nvbvnc.life Open in urlscan Pro
2606:4700:3032::6815:3307 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://nvbvnc.life/
Effective URL:
https://nvbvnc.life/login/
Submission: On April 11 via api (April 11th 2023, 8:04:52 am UTC) from JP — Scanned from JP

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3032::6815:3307, located in United States and belongs to CLOUDFLARENET, US. The main domain is nvbvnc.life.
TLS certificate: Issued by GTS CA 1P5 on April 10th 2023. Valid for: 3 months.

This is the only time nvbvnc.life was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Novobanco (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:303... 2606:4700:3034::ac43:d827	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 7	2606:4700:303... 2606:4700:3032::6815:3307	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2404:6800:400... 2404:6800:4004:801::2003	15169 (GOOGLE) (GOOGLE)
3	2606:4700:e4:... 2606:4700:e4::ac40:a916	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	4

2 2606:4700:3034::ac43:d827 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

nvbvnc.life	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:3032::6815:3307 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

nvbvnc.life	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:801::2003 (Australia)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:e4::ac40:a916 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	nvbvnc.life 4 redirects nvbvnc.life	74 KB
3	fontawesome.com ka-f.fontawesome.com — Cisco Umbrella Rank: 3207	19 KB
1	gstatic.com fonts.gstatic.com	27 KB
9	3

	Domain	Requested by
9	nvbvnc.life	4 redirects nvbvnc.life
3	ka-f.fontawesome.com	nvbvnc.life
1	fonts.gstatic.com	nvbvnc.life
9	3

This site contains no links.

Subject Issuer	Validity	Valid
*.nvbvnc.life GTS CA 1P5	`2023-04-10` - `2023-07-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-12` - `2023-08-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://nvbvnc.life/login/
Frame ID: 8C89194C9F6D0713B27DCE5341A87652
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Entrar

Page URL History Show full URLs

http://nvbvnc.life/ HTTP 301
https://nvbvnc.life/ HTTP 302
https://nvbvnc.life/login HTTP 301
http://nvbvnc.life/login/ HTTP 301
https://nvbvnc.life/login/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

118 kB
Transfer

330 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://nvbvnc.life/ HTTP 301
https://nvbvnc.life/ HTTP 302
https://nvbvnc.life/login HTTP 301
http://nvbvnc.life/login/ HTTP 301
https://nvbvnc.life/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
nvbvnc.life/login/
Redirect Chain

http://nvbvnc.life/
https://nvbvnc.life/
https://nvbvnc.life/login
http://nvbvnc.life/login/
https://nvbvnc.life/login/

99 KB
24 KB

229ms
229ms

Document
text/html

2606:4700:3032::6815:3307
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvbvnc.life/login/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:3307 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53623570cb0f4d17c9bc7abbab37729d46ffb165dac144348ec7fa25b1e8e7e2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7b61b886cec006b9-NRT
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 11 Apr 2023 08:04:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uYdYsK6EzAcUrf2H%2FRhJIhXyxsTcBu%2F%2Fc2dwiuKsuNqSlZkngtWw67cC5VQDyp0CndhAGtMOsJuV9lAw9AjaJQ%2BkMhXF7wnn9sZjEMooc%2BtfAHZERQKVk55t1XVirAM0E65w5TrXZGOXJg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

CF-RAY: 7b61b886cf33afc1-NRT
Cache-Control: max-age=3600
Connection: keep-alive
Date: Tue, 11 Apr 2023 08:04:47 GMT
Expires: Tue, 11 Apr 2023 09:04:47 GMT
Location: https://nvbvnc.life/login/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OD%2F0GQ7v7ZBS8Ibg4jfWLct1gbyXoRrLFe%2Fc9EWN7dc4a%2BckAWtOjWzyAVhxS%2BZc6kGMpz%2Fm%2FkFDM%2FTAeutWYXTo2hx43hnqBJSti3pruHChiojLgAykPBMPmEV9a7FGncpuHLGZvPo0NA%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 css2
nvbvnc.life/login/files/ 10 KB
10 KB 223ms
222ms Stylesheet
text/plain 2606:4700:3032::6815:3307
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvbvnc.life/login/files/css2
Requested by: Host: nvbvnc.life
URL: https://nvbvnc.life/login/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:3307 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb24d848aac27f7b8bcf57cb15f85c9732e4fe153e3916d5c745ef5fca2ef1ac

