snyst.xyz
Open in
urlscan Pro
46.17.175.42
Malicious Activity!
Public Scan
Submission Tags: 6490871
Submission: On April 07 via api from NL
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on April 7th 2020. Valid for: 3 months.
This is the only time snyst.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 46.17.175.42 46.17.175.42 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:814::2003 | 15169 (GOOGLE) (GOOGLE) | |
11 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
snyst.xyz
snyst.xyz |
505 KB |
2 |
gstatic.com
fonts.gstatic.com |
22 KB |
1 |
googleapis.com
fonts.googleapis.com |
949 B |
11 | 3 |
Domain | Requested by | |
---|---|---|
8 | snyst.xyz |
snyst.xyz
|
2 | fonts.gstatic.com |
snyst.xyz
|
1 | fonts.googleapis.com |
snyst.xyz
|
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
snyst.xyz Let's Encrypt Authority X3 |
2020-04-07 - 2020-07-06 |
3 months | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://snyst.xyz/itaucard/mobile/acesso.php
Frame ID: D20A0463EC495132ABF5A7C070C00B80
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
LiteSpeed (Web Servers) Expand
Detected patterns
- headers server /^LiteSpeed$/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
acesso.php
snyst.xyz/itaucard/mobile/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geral.css
snyst.xyz/itaucard/mobile/_styles/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
12 KB 949 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
snyst.xyz/itaucard/mobile/_jscripts/ |
85 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geral.js
snyst.xyz/itaucard/mobile/_jscripts/ |
4 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
is_logo.png
snyst.xyz/itaucard/mobile/_images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_home.jpg
snyst.xyz/itaucard/mobile/_images/ |
463 KB 463 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_card.png
snyst.xyz/itaucard/mobile/_images/ |
744 B 806 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_pass.png
snyst.xyz/itaucard/mobile/_images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| check_enter function| check_codi function| check_conf function| validarCPF function| checkCard1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
snyst.xyz/ | Name: PHPSESSID Value: 750f9ff47aa013c8f4512bcd77fa33fd |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
snyst.xyz
2a00:1450:4001:814::2003
2a00:1450:4001:821::200a
46.17.175.42
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
628f8babb02803af98c5e9faeff88fef69b3646199d080a0761a2ff01a7e1793
6cbae13ee759f7ec5404e72098296005adc591e4c9a8da0b1fae3f91a511afd9
82bc94a8917203204a6f9894bd478b22e63450be42fca8b41205b95b4c335df9
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
89f80ca5e2b9366152f9778f5611f31477a5abd75d2a56d11e15f42f6df747c1
8e1f196d7be65b0d522ac02978fbafc873fce13521fd560cb96cb591e7b48c1c
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
96f88e6d9ac9b63006c9268453c8b8473e7a2f5c6a9f3051c2bb666131da7703
d1e84d9fcc76d16198e1a0437d161a3b34c606cac4e088d7e3d7e68061ed2618
db6eb2615a3dc7d08ca4eba8ba3fab693bc393c56741f067af56e3b2547f012a