Bancolombia Phishing Kit 68a8d3f

Detects a Bancolombia phishing kit targeting Spanish speaking users. Commonly deployed on replit.com.

References

IOK Rule (edit) 

title: Bancolombia Phishing Kit 68a8d3f
description: |
    Detects a Bancolombia phishing kit targeting Spanish speaking users.
    Commonly deployed on `replit.com`.
    
references:
    - https://urlscan.io/result/68a8d3f3-ecaa-4fec-a4bc-95ce3a1c1859
    - https://urlscan.io/result/e98a899c-a68a-43ec-ade5-caefc01e4fbf

detection:
    
    styleSheetVersionStamp:
        html|contains: '?v=4.2.0.RC1_1624831458747'
        
    scisValue:
        html|contains: '?scis="YIi1lR6Pw8XXW+BFzGbgVa9/N5InkmIFmcP91Ale3jg='
        
    condition: styleSheetVersionStamp and scisValue
    
tags:
  - kit
  - target.bancolombia
  - target_country.colombia