cliente.resgatepontos-2023.com Open in urlscan Pro
2606:4700:3030::ac43:d2f5  Malicious Activity! Public Scan

URL: https://cliente.resgatepontos-2023.com/
Submission: On August 14 via manual from BR — Scanned from DE

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3030::ac43:d2f5, located in United States and belongs to CLOUDFLARENET, US. The main domain is cliente.resgatepontos-2023.com.
TLS certificate: Issued by E1 on August 12th 2023. Valid for: 3 months.
This is the only time cliente.resgatepontos-2023.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Livelo (E-commerce) Banco do Brasil (Banking)

Domain & IP information

IP Address AS Autonomous System
8 2606:4700:303... 13335 (CLOUDFLAR...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
10 3
Apex Domain
Subdomains
Transfer
8 resgatepontos-2023.com
cliente.resgatepontos-2023.com
308 KB
2 atm-bb.com
wwi.atm-bb.com
373 B
10 2
Domain Requested by
8 cliente.resgatepontos-2023.com cliente.resgatepontos-2023.com
2 wwi.atm-bb.com cliente.resgatepontos-2023.com
10 2

This site contains no links.

Subject Issuer Validity Valid
resgatepontos-2023.com
E1
2023-08-12 -
2023-11-10
3 months crt.sh
atm-bb.com
GTS CA 1P5
2023-07-20 -
2023-10-18
3 months crt.sh

This page contains 1 frames:

Primary Page: https://cliente.resgatepontos-2023.com/
Frame ID: 557E700800BC14B64B83DC1A4C1E2D73
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

-App

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

308 kB
Transfer

523 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
cliente.resgatepontos-2023.com/
520 B
743 B
Document
General
Full URL
https://cliente.resgatepontos-2023.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:d2f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e24faa51ba630099078dd83f7189b35fd2a2087d0f84e568553be1e99f7818a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7f6be11e0aff905e-FRA
content-encoding
br
content-type
text/html
date
Mon, 14 Aug 2023 20:17:06 GMT
last-modified
Sun, 13 Aug 2023 20:03:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QEFy4aGlLrhnlWxu3Q6kwPG7sFy2HTbkE5KITSANuWXk%2Bcv4o%2FlUtJWYNjLRtvnuAlZeyQasnawRFll9OWLtKRET2N7gQusZOUZ8A8QE2YFFVThdzKGzKE0fviQfyXFjFC0cb89gMi2itQGZ%2FQo%2FdCY9bW3f%2FH%2B%2BiUDicUA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
chunk-vendors.4dd75ca3.js
cliente.resgatepontos-2023.com/js/
206 KB
73 KB
Script
General
Full URL
https://cliente.resgatepontos-2023.com/js/chunk-vendors.4dd75ca3.js
Requested by
Host: cliente.resgatepontos-2023.com
URL: https://cliente.resgatepontos-2023.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:d2f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
991e867ad2b72df53b7e557dc022282e749c71cfd4733f5e7e48002cf065f431

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.resgatepontos-2023.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Mon, 14 Aug 2023 20:17:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 12 Aug 2023 13:41:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4018
etag
W/"64d78c1d-336df"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3qWiPp7plKJGttco3mAwVGxrOiDEzM11zXFz5WHnRydWJjbubNLomXFRCdktR80t%2BfqGTc9NZBNnRvbgq6ivEdKzUh7%2B%2Bi9NkkYTpzVAiZMyCkd%2B5NReUy9YNIodKIfEQq7SpVP8nydLJ62WbNJg4M3Eucqgoak2zxXcSvQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7f6be11e7b7b905e-FRA
alt-svc
h3=":443"; ma=86400
app.1209aa28.js
cliente.resgatepontos-2023.com/js/
41 KB
20 KB
Script
General
Full URL
https://cliente.resgatepontos-2023.com/js/app.1209aa28.js
Requested by
Host: cliente.resgatepontos-2023.com
URL: https://cliente.resgatepontos-2023.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:d2f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53c1858fc68d3955defb518c624fd1c8c5a26038e87de1001420367af6c99aff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.resgatepontos-2023.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Mon, 14 Aug 2023 20:17:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 13 Aug 2023 20:03:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4018
etag
W/"64d93704-a4a6"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sn6JD0lKdccgu57GCRolhb5TOzvh%2B1b%2BcqiCmPJfz9chlXWsn8eqnLQMLpoDNY8vUxD2fKkHPZkplHzqmIafwfPlcjbBiDkixgLDNyvw%2Bf2scEaS6d4OHM4Bb8Zfn0nFiTrMJrsGVJOEvVXQm8XmAPQvENel8PtFYB96JGw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7f6be11e7b7c905e-FRA
alt-svc
h3=":443"; ma=86400
app.cfcc1128.css
cliente.resgatepontos-2023.com/css/
185 KB
128 KB
Stylesheet
General
Full URL
https://cliente.resgatepontos-2023.com/css/app.cfcc1128.css
Requested by
Host: cliente.resgatepontos-2023.com
URL: https://cliente.resgatepontos-2023.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:d2f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
46d551b35ddd0f9b7e5b3072bcabb0093b8808bbb64c50f93efed5cc444ba608

