appbanking.lon.wafaicloud.com Open in urlscan Pro
185.206.28.147  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request home.html Show response appbanking.lon.wafaicloud.com/w/s/apps/atendimento/	2 KB 1 KB	95ms 22ms	Document text/html	185.206.28.147 DSP-AS
General Check archive.org Show headers Download Go to Full URL https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.206.28.147 , Saudi Arabia, ASN202105 (DSP-AS, SA), Reverse DNS Software openresty / Resource Hash 66aaeae37f51069911bcadd51c9309538b045b0d02a354916306a00b3e1e492e Security Headers Name Value Strict-Transport-Security max-age=15811200 Request headers :method GET :authority appbanking.lon.wafaicloud.com :scheme https :path /w/s/apps/atendimento/home.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server openresty date Sun, 25 Apr 2021 01:16:47 GMT content-type text/html; charset=UTF-8 content-length 957 last-modified Fri, 09 Apr 2021 17:21:32 GMT etag "87a-5bf8d65287f00-gzip" accept-ranges bytes vary Accept-Encoding content-encoding gzip x-resolver-ip 185.206.28.147 strict-transport-security max-age=15811200
GET H2	200	modalstyle.css appbanking.lon.wafaicloud.com/w/s/apps/atendimento/assets/css/	3 KB 958 B	22ms 21ms	Stylesheet text/css	185.206.28.147 DSP-AS
General Check archive.org Show headers Download Go to Full URL https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/assets/css/modalstyle.css Requested by Host: appbanking.lon.wafaicloud.com URL: https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.206.28.147 , Saudi Arabia, ASN202105 (DSP-AS, SA), Reverse DNS Software openresty / Resource Hash 4b45e1bcd1fcb00d31b2d83886965d9e5bc60bf5250c2e9d3cef313d0f6cc83d Security Headers Name Value Strict-Transport-Security max-age=15811200 Request headers :path /w/s/apps/atendimento/assets/css/modalstyle.css pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority appbanking.lon.wafaicloud.com referer https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html :scheme https sec-fetch-site same-origin :method GET Referer https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 25 Apr 2021 01:16:47 GMT content-encoding gzip last-modified Fri, 09 Apr 2021 17:21:32 GMT server openresty etag "a73-5bf8d65287f00-gzip" vary Accept-Encoding content-type text/css strict-transport-security max-age=15811200 accept-ranges bytes content-length 729 x-resolver-ip 185.206.28.147
GET H2	200	botoes.css appbanking.lon.wafaicloud.com/w/s/apps/atendimento/assets/css/	16 KB 2 KB	21ms 20ms	Stylesheet text/css	185.206.28.147 DSP-AS
General Check archive.org Show headers Download Go to Full URL https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/assets/css/botoes.css Requested by Host: appbanking.lon.wafaicloud.com URL: https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.206.28.147 , Saudi Arabia, ASN202105 (DSP-AS, SA), Reverse DNS Software openresty / Resource Hash f70adf6f45a5b0d529e398fa661e22b71c4263e92977be4287fcc92469ab7d37 Security Headers Name Value Strict-Transport-Security max-age=15811200 Request headers :path /w/s/apps/atendimento/assets/css/botoes.css pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority appbanking.lon.wafaicloud.com referer https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html :scheme https sec-fetch-site same-origin :method GET Referer https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 25 Apr 2021 01:16:47 GMT content-encoding gzip last-modified Fri, 09 Apr 2021 17:21:32 GMT server openresty etag "3fc9-5bf8d65287f00-gzip" vary Accept-Encoding content-type text/css strict-transport-security max-age=15811200 accept-ranges bytes content-length 1992 x-resolver-ip 185.206.28.147
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.12.4/	95 KB 33 KB	7ms 5ms	Script text/javascript	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js Requested by Host: appbanking.lon.wafaicloud.com URL: https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://appbanking.lon.wafaicloud.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 22 Apr 2021 16:12:35 GMT content-encoding gzip x-content-type-options nosniff age 205452 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33951 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 22 Apr 2022 16:12:35 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/	36 KB 10 KB	14ms 13ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js Requested by Host: appbanking.lon.wafaicloud.com URL: https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://appbanking.lon.wafaicloud.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 25 Apr 2021 01:16:47 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 722, 617 age 2866637 cdn-cachedat 2021-03-11 11:57:50 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09a832cd4300004dfa940f9000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:00 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 3033c5b7ea34684b20a8f4234fea378f cf-ray 6453ba5b9e664dfa-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	logo-itau.png appbanking.lon.wafaicloud.com/w/s/apps/atendimento/img/	6 KB 7 KB	21ms 20ms	Image image/png	185.206.28.147 DSP-AS
General Check archive.org Show headers Download Go to Show image Full URL https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/img/logo-itau.png Requested by Host: appbanking.lon.wafaicloud.com URL: https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.206.28.147 , Saudi Arabia, ASN202105 (DSP-AS, SA), Reverse DNS Software openresty / Resource Hash 0c489fc6a4d1005640a88bfc3f670615236d9a28f2d024a309a5967502be49ac Security Headers Name Value Strict-Transport-Security max-age=15811200 Request headers :path /w/s/apps/atendimento/img/logo-itau.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority appbanking.lon.wafaicloud.com referer https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html :scheme https sec-fetch-site same-origin :method GET Referer https://appbanking.lon.wafaicloud.com/w/s/apps/atendimento/home.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 25 Apr 2021 01:16:47 GMT last-modified Fri, 09 Apr 2021 17:21:32 GMT server openresty etag "19f6-5bf8d65287f00" strict-transport-security max-age=15811200 content-type image/png accept-ranges bytes content-length 6646 x-resolver-ip 185.206.28.147

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| jQuery1124026572443244794

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15811200

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
appbanking.lon.wafaicloud.com
maxcdn.bootstrapcdn.com
185.206.28.147
2606:4700::6812:bcf
2a00:1450:4001:811::200a
0c489fc6a4d1005640a88bfc3f670615236d9a28f2d024a309a5967502be49ac
4b45e1bcd1fcb00d31b2d83886965d9e5bc60bf5250c2e9d3cef313d0f6cc83d
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
66aaeae37f51069911bcadd51c9309538b045b0d02a354916306a00b3e1e492e
f70adf6f45a5b0d529e398fa661e22b71c4263e92977be4287fcc92469ab7d37