itauenptovvrsos.atsnx.com
Open in
urlscan Pro
185.27.134.221
Malicious Activity!
Public Scan
Effective URL: http://itauenptovvrsos.atsnx.com/?i=1
Submission: On March 08 via api from PY — Scanned from GB
Summary
This is the only time itauenptovvrsos.atsnx.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 185.27.134.221 185.27.134.221 | 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited) | |
6 | 2a00:1450:400... 2a00:1450:4001:830::2002 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:82b::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:400d:805::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::2002 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:400d:802::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::2004 | 15169 (GOOGLE) (GOOGLE) | |
25 | 8 |
ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
itauenptovvrsos.atsnx.com |
ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com |
ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
partner.googleadservices.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 101 tpc.googlesyndication.com — Cisco Umbrella Rank: 136 |
204 KB |
9 |
atsnx.com
itauenptovvrsos.atsnx.com |
171 KB |
3 |
doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 28 |
5 KB |
2 |
google.com
adservice.google.com — Cisco Umbrella Rank: 65 www.google.com — Cisco Umbrella Rank: 2 |
2 KB |
1 |
google.de
adservice.google.de — Cisco Umbrella Rank: 8682 |
531 B |
1 |
googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 863 |
603 B |
25 | 6 |
Domain | Requested by | |
---|---|---|
9 | itauenptovvrsos.atsnx.com |
itauenptovvrsos.atsnx.com
|
6 | pagead2.googlesyndication.com |
itauenptovvrsos.atsnx.com
pagead2.googlesyndication.com tpc.googlesyndication.com |
3 | tpc.googlesyndication.com |
pagead2.googlesyndication.com
tpc.googlesyndication.com |
3 | googleads.g.doubleclick.net |
pagead2.googlesyndication.com
|
1 | www.google.com |
tpc.googlesyndication.com
|
1 | adservice.google.com |
pagead2.googlesyndication.com
|
1 | adservice.google.de |
pagead2.googlesyndication.com
|
1 | partner.googleadservices.com |
pagead2.googlesyndication.com
|
25 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.g.doubleclick.net GTS CA 1C3 |
2023-02-20 - 2023-05-15 |
3 months | crt.sh |
*.googleadservices.com GTS CA 1C3 |
2023-02-20 - 2023-05-15 |
3 months | crt.sh |
*.google.de GTS CA 1C3 |
2023-02-08 - 2023-05-03 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-02-20 - 2023-05-15 |
3 months | crt.sh |
tpc.googlesyndication.com GTS CA 1C3 |
2023-02-08 - 2023-05-03 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2023-02-20 - 2023-05-15 |
3 months | crt.sh |
This page contains 6 frames:
Primary Page:
http://itauenptovvrsos.atsnx.com/?i=1
Frame ID: B71A60C75D6A21FE67DBB0D7B87AF253
Requests: 17 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/html/r20230306/r20190131/zrt_lookup.html
Frame ID: 16827DBCC31696FDEA2ED59969C8DF27
Requests: 1 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6325096445581587&output=html&adk=1812271804&adf=3025194257&lmt=1678278616&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x945_l%7C500x945_r&format=0x0&url=http%3A%2F%2Fitauenptovvrsos.atsnx.com%2F%3Fi%3D1&ea=0&pra=5&wgl=1&dt=1678304311203&bpp=2&bdt=401&idt=398&shv=r20230306&mjsv=m202302210101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3409603318820&frm=20&pv=2&ga_vid=635441081.1678304312&ga_sid=1678304312&ga_hid=144398880&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44777877%2C44759876%2C44759927%2C44759837%2C31071642%2C31072791%2C31071261&oid=2&pvsid=3174467218955649&tmod=2050382472&uas=0&nvt=1&ref=http%3A%2F%2Fitauenptovvrsos.atsnx.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=413
Frame ID: 0C0AD78C3F8D0E2A955798DA3E25C8F2
Requests: 1 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6325096445581587&output=html&h=280&slotname=9540245809&adk=298986885&adf=683863926&pi=t.ma~as.9540245809&w=1200&fwrn=4&fwrnh=100&lmt=1678278616&rafmt=1&format=1200x280&url=http%3A%2F%2Fitauenptovvrsos.atsnx.com%2F%3Fi%3D1&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1678304311205&bpp=1&bdt=403&idt=416&shv=r20230306&mjsv=m202302210101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3409603318820&frm=20&pv=1&ga_vid=635441081.1678304312&ga_sid=1678304312&ga_hid=144398880&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=200&ady=1200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44777877%2C44759876%2C44759927%2C44759837%2C31071642%2C31072791%2C31071261&oid=2&pvsid=3174467218955649&tmod=2050382472&uas=0&nvt=1&ref=http%3A%2F%2Fitauenptovvrsos.atsnx.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEebr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=2&uci=a!2&fsb=1&xpc=pyxUK972yl&p=http%3A//itauenptovvrsos.atsnx.com&dtd=419
Frame ID: 6411C8BCEA3C91D5648073A1DD585E0A
Requests: 1 HTTP requests in this frame
Frame:
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: C1BCA2DB70B4CE027C968527CA35706A
Requests: 3 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/aframe
Frame ID: B20B6CEBD26778BE607C7773F7678CE2
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
InicioPage URL History Show full URLs
- http://itauenptovvrsos.atsnx.com/ Page URL
- http://itauenptovvrsos.atsnx.com/?i=1 Page URL
Detected technologies