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nvbvnc.life/login/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 11 Apr 2023 08:04:48 GMT
cf-cache-status: DYNAMIC
last-modified: Mon, 20 Mar 2023 22:52:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "26d0-5f75cc83c4c00"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E60Aw7DblCDWspVVwiT26jYmenAK%2BXfWbL6BZNmewvpZDmV%2FJk805APInjVbuR%2FsHTYuzKkZGrzOUhG5AWV5TIy3YdEHgWeGnYpEVhFP2yPP%2BTP1dljzHluvt%2BTM%2FWF736%2F%2Fss2BWKv5Kw%3D%3D"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7b61b8885f4a06b9-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9936

GET
H3 200 all.css
nvbvnc.life/login/files/ 5 KB
2 KB 16ms
13ms Stylesheet
text/css 2606:4700:3032::6815:3307
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvbvnc.life/login/files/all.css
Requested by: Host: nvbvnc.life
URL: https://nvbvnc.life/login/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:3307 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd13896ab186c6b592a29edda3b6b3add02d94665263c13852b0770fbbeef097

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nvbvnc.life/login/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 11 Apr 2023 08:04:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 22:52:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 625
etag: W/"14b7-5f75cc83c4c00-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=viJPqxbwu97wnsMjE14XLf7h6XkGP3K0MiiiamjL1CSiMidiB3OaH6DFIc5FcHOcrcGjV5Sn5Lzea%2BKDQDKnV8QA2PXvQUC3T%2Bw6qcb1DKHmjmwNFCGXLYgdXh9Hp9yGZTwdr3OdnVyQsw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7b61b8885f4c06b9-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery.min.js Show response
nvbvnc.life/login/files/ 85 KB
31 KB 23ms
20ms Script
application/javascript 2606:4700:3032::6815:3307
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvbvnc.life/login/files/jquery.min.js
Requested by: Host: nvbvnc.life
URL: https://nvbvnc.life/login/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:3307 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nvbvnc.life/login/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 11 Apr 2023 08:04:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 22:52:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 625
etag: W/"15391-5f75cc83c4c00-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KzJQp3%2B7aCcQxWonBVO69ta1ORZVzPzSdLfl7xabOK0M8kUbFAk5CdZVwsMN4hz3x%2BYmjqskhIT71rjW0vphLODmuQAp5ByyzEMFVVaFhLMsv0gpwtSLDfBrXxZawuCYLWAk9uKKshhKXg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7b61b8885f4f06b9-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 eb32f84b17.js Show response
nvbvnc.life/login/files/ 11 KB
4 KB 14ms
11ms Script
application/javascript 2606:4700:3032::6815:3307
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvbvnc.life/login/files/eb32f84b17.js
Requested by: Host: nvbvnc.life
URL: https://nvbvnc.life/login/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:3307 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14342dd2b960f5005eb7976420e312661a7ab1bc080350eebd06b227000bc483

Request headers

Referer: https://nvbvnc.life/login/
Origin: https://nvbvnc.life
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 11 Apr 2023 08:04:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 22:52:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 625
etag: W/"2b11-5f75cc83c4c00-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SHgwhzVzv45d8MFOmJziKXpSMoC1DThdFUOSdMmHlOu38N8othlO3s3hEDFUp7L2wPZVKoZSeiyxOts5yL6pLC0QenC0RKwJqI2LcDKZwWgwr7PIKR8oCRyF5bQEXGHTKDqIB9MgbAF23g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7b61b8885f5206b9-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 858f5fc6c36c6f7a6fb9ecde1d295f4ff988f43054379702063cca9054107681

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 1Ptvg83HX_SGhgqk3wot.woff2
fonts.gstatic.com/s/mulish/v12/ 27 KB
27 KB 44ms
4ms Font
font/woff2 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/mulish/v12/1Ptvg83HX_SGhgqk3wot.woff2

Requested by

Host: nvbvnc.life
URL: https://nvbvnc.life/login/files/css2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8da72dacca3725d500bc789e5f506c76367804eecc46c4249ce0ff822d7a147e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nvbvnc.life/
Origin: https://nvbvnc.life
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 04 Apr 2023 10:52:22 GMT
x-content-type-options: nosniff
age: 594746
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27428
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:51 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Apr 2024 10:52:22 GMT

