absolute-climbing-caiman.ngrok-free.app
Open in
urlscan Pro
3.134.39.220
Malicious Activity!
Public Scan
Effective URL: https://absolute-climbing-caiman.ngrok-free.app/itau/
Submission: On December 16 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on December 10th 2023. Valid for: 3 months.
This is the only time absolute-climbing-caiman.ngrok-free.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 76.76.21.9 76.76.21.9 | 16509 (AMAZON-02) (AMAZON-02) | |
1 7 | 3.134.39.220 3.134.39.220 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 151.101.2.137 151.101.2.137 | 54113 (FASTLY) (FASTLY) | |
1 | 142.251.41.10 142.251.41.10 | 15169 (GOOGLE) (GOOGLE) | |
1 | 34.117.186.192 34.117.186.192 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 | 142.251.40.131 142.251.40.131 | 15169 (GOOGLE) (GOOGLE) | |
12 | 6 |
ASN16509 (AMAZON-02, US)
izzypqxvwhtrtweuhvwieybgyucftw-noreplyservicesformore.vercel.app |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-134-39-220.us-east-2.compute.amazonaws.com
absolute-climbing-caiman.ngrok-free.app |
ASN15169 (GOOGLE, US)
PTR: lga34s40-in-f10.1e100.net
fonts.googleapis.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.186.117.34.bc.googleusercontent.com
ipinfo.io |
ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f3.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
ngrok-free.app
1 redirects
absolute-climbing-caiman.ngrok-free.app |
369 KB |
2 |
gstatic.com
fonts.gstatic.com |
31 KB |
1 |
ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 6752 |
570 B |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29 |
1 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 735 |
78 KB |
1 |
vercel.app
izzypqxvwhtrtweuhvwieybgyucftw-noreplyservicesformore.vercel.app |
519 B |
12 | 6 |
Domain | Requested by | |
---|---|---|
7 | absolute-climbing-caiman.ngrok-free.app |
1 redirects
izzypqxvwhtrtweuhvwieybgyucftw-noreplyservicesformore.vercel.app
absolute-climbing-caiman.ngrok-free.app |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | ipinfo.io |
code.jquery.com
|
1 | fonts.googleapis.com |
absolute-climbing-caiman.ngrok-free.app
|
1 | code.jquery.com |
absolute-climbing-caiman.ngrok-free.app
|
1 | izzypqxvwhtrtweuhvwieybgyucftw-noreplyservicesformore.vercel.app | |
12 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.vercel.app R3 |
2023-12-15 - 2024-03-14 |
3 months | crt.sh |
*.ngrok-free.app R3 |
2023-12-10 - 2024-03-09 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
ipinfo.io R3 |
2023-12-06 - 2024-03-05 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://absolute-climbing-caiman.ngrok-free.app/itau/
Frame ID: EC2C371A4A9B9795696D16EE185B4515
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
ItauPage URL History Show full URLs
- https://izzypqxvwhtrtweuhvwieybgyucftw-noreplyservicesformore.vercel.app/indexitau.html/ Page URL
-
https://absolute-climbing-caiman.ngrok-free.app/itau
HTTP 301
http://absolute-climbing-caiman.ngrok-free.app/itau/ HTTP 307
https://absolute-climbing-caiman.ngrok-free.app/itau/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://izzypqxvwhtrtweuhvwieybgyucftw-noreplyservicesformore.vercel.app/indexitau.html/ Page URL
-
https://absolute-climbing-caiman.ngrok-free.app/itau
HTTP 301
http://absolute-climbing-caiman.ngrok-free.app/itau/ HTTP 307
https://absolute-climbing-caiman.ngrok-free.app/itau/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
izzypqxvwhtrtweuhvwieybgyucftw-noreplyservicesformore.vercel.app/indexitau.html/ |
231 B 519 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
absolute-climbing-caiman.ngrok-free.app/itau/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
absolute-climbing-caiman.ngrok-free.app/itau/files/ |
17 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.js
code.jquery.com/ |
262 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ipinfo.io/ |
268 B 570 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
absolute-climbing-caiman.ngrok-free.app/itau/files/ |
28 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jsconeccion.js
absolute-climbing-caiman.ngrok-free.app/itau/files/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
javamagic.js
absolute-climbing-caiman.ngrok-free.app/itau/files/ |
695 B 799 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fondito.png
absolute-climbing-caiman.ngrok-free.app/itau/files/ |
318 KB 319 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery object| button1 object| username object| pass function| ACTION2 function| ACTION3 function| checkAlert1 function| checkAlert20 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
absolute-climbing-caiman.ngrok-free.app
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
ipinfo.io
izzypqxvwhtrtweuhvwieybgyucftw-noreplyservicesformore.vercel.app
142.251.40.131
142.251.41.10
151.101.2.137
3.134.39.220
34.117.186.192
76.76.21.9
0d9027289ffa5d9f6c8b4e0782bb31bbff2cef5ee3708ccbcb7a22df9128bb21
0f303f31706d39866cced9dcc17b61fb8423674278d7f6051d66b3a79ffbca18
40b28efb35697da04fc732de83240317bb102fdc28795839dea1dd4e433cdc70
4db7d493be22cd92de079c2e04060e06bc70392221d583c1f1c1c6c20d9619cb
782e3085dd2d33d68a73ef702adfb286aa5855ae2245bdd378bbe45366418278
940b5e1b96b1c50e111cc2122726c23f03a9230bcb8008a6999784c18ec0b008
a4247b8271a0993f45d0e0f5572dd9ebdcb874c91508d309ba1343a0ddb5a2e7
af94db5fb10d6311f345358cd8d3f3d67de33a161da9884c678d602aa1ef9319
bc32b339db14a4d0b6edd8719af1743f6a076d56285ae45c00d03d45c195c26f
cf0fa8dfca1233f2ec60348748c372190bab07c993c7f3ba7b7d514274764c14
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615