_seen":"2023-03-07T12:11:26Z","last_seen":"2026-06-14T13:31:18.860145Z","times_seen":716,"resource_available":true,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/img/load4.gif","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /img/load4.gif HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\ncontent-type: image/gif\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nx-zeabur-request-id: sjc1::d6736687-90b0-4d72-b761-346b5e1eecb6\r\netag: \"69594405-2197b\"\r\nx-content-type-options: nosniff\r\nx-zeabur-ip-country: \r\nx-frame-options: SAMEORIGIN\r\ncontent-length: 137595\r\naccept-ranges: bytes\r\nserver: nginx\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":137595,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 200 x 200","md5":"f4f2f7e33be2cda04749c95e2a41c5cb","sha1":"e90dd248dbeadfce55d336b93a64b26075bb8ee4","sha256":"e9191cc19434a700da94fa4bf8fb841a911102f93f5187cd3bc369dcd5ce97f2","sha512":"8b1c2e9827c63e1c414100651283542228b4ca4203fea4e635e145f94226e94a3b66dcee94093664c7649c615f7ab3ea5d7f75072d75a3ed77a382b07592c62d","ssdeep":"3072:xlRRaFZdoOhCUXvufKkf0JcYwEalJy4SrrSe:zaLfXvuCkZw43","tlshash":"79d39d94f06ae4d6f33393703ae15da04e981da1b5ca451fb232bb8267f1f9524e434e","first_seen":"2025-01-15T12:57:33.20768Z","last_seen":"2026-05-09T03:07:33.78364Z","times_seen":52,"resource_available":false,"data":null}},"time_used":621,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":449,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"kit.fontawesome.com/45b9078c9f.js","fqdn":"kit.fontawesome.com","domain":"fontawesome.com","tld":"com"},"ip":{"addr":"104.18.40.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.589Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fontawesome.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 21:28:44 GMT","end":"Thu, 19 Mar 2026 22:28:40 GMT"},"fingerprint":{"sha1":"87:09:C0:02:92:4C:46:4B:44:24:E8:82:D9:66:67:19:1E:B7:36:86","sha256":"4D:6C:5D:B0:58:E0:25:6E:02:7C:52:F9:DB:54:71:C6:EC:6F:60:D2:DE:87:67:6C:31:2D:09:E5:90:3C:58:E6"}}},"request":{"raw":"GET /45b9078c9f.js HTTP/1.1\r\nHost: kit.fontawesome.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://bancolombiacreditodirecto.zeabur.app\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 14:23:10 GMT\r\ncontent-type: text/javascript\r\ncontent-encoding: gzip\r\naccess-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 3000\r\ncache-control: max-age=60, public, stale-while-revalidate=30\r\nvary: origin, accept-encoding, access-control-request-headers, access-control-request-method\r\nx-request-id: GIfo2KEl8xGQDMOWkeOh\r\ncf-cache-status: REVALIDATED\r\nserver: cloudflare\r\ncf-ray: 9b9bdf250c44568e-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15204,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (14742)","md5":"204d14aeef728724788a52da3985fe47","sha1":"8d93886d354d997e3413ea4d1f95cfc565de312b","sha256":"60de65ec6d827b1c30278dbee917b6a8783ee54d4f49c1880291bdf00fd62f35","sha512":"89c3ca3a92edd2baea15976cc21dbe9c5db1e5756b20c4af08da7e1a4d809bf89a42bdbc7dc94bd76d94914b51e0bceb7f7f202875d1e4c44803c2c33869065b","ssdeep":"192:FkGliHAgdNpCpjebuSRDIbCpgeMvhhvlLoN6IQEZcJZuKwPXUxbUmVvh3uYXyl8o:FkKCClPCChhtqVUMFw1h3uYXyl8Y1e6","tlshash":"0362f91d7a81b43a86af7192843f670fb275353b30129461e25cd9e46c7ce9ea123f1d","first_seen":"2026-01-02T06:14:41.669964Z","last_seen":"2026-01-07T21:05:45.342849Z","times_seen":9,"resource_available":true,"data":null}},"time_used":704,"timings":{"blocked":20,"dns":20,"connect":1,"send":0,"wait":636,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ka-f.fontawesome.com/releases/v6.7.2/css/free-v5-font-face.min.css?token=45b9078c9f","fqdn":"ka-f.fontawesome.com","domain":"fontawesome.com","tld":"com"},"ip":{"addr":"172.67.139.119","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:10.282Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ka-f.fontawesome.