brunomarquesdacunha.com

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 185.12.116.85, located in Portugal and belongs to FLESK-AS, PT. The main domain is brunomarquesdacunha.com.
TLS certificate: Issued by R3 on October 6th 2022. Valid for: 3 months.

This is the only time brunomarquesdacunha.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

	IP Address		AS Autonomous System
7	185.12.116.85 185.12.116.85		33876 (FLESK-AS) (FLESK-AS)
7	1

7 185.12.116.85 (Portugal)

ASN33876 (FLESK-AS, PT)
PTR: cpanel85.dnscpanel.com

brunomarquesdacunha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	brunomarquesdacunha.com brunomarquesdacunha.com	122 KB
7	1

	Domain	Requested by
7	brunomarquesdacunha.com	brunomarquesdacunha.com
7	1

This site contains no links.

Subject Issuer	Validity	Valid
*.brunomarquesdacunha.com R3	`2022-10-06` - `2023-01-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://brunomarquesdacunha.com/fe/
Frame ID: 320AD5BA1E5681A1D1D3D4C59B62AD91
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Inicio

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

122 kB
Transfer

252 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response brunomarquesdacunha.com/fe/	7 KB 2 KB	758ms 111ms	Document text/html	185.12.116.85 FLESK-AS
General Check archive.org Show headers Download Go to Full URL https://brunomarquesdacunha.com/fe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.12.116.85 , Portugal, ASN33876 (FLESK-AS, PT), Reverse DNS cpanel85.dnscpanel.com Software nginx / Resource Hash `79284e509de52b16d3a6088605f46ce1464e1fd208aee18859b52d4bf4019cbe` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html date Mon, 21 Nov 2022 16:30:45 GMT last-modified Mon, 15 Aug 2022 21:49:00 GMT server nginx vary Accept-Encoding x-scale YXBvY2FzQGdpdGh1Yg==
GET H2	200	lgn.css brunomarquesdacunha.com/fe/ff/	144 KB 19 KB	193ms 192ms	Stylesheet text/css	185.12.116.85 FLESK-AS
General Check archive.org Show headers Download Go to Full URL https://brunomarquesdacunha.com/fe/ff/lgn.css Requested by Host: brunomarquesdacunha.com URL: https://brunomarquesdacunha.com/fe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.12.116.85 , Portugal, ASN33876 (FLESK-AS, PT), Reverse DNS cpanel85.dnscpanel.com Software nginx / Resource Hash `d33641dafd133ef4dfecc4bfac495e557609c852d67e1f19468d7233190034b7` Request headers accept-language de-DE,de;q=0.9 Referer https://brunomarquesdacunha.com/fe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers x-type static date Mon, 21 Nov 2022 16:30:45 GMT content-encoding gzip last-modified Fri, 03 Jun 2022 16:53:30 GMT server nginx vary Accept-Encoding x-cache MISS content-type text/css
GET H2	200	LOGO_ita.png brunomarquesdacunha.com/fe/ff/	44 KB 44 KB	192ms 191ms	Image image/png	185.12.116.85 FLESK-AS
General Check archive.org Show headers Download Go to Show image Full URL https://brunomarquesdacunha.com/fe/ff/LOGO_ita.png Requested by Host: brunomarquesdacunha.com URL: https://brunomarquesdacunha.com/fe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.12.116.85 , Portugal, ASN33876 (FLESK-AS, PT), Reverse DNS cpanel85.dnscpanel.com Software nginx / Resource Hash `3aff6206d924c35025b595d4876ee279d1519269999e066aa8ffc41189050527` Request headers accept-language de-DE,de;q=0.9 Referer https://brunomarquesdacunha.com/fe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers x-type static date Mon, 21 Nov 2022 16:30:45 GMT last-modified Thu, 02 Jun 2022 05:40:52 GMT server nginx x-cache MISS content-type image/png accept-ranges bytes content-length 44615
GET H2	200	bottom.png brunomarquesdacunha.com/fe/ff/	28 KB 29 KB	103ms 102ms	Image image/png	185.12.116.85 FLESK-AS
General Check archive.org Show headers Download Go to Show image Full URL https://brunomarquesdacunha.com/fe/ff/bottom.png Requested by Host: brunomarquesdacunha.com URL: https://brunomarquesdacunha.com/fe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.12.116.85 , Portugal, ASN33876 (FLESK-AS, PT), Reverse DNS cpanel85.dnscpanel.com Software nginx / Resource Hash `76460e705cc668b3f517809abed94e599230b18e920d2d865f52f54aa76b7ede` Request headers accept-language de-DE,de;q=0.9 Referer https://brunomarquesdacunha.com/fe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers x-type static date Mon, 21 Nov 2022 16:30:45 GMT last-modified Fri, 03 Jun 2022 16:34:14 GMT server nginx x-cache MISS content-type image/png accept-ranges bytes content-length 29061