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.resgatepontos-2023.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Mon, 14 Aug 2023 20:17:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 13 Aug 2023 20:03:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4018
etag
W/"64d93704-2e482"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VGBA4C53WWkFODDGjekW5wcywFZUfsRtaamPwHkgJg3IqeghEzB%2B%2FkvMLXJJV2OpRa8g0R%2FQeUERyLUGtH0%2FKf%2BoL71x%2FuZRmCJdhNOeJUUM5fGJke2ednqDi8j13OIjlDRL6Tl%2BNTFh5P8%2FDEGfUsIbmQoIxGrQ1%2FeRsRA%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7f6be11e7b7a905e-FRA
alt-svc
h3=":443"; ma=86400
criar
wwi.atm-bb.com/acesso/
0
0
Preflight
General
Full URL
https://wwi.atm-bb.com/acesso/criar
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:1461 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://cliente.resgatepontos-2023.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin
https://cliente.resgatepontos-2023.com
allow
POST, OPTIONS
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7f6be120c86a1e30-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 14 Aug 2023 20:17:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tHngN9R%2Ftar7IFvELliS68p08aOPFULRd2OlogFszlraM5%2Bw1YA5qRBMcEcQ8FACa0s%2Bk2%2F8ucg4VaJWKZOeEVodOX3VpBepTQQNuUlK27HkXmWPWYcbsKM8NdmUFzEeyt%2BDH%2F1aAUnfHz72jQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2220d04132f5cfab8156477b68ded07a22c8aad051d399ff0fd174b9732e697d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/gif
criar
wwi.atm-bb.com/acesso/
61 B
373 B
XHR
General
Full URL
https://wwi.atm-bb.com/acesso/criar
Requested by
Host: cliente.resgatepontos-2023.com
URL: https://cliente.resgatepontos-2023.com/js/chunk-vendors.4dd75ca3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:1461 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da87fde36c22fee167f227fed714b078a8d280f1bc636f4ed3e3e6ae1f1472d3

Request headers

Accept
application/json, text/plain, */*
Referer
https://cliente.resgatepontos-2023.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 14 Aug 2023 20:17:07 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7TMH6Flm0xEkUcvCynXFOcvD0nIPOYE7FlcTLN8VA0Ud5czMsDOnarr%2F5WAU01buMHXQj19AQEJATvoDs%2F6g1FJ92g5FMpJVieKYTFPwPqQXcx3CaltiRZZkw1eoPMyTo9mktWxeGzTTW%2Bmq4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://cliente.resgatepontos-2023.com
cf-ray
7f6be1232c4a1e30-FRA
alt-svc
h3=":443"; ma=86400
xpt0-log-liv.2c7a4267.svg
cliente.resgatepontos-2023.com/img/
5 KB
3 KB
Image
General
Full URL
https://cliente.resgatepontos-2023.com/img/xpt0-log-liv.2c7a4267.svg
Requested by
Host: cliente.resgatepontos-2023.com
URL: https://cliente.resgatepontos-2023.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d2f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a93839a2c1e9457a6a66474a128ae6221798e5fec089c172e8160b592584dd93

