planetbusca.com.br
Open in
urlscan Pro
162.241.203.25
Malicious Activity!
Public Scan
Effective URL: https://planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/signin.php?session=363665636435
Submission: On September 22 via automatic, source phishtank
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on August 20th 2019. Valid for: 3 months.
This is the only time planetbusca.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Chase (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 67.199.248.10 67.199.248.10 | 395224 (BITLY-AS) (BITLY-AS - Bitly Inc) | |
3 | 2606:4700:30:... 2606:4700:30::681f:4124 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 2606:4700::68... 2606:4700::6813:c597 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
4 | 2a00:1450:400... 2a00:1450:4001:81f::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 2a00:1450:400... 2a00:1450:4001:824::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 104.20.3.47 104.20.3.47 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 10 | 162.241.203.25 162.241.203.25 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
2 | 104.20.2.47 104.20.2.47 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
25 | 8 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
nullrefer.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ajax.cloudflare.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google.com |
ASN15169 (GOOGLE - Google LLC, US)
www.gstatic.com |
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: 162-241-203-25.unifiedlayer.com
planetbusca.com.br |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
planetbusca.com.br
1 redirects
planetbusca.com.br |
398 KB |
4 |
statcounter.com
www.statcounter.com c.statcounter.com Failed |
24 KB |
4 |
google.com
www.google.com |
1 KB |
3 |
nullrefer.com
nullrefer.com |
3 KB |
2 |
gstatic.com
www.gstatic.com |
184 KB |
2 |
cloudflare.com
ajax.cloudflare.com |
8 KB |
2 |
bit.ly
2 redirects
bit.ly |
694 B |
25 | 7 |
Domain | Requested by | |
---|---|---|
10 | planetbusca.com.br |
1 redirects
planetbusca.com.br
|
4 | www.google.com |
nullrefer.com
www.gstatic.com |
3 | nullrefer.com |
nullrefer.com
|
2 | c.statcounter.com | |
2 | www.statcounter.com |
ajax.cloudflare.com
|
2 | www.gstatic.com |
www.google.com
|
2 | ajax.cloudflare.com |
nullrefer.com
|
2 | bit.ly | 2 redirects |
25 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-08-10 - 2020-02-16 |
6 months | crt.sh |
www.google.com GTS CA 1O1 |
2019-09-05 - 2019-11-28 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2019-09-05 - 2019-11-28 |
3 months | crt.sh |
planetbusca.com.br Let's Encrypt Authority X3 |
2019-08-20 - 2019-11-18 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/signin.php?session=363665636435
Frame ID: EFFC317C9128783DC99C9E3CC8EE8162
Requests: 23 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LftsXMUAAAAALlWG1yUWFRGkwxc7P-ZFroKILkc&co=aHR0cDovL251bGxyZWZlci5jb206ODA.&hl=en&v=v1566858990656&size=invisible&cb=my7xij6wpp1n
Frame ID: 6D9B49272DB9EAF0879783D208CD79DE
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LftsXMUAAAAALlWG1yUWFRGkwxc7P-ZFroKILkc&co=aHR0cDovL251bGxyZWZlci5jb206ODA.&hl=en&v=v1566858990656&size=invisible&cb=kdt2fvmr8ggi
Frame ID: C63CC9CEE571439F49E01418B68FAC7C
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://bit.ly/2kOJMhF
HTTP 301
http://nullrefer.com/?http://nullrefer.com/?http://bit.ly/2kRvvkd Page URL
- http://nullrefer.com/?http://bit.ly/2kRvvkd Page URL
-
http://bit.ly/2kRvvkd
HTTP 301
https://planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/ HTTP 302
https://planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/signin.php?ses... Page URL
Detected technologies
AngularJS (JavaScript Frameworks) ExpandDetected patterns
- script /angular.*\.js/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bit.ly/2kOJMhF
HTTP 301
http://nullrefer.com/?http://nullrefer.com/?http://bit.ly/2kRvvkd Page URL
- http://nullrefer.com/?http://bit.ly/2kRvvkd Page URL
-
http://bit.ly/2kRvvkd
HTTP 301
https://planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/ HTTP 302
https://planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/signin.php?session=363665636435 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://bit.ly/2kOJMhF HTTP 301
