cliente.resgatepontos-2023.com
Open in
urlscan Pro
2606:4700:3030::ac43:d2f5
Malicious Activity!
Public Scan
Effective URL: https://cliente.resgatepontos-2023.com/
Submission: On August 16 via manual from BR — Scanned from DE
Summary
TLS certificate: Issued by E1 on August 12th 2023. Valid for: 3 months.
This is the only time cliente.resgatepontos-2023.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Livelo (E-commerce) Banco do Brasil (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 192.185.215.219 192.185.215.219 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
8 | 2606:4700:303... 2606:4700:3030::ac43:d2f5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:303... 2606:4700:3037::ac43:c00e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 3 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: vega-ip07.prodns.com.br
bemblogado.com.br |
ASN13335 (CLOUDFLARENET, US)
cliente.resgatepontos-2023.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
resgatepontos-2023.com
cliente.resgatepontos-2023.com |
308 KB |
2 |
atm-bb.com
wwi.atm-bb.com |
379 B |
2 |
bemblogado.com.br
2 redirects
bemblogado.com.br |
356 B |
10 | 3 |
Domain | Requested by | |
---|---|---|
8 | cliente.resgatepontos-2023.com |
cliente.resgatepontos-2023.com
|
2 | wwi.atm-bb.com |
cliente.resgatepontos-2023.com
|
2 | bemblogado.com.br | 2 redirects |
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
resgatepontos-2023.com E1 |
2023-08-12 - 2023-11-10 |
3 months | crt.sh |
atm-bb.com GTS CA 1P5 |
2023-07-20 - 2023-10-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cliente.resgatepontos-2023.com/
Frame ID: FE177984F336E7650EEBFA189A2896A7
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
-AppPage URL History Show full URLs
-
http://bemblogado.com.br/?to=
HTTP 301
https://bemblogado.com.br/site/?to= HTTP 302
https://cliente.resgatepontos-2023.com/ Page URL
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- <[^>]+\sdata-v(?:ue)?-
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bemblogado.com.br/?to=
HTTP 301
https://bemblogado.com.br/site/?to= HTTP 302
https://cliente.resgatepontos-2023.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
cliente.resgatepontos-2023.com/ Redirect Chain
|
520 B 739 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.4dd75ca3.js
cliente.resgatepontos-2023.com/js/ |
206 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.1209aa28.js
cliente.resgatepontos-2023.com/js/ |
41 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.cfcc1128.css
cliente.resgatepontos-2023.com/css/ |
185 KB 129 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
criar
wwi.atm-bb.com/acesso/ |
0 0 |
Preflight
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
criar
wwi.atm-bb.com/acesso/ |
61 B 379 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
xpt0-log-liv.2c7a4267.svg
cliente.resgatepontos-2023.com/img/ |
5 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bblogos.52be742d.png
cliente.resgatepontos-2023.com/img/ |
59 KB 60 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.934c4b7c.woff2
cliente.resgatepontos-2023.com/fonts/ |
11 KB 11 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.0e4fe491.woff2
cliente.resgatepontos-2023.com/fonts/ |
11 KB 11 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Livelo (E-commerce) Banco do Brasil (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| webpackChunkbitmart boolean| __INTLIFY_PROD_DEVTOOLS__ boolean| __VUE_I18N_FULL_INSTALL__ boolean| __VUE_I18N_LEGACY_API__ boolean| __VUE__0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bemblogado.com.br
cliente.resgatepontos-2023.com
wwi.atm-bb.com
192.185.215.219
2606:4700:3030::ac43:d2f5
2606:4700:3037::ac43:c00e
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
2220d04132f5cfab8156477b68ded07a22c8aad051d399ff0fd174b9732e697d
2e24faa51ba630099078dd83f7189b35fd2a2087d0f84e568553be1e99f7818a
46d551b35ddd0f9b7e5b3072bcabb0093b8808bbb64c50f93efed5cc444ba608
53c1858fc68d3955defb518c624fd1c8c5a26038e87de1001420367af6c99aff
692ee04dd9488f890f4768ef27f2a7d8d3f7b8cd3bd478e7b60b82aefe557854
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
991e867ad2b72df53b7e557dc022282e749c71cfd4733f5e7e48002cf065f431
a93839a2c1e9457a6a66474a128ae6221798e5fec089c172e8160b592584dd93
da87fde36c22fee167f227fed714b078a8d280f1bc636f4ed3e3e6ae1f1472d3