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.resgatepontos-2023.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Mon, 14 Aug 2023 20:17:06 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 12 Aug 2023 13:41:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4017
etag
W/"64d78c1d-1437"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uJ6jkB0tNzAYaml3mOqUOpAp1o4Grce1CMMh4WnIYnipkJ%2BtvUlebTGdDNT2DTvWsN6TIDK99fQ9U%2Bgum4cd%2F7Pw0Ww3wRhuxkPbk09QQ3V6SjizmQnuKFoC6Qh2YGZr0RK%2FlfpkwL3LacM%2F%2B3tBUZgz0%2BKHPHuosw%2FtUJI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400
cf-ray
7f6be11fda358fce-FRA
alt-svc
h3=":443"; ma=86400
bblogos.52be742d.png
cliente.resgatepontos-2023.com/img/
59 KB
60 KB
Image
General
Full URL
https://cliente.resgatepontos-2023.com/img/bblogos.52be742d.png
Requested by
Host: cliente.resgatepontos-2023.com
URL: https://cliente.resgatepontos-2023.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d2f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
692ee04dd9488f890f4768ef27f2a7d8d3f7b8cd3bd478e7b60b82aefe557854

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.resgatepontos-2023.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Mon, 14 Aug 2023 20:17:06 GMT
cf-cache-status
HIT
last-modified
Sat, 12 Aug 2023 18:03:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4017
etag
"64d7c98c-ece8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oPcNnJtbxLnbNFRsSwZTdXD9oF0vfNR6PjYbwkPOI3Q0Z8%2F%2FRNYA7X7wp7wpvA4fzrAHPishsKsYRk%2Be5IbgqwW3dr%2FkPtkOGyKxvebUxaMdvYIh4pwbXdpIzx%2Bt9nF3mWzp5IS8a5z72c593fre2n1X0C6eVaL32tzLbcU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7f6be11fda368fce-FRA
alt-svc
h3=":443"; ma=86400
content-length
60648
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.934c4b7c.woff2
cliente.resgatepontos-2023.com/fonts/
11 KB
11 KB
Font
General
Full URL
https://cliente.resgatepontos-2023.com/fonts/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.934c4b7c.woff2
Requested by
Host: cliente.resgatepontos-2023.com
URL: https://cliente.resgatepontos-2023.com/css/app.cfcc1128.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d2f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f

Request headers

Referer
https://cliente.resgatepontos-2023.com/css/app.cfcc1128.css
Origin
https://cliente.resgatepontos-2023.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Mon, 14 Aug 2023 20:17:06 GMT
cf-cache-status
HIT
last-modified
Sat, 12 Aug 2023 13:41:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4017
etag
"64d78c1d-2b14"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9qSoX4pg9unKYBRukcLz0IU7Ow05rnm0oHCFnubmJvo9jsnndm2RfaHUxxXSPWCFrJb1NOyPu%2B3UIqYLL1jm2kbFot7%2FiBNKMOFjbXfcIomf9baMFfGJUrquxPWiAqn8WevlOdiAI%2FazDSw4NXBqxjPsJaturHU3S8f0MM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7f6be11fda398fce-FRA
alt-svc
h3=":443"; ma=86400
content-length
11028
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.0e4fe491.woff2
cliente.resgatepontos-2023.com/fonts/
11 KB
11 KB
Font
General
Full URL
https://cliente.resgatepontos-2023.com/fonts/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.0e4fe491.woff2
Requested by
Host: cliente.resgatepontos-2023.com
URL: https://cliente.resgatepontos-2023.com/css/app.cfcc1128.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d2f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44

Request headers

Referer
https://cliente.resgatepontos-2023.com/css/app.cfcc1128.css
Origin
https://cliente.resgatepontos-2023.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Mon, 14 Aug 2023 20:17:06 GMT
cf-cache-status
HIT
last-modified
Sat, 12 Aug 2023 13:41:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4017
etag
"64d78c1d-2b20"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C5NKi15iBhWNm5wOuYSmNmQihn23t8Vnl9oRPHtCAl9Dgt2zApo8102IY1DbbchuZE99fZK6Om81oJuDXZo7Lq1PHA%2FvTPO3uqhBe6%2FFdviVHDyMTAmkzBflBoxqxfJ6vDqr4s6Ce8tBAF5bhmBBXqJwKNuWblXlRIHcnIY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7f6be11fda3a8fce-FRA
alt-svc
h3=":443"; ma=86400
content-length
11040

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Livelo (E-commerce) Banco do Brasil (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunkbitmart boolean| __INTLIFY_PROD_DEVTOOLS__ boolean| __VUE_I18N_FULL_INSTALL__ boolean| __VUE_I18N_LEGACY_API__ boolean| __VUE__

0 Cookies