Google AdSense (Advertising Networks) ExpandDetected patterns
- googlesyndication\.com/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://itauenptovvrsos.atsnx.com/ Page URL
- http://itauenptovvrsos.atsnx.com/?i=1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
itauenptovvrsos.atsnx.com/ |
836 B 832 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aes.js
itauenptovvrsos.atsnx.com/ |
30 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
itauenptovvrsos.atsnx.com/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lgn.css
itauenptovvrsos.atsnx.com/ff/ |
141 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LOGO_ita.png
itauenptovvrsos.atsnx.com/ff/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bottom.png
itauenptovvrsos.atsnx.com/ff/ |
28 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ |
142 KB 48 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
air-blog.jpg
itauenptovvrsos.atsnx.com/ff/ |
28 KB 28 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
requerido_ban.png
itauenptovvrsos.atsnx.com/login/css/custom-theme/images/ |
12 KB 12 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans.woff
itauenptovvrsos.atsnx.com/Fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202302210101/ |
360 KB 119 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20230306/r20190131/ Frame 1682 |
10 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookie.js
partner.googleadservices.com/gampad/ |
385 B 603 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.de/adsid/ |
107 B 531 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.com/adsid/ |
107 B 456 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
googleads.g.doubleclick.net/pagead/ Frame 0C0A |
603 B 245 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
googleads.g.doubleclick.net/pagead/ Frame 6411 |
603 B 211 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar
pagead2.googlesyndication.com/getconfig/ |
15 KB 11 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar2.js
tpc.googlesyndication.com/sodar/ |
17 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C1BC |
13 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aframe
www.google.com/recaptcha/api2/ Frame B20B |
783 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hTGw0iTttGPYNj9jnBVYIcaXVb8tbW1IYYT-gsExgL0.js
pagead2.googlesyndication.com/bg/ Frame C1BC |
36 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sodar
pagead2.googlesyndication.com/pagead/ Frame B20B |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
generate_204
tpc.googlesyndication.com/ Frame C1BC |
0 10 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sodar
pagead2.googlesyndication.com/pagead/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 boolean| credentialless function| soloNumeros object| adsbygoogle object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac object| google_persistent_state_async boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue function| google_process_slots function| google_spfd number| google_unique_id object| google_sv_map number| google_lpabyc number| google_rum_task_id_counter function| google_sa_impl object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| gaGlobal object| ampInaboxIframes object| ampInaboxPendingMessages object| GoogleGcLKhOms object| google_image_requests4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
itauenptovvrsos.atsnx.com/ | Name: __test Value: d3df92f47202f75e9e35530a81065d86 |
|
.atsnx.com/ | Name: __gads Value: ID=b6bb3eb10ca18b43-22c861c446dd00df:T=1678304311:RT=1678304311:S=ALNI_MbYAWqANJ5mBbZ0SKRSTTZFDAySwQ |
|
.atsnx.com/ | Name: __gpi Value: UID=000009d664ef9a53:T=1678304311:RT=1678304311:S=ALNI_MZESkP3z7ESp2Md44BMzwTK-blGBg |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adservice.google.com
adservice.google.de
googleads.g.doubleclick.net
itauenptovvrsos.atsnx.com
pagead2.googlesyndication.com
partner.googleadservices.com
tpc.googlesyndication.com
www.google.com
185.27.134.221
2a00:1450:4001:80e::2004
2a00:1450:4001:810::2002
2a00:1450:4001:812::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2002
2a00:1450:400d:802::2001
2a00:1450:400d:805::2002
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
0d2fe9c96779a3b94d0fdec6f2d529b6c0d026fa9efe0e19713567ab1eee629f
17c592528124567f03014c693022e882274b93c93d1e3d4baa1cff61c4989b6c
3aff6206d924c35025b595d4876ee279d1519269999e066aa8ffc41189050527
530450c99b610df9f0e84a708d7fb384e2c28ad8b9b0f05a948510b5f1cd76d3
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5f1635cd5b150431da3282b5d49edc1087953b8083b28bdd63f5d4ef2e616935
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
76460e705cc668b3f517809abed94e599230b18e920d2d865f52f54aa76b7ede
8531b0d224edb463d8363f639c155821c69755bf2d6d6d486184fe82c13180bd
8c42814f0a4e3446104a63bde425651f532aec9b18fe00d894d77a0fc7c9b876
97f0fb739b83deaa914458dcf994714d01147c71256bdde803ad28449814b17e
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
ad18b4fd7c8072fb0041a2aabeb2289c94f29f810ac9628522dfb0da6f747ccb
b1ec13d16ca0948c4a4edd58bc693ac0975f84abae70630a882646b9ba21cc8a
b23a3c815a7816bb5d35406d0d0ee7579968144af7a256d08735a49aad81b624
c62dd072c8429ea3e2c6a50f7553e289c9e836b6375baee2b71a4c7b264a38fb
ca070dfc7785775cbf5cce16064029ee534259de42c6d9de10e476e710000e93
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855