GET
H2 200 free.min.css Show response
ka-f.fontawesome.com/releases/v5.15.4/css/ 59 KB
13 KB 22ms
14ms Fetch
text/css 2606:4700:e4::ac40:a916
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=eb32f84b17
Requested by: Host: nvbvnc.life
URL: https://nvbvnc.life/login/files/eb32f84b17.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a916 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nvbvnc.life/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 11 Apr 2023 08:04:48 GMT
via: 1.1 5fa8781927f0b3b53d2119c9d6e2e874.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: NRT20-C1
age: 816
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B9BhZmkCPsDAzYFNtpX5mzCdoQeqRoyiStlgmA8QvJpy202iFDit0FX80wVzwhbZE3cWoJ8qQR7QxKELDis%2F%2FAjZlg37xuoC7JMo3%2FBzYUGiAOA2ZTONR4j9z9CoU94jwKKKqewz9QDoqyD%2Fe5FTCT1%2Bkw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7b61b88a0bbdf6ad-NRT
access-control-allow-headers: fa-kit-token
x-amz-cf-id: 9ta0CC31Oi3l-hLP9YP55QsjK1xvSazuvFsNxADVbdUAbRDk5c4i6g==

GET
H2 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v5.15.4/css/ 26 KB
4 KB 21ms
13ms Fetch
text/css 2606:4700:e4::ac40:a916
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=eb32f84b17
Requested by: Host: nvbvnc.life
URL: https://nvbvnc.life/login/files/eb32f84b17.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a916 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nvbvnc.life/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 11 Apr 2023 08:04:48 GMT
via: 1.1 307a97273db3ed9a5fe03619bd9907b4.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: NRT20-C1
age: 816
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
etag: W/"76f34b71fc9fb641507ff6a822cc07f5"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ho4%2Bx5Pru%2Fedgiz7xAbTSpRlp85gaaq30j6m1ym%2FNgyki%2B%2FzRh4mxUVNTAexWDj3W%2BcXN9BBiTW67BV1ULkgAlWJ7NpJXHhzRRvrwi5XU076JW%2Bb9DAYpCzBaU0DfeHqwoVeIU9KcjsDBkhpWs5MjN1iIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7b61b88a0bc0f6ad-NRT
access-control-allow-headers: fa-kit-token
x-amz-cf-id: Z3lPMicDbVXJE2XmoekFda18rKdzaZpQXQf66bgfumXmxxZRBDSr1g==

GET
H2 200 free-v4-font-face.min.css Show response
ka-f.fontawesome.com/releases/v5.15.4/css/ 3 KB
2 KB 17ms
10ms Fetch
text/css 2606:4700:e4::ac40:a916
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-font-face.min.css?token=eb32f84b17
Requested by: Host: nvbvnc.life
URL: https://nvbvnc.life/login/files/eb32f84b17.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a916 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://nvbvnc.life/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 11 Apr 2023 08:04:48 GMT
via: 1.1 3169a86fe70f3974b3b8377d728ccf44.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: NRT20-C1
age: 816
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
etag: W/"f2e0b2680d9b0bcb6e0039c4424e5a59"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ER0dqLyFP2wDvkDgE47cOslPHa5eeLwhEh9UxtQMqgpvkehfrukGDB9UWdYxsBwdpMfl3%2FwOnMrhvFFkwrAGXIh7TGIcbum4GBplspd%2FVjuA%2Fju0uDDUhyOqUVGRe3Px%2FGi2B3h6Cmg1tAi2qkKK0ivqkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7b61b88a0bc1f6ad-NRT
access-control-allow-headers: fa-kit-token
x-amz-cf-id: vGfBU0uXWg0BjliRg0rjzB9CQc3WWltpRfE2PAYmsIAFtCeD6r5cNw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Novobanco (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery object| FontAwesomeKitConfig

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			nvbvnc.life/	1970-01-20 11:00:03	Name: CookieContador Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
ka-f.fontawesome.com
nvbvnc.life
2404:6800:4004:801::2003
2606:4700:3032::6815:3307
2606:4700:3034::ac43:d827
2606:4700:e4::ac40:a916
14342dd2b960f5005eb7976420e312661a7ab1bc080350eebd06b227000bc483
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
53623570cb0f4d17c9bc7abbab37729d46ffb165dac144348ec7fa25b1e8e7e2
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6
858f5fc6c36c6f7a6fb9ecde1d295f4ff988f43054379702063cca9054107681
8da72dacca3725d500bc789e5f506c76367804eecc46c4249ce0ff822d7a147e
cd13896ab186c6b592a29edda3b6b3add02d94665263c13852b0770fbbeef097
eb24d848aac27f7b8bcf57cb15f85c9732e4fe153e3916d5c745ef5fca2ef1ac
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

nvbvnc.life Open in urlscan Pro 2606:4700:3032::6815:3307 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

118 kBTransfer

330 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

nvbvnc.life Open in urlscan Pro
2606:4700:3032::6815:3307 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

118 kB
Transfer

330 kB
Size

1
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!