- http://nullrefer.com/?http://nullrefer.com/?http://bit.ly/2kRvvkd
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
/
nullrefer.com/ Redirect Chain
|
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
748 B 664 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/api2/v1566858990656/ |
264 KB 92 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter.js
www.statcounter.com/counter/ |
30 KB 11 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
nullrefer.com/ |
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
t.php
c.statcounter.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame 6D9B |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
748 B 579 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/api2/v1566858990656/ |
264 KB 92 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter.js
www.statcounter.com/counter/ |
30 KB 11 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
signin.php
planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/ Redirect Chain
|
22 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t.php
c.statcounter.com/ |
213 B 525 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t.php
c.statcounter.com/ |
213 B 525 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame C63C |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chk_captcha_v3
nullrefer.com/cdn-cgi/l/ |
0 406 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blue-ui.css
planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/style/css/ |
396 KB 78 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logon.css
planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/style/css/ |
128 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular.min.js
planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/style/js/ |
163 KB 70 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/style/js/ |
286 KB 110 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.min.js
planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/style/js/ |
49 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wordmark-white.svg
planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/style/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default.jpeg
planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/style/img/ |
38 KB 39 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dcefont.woff
planetbusca.com.br/pl/secure07b.chase.com-web-auth-dashboard/overview/chase/home/style/img/ |
53 KB 53 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- c.statcounter.com
- URL
- http://c.statcounter.com/t.php?sc_project=11231575&java=1&security=96323b3b&u1=A4A59F41A9954F68C2EBC59C3F33F779&sc_rum_f_s=0&sc_rum_f_e=681&sc_rum_e_s=685&sc_rum_e_e=691&sc_random=0.9943716891111318&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=&u=http%3A//nullrefer.com/%3Fhttp%3A//nullrefer.com/%3Fhttp%3A//bit.ly/2kRvvkd&t=Nullrefer.com%20Anonym%20Link&sc_snum=1&sess=ef5bce&p=0&invisible=1
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Chase (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| angular function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.cloudflare.com
bit.ly
c.statcounter.com
nullrefer.com
planetbusca.com.br
www.google.com
www.gstatic.com
www.statcounter.com
c.statcounter.com
104.20.2.47
104.20.3.47
162.241.203.25
2606:4700:30::681f:4124
2606:4700::6813:c597
2a00:1450:4001:81f::2004
2a00:1450:4001:824::2003
67.199.248.10
2e323c6acaa7ee858f6cfe0c0e5d113e45593ee86756859992e40084c23e7c0c
344744e665465459e29786188b906fdc065231a054e05cda3051f5615a8002d7
60ae8b3bd8772f8dc5a03cee5d6176620d5df9a26b9e6d5b0070ea1e96588e69
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d
7ebb1042972496d60bb6555b9622f7e23201bbfe5d25b33d1096f1b61d659045
863576c871fc9979e7389a298b2c56ddc3ef63160848558577668b05bbcf93fb
8a789126542ffccd16c10617e6d9c3338924ab3c3dec0a1c7aee55a421b98649
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
a054554812c09bcd6e28618753061066ae6273f3af38e7cba62adeb7f1a5c348
ac2faaa0365cb4fa0389ddffc2957571ab541b85f0113ffdb519dc075c6b3f33
bd3cad6b7ba79270dee54a5ba1482ac6b522b147dc8f9d04791050711ada7865
beaf04b1508ee134c7053a40e11f0a70faad6ac2dabad8cf8d288a77193f10df
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
d75bef30599959292f501c97f1c3bbe31dbba72560b4602b9332a83a7794ba37