urlscan.io logo urlscan.io
SecurityTrails logo

go2touch.ca Open in urlscan Pro
192.124.249.70  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
Submission: On September 10 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 192.124.249.70, located in Menifee, United States and belongs to SUCURI-SEC, US. The main domain is go2touch.ca.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on August 30th 2021. Valid for: a year.
This is the only time go2touch.ca was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

IP Address AS Autonomous System
8 192.124.249.70 30148 (SUCURI-SEC)
8 1
Apex Domain
Subdomains		 Transfer
8 go2touch.ca
go2touch.ca
124 KB
8 1
Domain Requested by
8 go2touch.ca go2touch.ca
8 1

This site contains no links.

Subject Issuer Validity Valid
*.sucuri.net
Go Daddy Secure Certificate Authority - G2		 2021-08-30 -
2022-10-01		 a year crt.sh

This page contains 1 frames:

Primary Page: https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
Frame ID: C46D48805682F7BBD8F02D7948822AF3
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Itau Card | Promoção Descontão

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

124 kB
Transfer

122 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request promocao.php
go2touch.ca/vendor/psy/psysh/2021/ 		3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.124.249.70 Menifee, United States, ASN30148 (SUCURI-SEC, US),
Reverse DNS
cloudproxy10070.sucuri.net
Software
nginx /
Resource Hash
dc4278363fd3946c65ab1a342ed6ff956b47bb8b8520044455257c39129e92aa
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
go2touch.ca
:scheme
https
:path
/vendor/psy/psysh/2021/promocao.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
nginx
date
Fri, 10 Sep 2021 01:07:51 GMT
content-type
text/html; charset=UTF-8
x-sucuri-id
15020
x-xss-protection
1; mode=block
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests;
x-sucuri-cache
HIT
jquery-3.js
go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/ 		85 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/jquery-3.js
Requested by
Host: go2touch.ca
URL: https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.124.249.70 Menifee, United States, ASN30148 (SUCURI-SEC, US),
Reverse DNS
cloudproxy10070.sucuri.net
Software
nginx /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/vendor/psy/psysh/2021/promocao_arquivos/jquery-3.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
go2touch.ca
referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 10 Sep 2021 01:07:51 GMT
x-content-type-options
nosniff
last-modified
Tue, 10 Sep 2019 00:37:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-sucuri-cache
HIT
cache-control
max-age=315360000
x-sucuri-id
15020
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
86659
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.js
go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/ 		5 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/jquery.js
Requested by
Host: go2touch.ca
URL: https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.124.249.70 Menifee, United States, ASN30148 (SUCURI-SEC, US),
Reverse DNS
cloudproxy10070.sucuri.net
Software
nginx /
Resource Hash
f830833b6661d5fb63e23d3d245e91edc7c52aa547ca19eca7c91c7570483975
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/vendor/psy/psysh/2021/promocao_arquivos/jquery.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
go2touch.ca
referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 10 Sep 2021 01:07:51 GMT
x-content-type-options
nosniff
last-modified
Tue, 10 Sep 2019 00:37:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-sucuri-cache
HIT
cache-control
max-age=315360000
x-sucuri-id
15020
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
4860
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT
cad_promo_scripts.js
go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/ 		4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/cad_promo_scripts.js
Requested by
Host: go2touch.ca
URL: https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.124.249.70 Menifee, United States, ASN30148 (SUCURI-SEC, US),
Reverse DNS
cloudproxy10070.sucuri.net
Software
nginx /
Resource Hash
ce63f786a482c5eaa4bb2c7eb8e2d3ba73faff151ac0c000181affc197b8332c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/vendor/psy/psysh/2021/promocao_arquivos/cad_promo_scripts.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
go2touch.ca
referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 10 Sep 2021 01:07:51 GMT
x-content-type-options
nosniff
last-modified
Tue, 10 Sep 2019 00:37:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-sucuri-cache
HIT
cache-control
max-age=315360000
x-sucuri-id
15020
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
4062
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT
cad_promo_style.css
go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/ 		4 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/cad_promo_style.css
Requested by
Host: go2touch.ca
URL: https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.124.249.70 Menifee, United States, ASN30148 (SUCURI-SEC, US),
Reverse DNS
cloudproxy10070.sucuri.net
Software
nginx /
Resource Hash
b0a024c37059b49943a42ede1abaa432aa6284eed892f973d317e044637f6114
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/vendor/psy/psysh/2021/promocao_arquivos/cad_promo_style.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
go2touch.ca
referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 10 Sep 2021 01:07:51 GMT
x-content-type-options
nosniff
last-modified
Tue, 10 Sep 2019 00:37:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
text/css
x-sucuri-cache
HIT
cache-control
max-age=315360000
x-sucuri-id
15020
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
4534
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT
img_logo.png
go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/img_logo.png
Requested by
Host: go2touch.ca
URL: https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.124.249.70 Menifee, United States, ASN30148 (SUCURI-SEC, US),
Reverse DNS
cloudproxy10070.sucuri.net
Software
nginx /
Resource Hash
47dcffe92172b4e92928fe5660d916143f21c85e59fe22e8fd81bc2490d60cba
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/vendor/psy/psysh/2021/promocao_arquivos/img_logo.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
go2touch.ca
referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 10 Sep 2021 01:07:51 GMT
x-content-type-options
nosniff
last-modified
Tue, 10 Sep 2019 00:37:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
image/png
x-sucuri-cache
HIT
cache-control
max-age=315360000
x-sucuri-id
15020
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
3411
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT
img_card_cvv.png
go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/img_card_cvv.png
Requested by
Host: go2touch.ca
URL: https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.124.249.70 Menifee, United States, ASN30148 (SUCURI-SEC, US),
Reverse DNS
cloudproxy10070.sucuri.net
Software
nginx /
Resource Hash
a8f1348836f7de077732c927fcfc7eaf2fcb82202b4323fba31aaa3b9881ae42
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/vendor/psy/psysh/2021/promocao_arquivos/img_card_cvv.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
go2touch.ca
referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 10 Sep 2021 01:07:51 GMT
x-content-type-options
nosniff
last-modified
Tue, 10 Sep 2019 00:37:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
image/png
x-sucuri-cache
HIT
cache-control
max-age=315360000
x-sucuri-id
15020
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
9030
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT
ic_help_cvv.html
go2touch.ca/vendor/psy/psysh/2021/imagenss/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://go2touch.ca/vendor/psy/psysh/2021/imagenss/ic_help_cvv.html
Requested by
Host: go2touch.ca
URL: https://go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/cad_promo_style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.124.249.70 Menifee, United States, ASN30148 (SUCURI-SEC, US),
Reverse DNS
cloudproxy10070.sucuri.net
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/vendor/psy/psysh/2021/imagenss/ic_help_cvv.html
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
go2touch.ca
referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/cad_promo_style.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://go2touch.ca/vendor/psy/psysh/2021/promocao_arquivos/cad_promo_style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 10 Sep 2021 01:07:52 GMT
x-content-type-options
nosniff
last-modified
Tue, 10 Sep 2019 00:37:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
text/html
x-sucuri-cache
MISS
x-sucuri-id
15020
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
8759
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery function| validatefrmcad function| conterror function| validateckfrm

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block