GET H2	200	air-blog.jpg brunomarquesdacunha.com/fe/ff/	28 KB 28 KB	101ms 100ms	Image image/jpeg	185.12.116.85 FLESK-AS
General Check archive.org Show headers Download Go to Show image Full URL https://brunomarquesdacunha.com/fe/ff/air-blog.jpg Requested by Host: brunomarquesdacunha.com URL: https://brunomarquesdacunha.com/fe/ff/lgn.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.12.116.85 , Portugal, ASN33876 (FLESK-AS, PT), Reverse DNS cpanel85.dnscpanel.com Software nginx / Resource Hash `530450c99b610df9f0e84a708d7fb384e2c28ad8b9b0f05a948510b5f1cd76d3` Request headers accept-language de-DE,de;q=0.9 Referer https://brunomarquesdacunha.com/fe/ff/lgn.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers x-type static date Mon, 21 Nov 2022 16:30:45 GMT last-modified Thu, 02 Jun 2022 03:44:52 GMT server nginx x-cache MISS content-type image/jpeg accept-ranges bytes content-length 28412
GET H2	200	requerido_ban.png brunomarquesdacunha.com/fe/login/css/custom-theme/images/	433 B 433 B	102ms 102ms	Image text/html	185.12.116.85 FLESK-AS
General Check archive.org Show headers Download Go to Show image Full URL https://brunomarquesdacunha.com/fe/login/css/custom-theme/images/requerido_ban.png Requested by Host: brunomarquesdacunha.com URL: https://brunomarquesdacunha.com/fe/ff/lgn.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.12.116.85 , Portugal, ASN33876 (FLESK-AS, PT), Reverse DNS cpanel85.dnscpanel.com Software nginx / PHP/7.4.33 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://brunomarquesdacunha.com/fe/ff/lgn.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers x-type static date Mon, 21 Nov 2022 16:30:45 GMT content-encoding gzip server nginx x-powered-by PHP/7.4.33 vary Accept-Encoding x-cache MISS content-type text/html; charset=UTF-8
GET H2	200	OpenSans.woff brunomarquesdacunha.com/fe/Fonts/	433 B 464 B	105ms 105ms	Font text/html	185.12.116.85 FLESK-AS
General Check archive.org Show headers Download Go to Full URL https://brunomarquesdacunha.com/fe/Fonts/OpenSans.woff Requested by Host: brunomarquesdacunha.com URL: https://brunomarquesdacunha.com/fe/ff/lgn.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.12.116.85 , Portugal, ASN33876 (FLESK-AS, PT), Reverse DNS cpanel85.dnscpanel.com Software nginx / PHP/7.4.33 Resource Hash `e6fa4115991a727af1c277d82bc522e290634b7e01aa9feeebbdb4a85054c67e` Request headers Referer https://brunomarquesdacunha.com/fe/ff/lgn.css Origin https://brunomarquesdacunha.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Mon, 21 Nov 2022 16:30:45 GMT content-encoding gzip x-scale YXBvY2FzQGdpdGh1Yg== server nginx x-powered-by PHP/7.4.33 vary Accept-Encoding content-type text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| soloNumeros

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://brunomarquesdacunha.com/fe/ Message: Failed to decode downloaded font: https://brunomarquesdacunha.com/fe/Fonts/OpenSans.woff
other	warning	URL: https://brunomarquesdacunha.com/fe/ Message: OTS parsing error: invalid sfntVersion: 168430140

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

brunomarquesdacunha.com
185.12.116.85
3aff6206d924c35025b595d4876ee279d1519269999e066aa8ffc41189050527
530450c99b610df9f0e84a708d7fb384e2c28ad8b9b0f05a948510b5f1cd76d3
76460e705cc668b3f517809abed94e599230b18e920d2d865f52f54aa76b7ede
79284e509de52b16d3a6088605f46ce1464e1fd208aee18859b52d4bf4019cbe
d33641dafd133ef4dfecc4bfac495e557609c852d67e1f19468d7233190034b7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6fa4115991a727af1c277d82bc522e290634b7e01aa9feeebbdb4a85054c67e

brunomarquesdacunha.com Open in urlscan Pro 185.12.116.85 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

122 kBTransfer

252 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

brunomarquesdacunha.com Open in urlscan Pro
185.12.116.85 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

122 kB
Transfer

252 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!