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Dec 2025 02:24:19 GMT","end":"Mon, 16 Mar 2026 03:24:16 GMT"},"fingerprint":{"sha1":"10:37:4B:A2:03:B2:49:7B:74:EE:F5:0F:E4:6F:20:31:F4:40:E6:40","sha256":"FF:BB:59:CA:F2:7C:B0:C5:C3:4F:A0:3A:15:57:65:B0:B1:D4:85:84:06:A0:CB:80:9C:53:7F:C1:24:0C:17:74"}}},"request":{"raw":"GET /releases/v6.7.2/css/free-v5-font-face.min.css?token=45b9078c9f HTTP/1.1\r\nHost: ka-f.fontawesome.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/\r\nOrigin: https://bancolombiacreditodirecto.zeabur.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 06 Jan 2026 14:23:10 GMT\r\ncontent-type: text/css\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccess-control-max-age: 3000\r\nlast-modified: Mon, 16 Dec 2024 16:06:36 GMT\r\nx-amz-server-side-encryption: AES256\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ikyEvaXMvddv4g%2FPNxJYqa3Oirm7Zi%2F1sjwWnNrT0gz7Qo8lbYcxETkTERgwRnP8kO%2BtrqKjRJzGQtZMTCgEsAhdzsPQK%2BN0L%2FoaKSu9O41Kug%3D%3D\"}]}\r\nserver: cloudflare\r\naccess-control-allow-headers: fa-kit-token\r\ncache-control: max-age=31556926\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3da6f6abdf7146387ea7a7f42136c780.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: YkOMwMYv_Ur0qtpF13NtZuWmwe-UMbG23Ywz_wafFhl92EMMP3iWMg==\r\nage: 38664\r\ncf-cache-status: HIT\r\netag: W/\"ce9c230eaa656cebb4bcb218cc034374\"\r\ncontent-encoding: br\r\ncf-ray: 9b9bdf29be15b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":823,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (608)","md5":"ce9c230eaa656cebb4bcb218cc034374","sha1":"e7c962a7b5113bd9273f8eb56b1fd75d9a152d2d","sha256":"da44f714aafade532fab93527bdcec46596d87cfef74a613d529e34686b6a064","sha512":"38a99c70f756999b2a49b4d2f27aa2de516bcbf19596d63db88cabfa6251b3bb7f75621d4829ee18098ca63f9fc03a5bd1ab3ed757f0a30e011e841aac1ace6d","ssdeep":"","tlshash":"14012b5d4569006141510f1138dbbb0abd0ab16778a95ea3911b8d2c4cfa90773f5f09","first_seen":"2024-12-18T12:55:36.292311Z","last_seen":"2026-07-27T03:28:02.291516Z","times_seen":6981,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":79,"dns":48,"connect":3,"send":0,"wait":9,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/img/fondo1.png","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:10.294Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /img/fondo1.png HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/css/style-app.css?v2\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 39706\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 06 Jan 2026 14:23:10 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-zeabur-ip-country: \r\nserver: nginx\r\netag: \"69594405-9b1a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nx-zeabur-request-id: sjc1::e7acf977-a598-43fd-a647-e84199d6a561\r\ncontent-type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39706,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1157 x 519, 8-bit/color RGBA, non-interlaced","md5":"78a384ae63f76fb730c1971aaf26c8c8","sha1":"945a38609b542e16207dcb548621f3d61428b72a","sha256":"8f32d7f5854de5e7dfef904b696524f60ebc181d1c0940e50196207c649257c2","sha512":"b56aa975d3522cefdba21f13359522a8a7527086272d7a1e6b0ac9f60da933f71ebc73a79bd35effe9a364158e153ac7d95161e78d66f41f328e4d33dab30ece","ssdeep":"768:3/wM7RIbimr9jVOXmTdIknoj7En1R47W8wFbl58ZgFn8+y22q/tI3:3y7r+WTdIgGEP5Fbqgpy4m3","tlshash":"cd03e192dbd86d7cd5298333e1cb45b925f0aef9208c833e1a66d3b93d0660b61817e4","first_seen":"2025-11-17T01:45:59.480526Z","last_seen":"2026-05-09T03:07:33.799737Z","times_seen":39,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":156,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/img/logo.png","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:10.732Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /img/logo.png HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ncontent-length: 9489\r\nx-zeabur-ip-country: \r\ncontent-type: image/png\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\netag: \"69594405-2511\"\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=86400\r\ndate: Tue, 06 Jan 2026 14:23:10 GMT\r\nx-zeabur-request-id: sjc1::c671356f-f883-40f3-8c51-f757685e4e44\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":9489,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 521 x 520, 8-bit/color RGBA, non-interlaced","md5":"2903c67701750d246b77ee1c1c9188f1","sha1":"028e6e88d6563e81eb77807c38f401cf5e7f2be0","sha256":"c2fd3f9e79070fdbcb7ed3270a428a6ecd22ae089ab6e573eb4dfe91079c41fb","sha512":"69d91b5ec22b115e7a04bbde1ac0a2cd5363ec43b31c2306db750fc633b09f200747134d64fa65ae08878022da83528c7dfd85e52cf8414682384e63320d6392","ssdeep":"192:RHdLF/vqjt+4Ax2zv7OSrsA115FfQXlJeY2hyPjNpD6zQc4HXht4:RNJv8tFTxsA11PfQXX+hyXDk4Hxq","tlshash":"4312aef04e8261c76e65e98c50e2bec8fef56ff71634c1bf8076656443dc25aa5084b2","first_seen":"2023-04-30T20:28:03Z","last_seen":"2026-06-14T13:31:18.862221Z","times_seen":592,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":156,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bancolombiacreditodirecto.zeabur.app/js/functions.js?v1","fqdn":"bancolombiacreditodirecto.zeabur.app","domain":"bancolombiacreditodirecto.zeabur.app","tld":"zeabur.app"},"ip":{"addr":"43.159.166.10","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bancolombiacreditodirecto.zeabur.app/a/login.php","date":"2026-01-06T14:23:09.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zeabur.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 15:07:59 GMT","end":"Tue, 31 Mar 2026 15:07:58 GMT"},"fingerprint":{"sha1":"54:D3:80:D3:85:42:FC:6B:B6:93:3E:06:AE:75:C8:8E:F3:2C:8F:C7","sha256":"1B:C4:7E:F0:7C:89:E3:1E:1F:49:92:7A:33:E5:6C:EC:C3:74:7C:2B:5A:B7:CA:BD:78:C1:40:92:6B:29:0A:7F"}}},"request":{"raw":"GET /js/functions.js?v1 HTTP/1.1\r\nHost: bancolombiacreditodirecto.zeabur.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bancolombiacreditodirecto.zeabur.app/a/login.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nx-frame-options: SAMEORIGIN\r\netag: \"69594405-e14\"\r\nx-content-type-options: nosniff\r\nx-zeabur-ip-country: \r\ndate: Tue, 06 Jan 2026 14:23:09 GMT\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Sat, 03 Jan 2026 16:29:57 GMT\r\naccept-ranges: bytes\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 3604\r\nx-zeabur-request-id: sjc1::8a038015-8c03-4836-b57b-b8eca575a7ab\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Zeabur","description":"Zeabur is a platform for running full stack apps and databases.","website":"https://zeabur.com","common_platform_enumeration":"","icon":"zeabur.svg","categories":["PaaS"]}],"data":{"size":3604,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"5de2174c1416a7109101f47c1ada42df","sha1":"3c6d474c191862634de02876d55ae298e7c78e34","sha256":"fa41971985dea092b3f122ff8f185774f329e308eb4ffde4049bdb79f4c1248a","sha512":"74c9a85cf92606c09944b5b3f9a81f26c665577a461179ff02f92248c46a10f4f4d0ba1a72c55a90dea3e3e409d535eb408598891078bd285175b5a414093409","ssdeep":"","tlshash":"2a71f59d6006100916f36f355a1b7204e8b340a74f1da800bd5cced4af3c7bf9aa6ead","first_seen":"2025-12-29T10:24:05.584096Z","last_seen":"2026-05-09T03:07:33.781173Z","times_seen":32,"resource_available":true,"data":null}},"time_used":295,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":139,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"bancolombiacreditodirecto.zeabur.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Bancolombia","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Bancolombia phishing","tags":["bancolombia","financial","phishing"],"meta":null}]}}]}