www.agnacional.com.br Open in urlscan Pro
162.241.47.79 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://cerradomalte.com.br/tree
Effective URL:
https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Submission: On September 03 via manual (September 3rd 2020, 12:20:37 pm UTC) from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 162.241.47.79, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is www.agnacional.com.br.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 14th 2020. Valid for: 3 months.

This is the only time www.agnacional.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a03:b0c0:1:e... 2a03:b0c0:1:e0::397:3001	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1 2	2606:4700:303... 2606:4700:3034::ac43:b119	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 13	162.241.47.79 162.241.47.79	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
12	2

1 2a03:b0c0:1:e0::397:3001 (London, United Kingdom) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

cerradomalte.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3034::ac43:b119 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.cerradomalte.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 162.241.47.79 (Provo, United States) 2 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps.agnacional.com.br

www.agnacional.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	agnacional.com.br 2 redirects www.agnacional.com.br	480 KB
3	cerradomalte.com.br 2 redirects cerradomalte.com.br www.cerradomalte.com.br	2 KB
12	2

	Domain	Requested by
13	www.agnacional.com.br	2 redirects www.agnacional.com.br
2	www.cerradomalte.com.br	1 redirects
1	cerradomalte.com.br	1 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid
www.agnacional.com.br Let's Encrypt Authority X3	`2020-07-14` - `2020-10-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Frame ID: 95752DF19470BB9F91114DD813BDE18F
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://cerradomalte.com.br/tree HTTP 301
http://www.cerradomalte.com.br/tree HTTP 301
http://www.cerradomalte.com.br/tree/ Page URL
https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/index.php HTTP 302
https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc HTTP 301
https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

12
Requests

92 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

480 kB
Transfer

477 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cerradomalte.com.br/tree HTTP 301
http://www.cerradomalte.com.br/tree HTTP 301
http://www.cerradomalte.com.br/tree/ Page URL
https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/index.php HTTP 302
https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc HTTP 301
https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://cerradomalte.com.br/tree HTTP 301
http://www.cerradomalte.com.br/tree HTTP 301
http://www.cerradomalte.com.br/tree/

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set / Show response
www.cerradomalte.com.br/tree/
Redirect Chain

http://cerradomalte.com.br/tree
http://www.cerradomalte.com.br/tree
http://www.cerradomalte.com.br/tree/

170 B
818 B

1562ms
1561ms

Document
text/html

2606:4700:3034::ac43:b119
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://www.cerradomalte.com.br/tree/

Protocol

HTTP/1.1

Server

2606:4700:3034::ac43:b119 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.0.33-30+ubuntu16.04.1+deb.sury.org+1

Resource Hash

52902c490ab6a22be69c83c3b9cd20172e805f8c092ee23d97d5f4ab1adb3a70

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: www.cerradomalte.com.br
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Cookie: __cfduid=db64b60d1a9960d91904b1d417252dc891599135615
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, must-revalidate
Cf-Railgun: direct (waiting for pending WAN connection)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Set-Cookie: PHPSESSID=1juvth83akaafri9fs1d1837m3; path=/
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.0.33-30+ubuntu16.04.1+deb.sury.org+1
CF-Cache-Status: DYNAMIC
cf-request-id: 04f58225e50000d715239b3200000001
Server: cloudflare
CF-RAY: 5ccf6c830c16d715-FRA
Content-Encoding: gzip

Redirect headers

Date: Thu, 03 Sep 2020 12:20:16 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=db64b60d1a9960d91904b1d417252dc891599135615; expires=Sat, 03-Oct-20 12:20:15 GMT; path=/; domain=.cerradomalte.com.br; HttpOnly; SameSite=Lax
Cf-Railgun: direct (starting new WAN connection)
Location: http://www.cerradomalte.com.br/tree/
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
cf-request-id: 04f58222fc0000d7152397e200000001
Server: cloudflare
CF-RAY: 5ccf6c7e6eced715-FRA

GET
H/1.1

200
OK

Primary Request

Cookie set / Show response
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Redirect Chain

https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/index.php
https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc
https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/

12 KB
12 KB

209ms
208ms

Document
text/html

162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash: c687f4b606e85ba4dbbedc39c4f791603bd0fce63a8f1ddf67a08848d0961fc5

Request headers

Host: www.agnacional.com.br
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: http://www.cerradomalte.com.br/tree/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://www.cerradomalte.com.br/tree/

Response headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=ghhmfjssfmgv95ujh38q4o15m2; path=/
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Server: Apache
Location: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Content-Length: 305
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK blue-ui.css
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/ 258 KB
258 KB 128ms
123ms Stylesheet
text/css 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/blue-ui.css
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash: 80a18543ba3fff90a23a10df2d435680fcefee6c962dd9d20ab3f51c2abaf162

Request headers

Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Last-Modified: Thu, 03 Sep 2020 12:20:17 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 263831

GET
H/1.1 200
OK logon.css
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/ 65 KB
66 KB 126ms
122ms Stylesheet
text/css 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/logon.css
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash: 2e8c3233428a93ef9bb4be8188eaed6dbbfa559618f014b08cc6c97dd6ff8bfb

Request headers

Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Last-Modified: Thu, 03 Sep 2020 12:20:17 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 66913

GET
H/1.1 200
OK chase.png
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/ 18 KB
19 KB 368ms
121ms Image
image/png 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/chase.png
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash: be2e9a139a53a358658b746924656ebcb08cafe09636949e4cdcd2cde9ce6d5d

Request headers

Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Last-Modified: Thu, 03 Sep 2020 12:20:17 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 18850

GET
H/1.1 200
OK Capture.PNG
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/ 1 KB
1 KB 373ms
123ms Image
image/png 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/Capture.PNG
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash: 922579c97e77c029923625e04383db0a7d2060e94170a7493f7f15b111eb832b

Request headers

Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Last-Modified: Thu, 03 Sep 2020 12:20:17 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1062

GET
H/1.1 200
OK background.mobile.night.4.jpeg
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/ 87 KB
88 KB 375ms
128ms Image
image/jpeg 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/background.mobile.night.4.jpeg
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash: 4dcf3aa360ee96e6cf8b9f57b214499e20503a3c24eb0ffb8f2229e3c2114795

Request headers

Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Last-Modified: Thu, 03 Sep 2020 12:20:17 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 89366

GET
H/1.1 200
OK opensans-semibold.woff
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/ 25 KB
25 KB 121ms
121ms Font
font/woff 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/opensans-semibold.woff
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash: d2113460c69de50edc6206a20deec3c2bc2733929f53817f1faca74ab34c33e3

Request headers

Origin: https://www.agnacional.com.br
Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Last-Modified: Thu, 03 Sep 2020 12:20:17 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 25108

GET
H/1.1 200
OK /
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/ 12 KB
12 KB 211ms
211ms Font
text/html 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash: c687f4b606e85ba4dbbedc39c4f791603bd0fce63a8f1ddf67a08848d0961fc5

Request headers

Origin: https://www.agnacional.com.br
Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Sep 2020 12:20:18 GMT
Server: Apache
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Keep-Alive: timeout=5, max=96
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 404
Not Found dcefont.woff
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/fonts/ 0
0 124ms
123ms Font
text/html 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/fonts/dcefont.woff
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/blue-ui.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash

Request headers

Origin: https://www.agnacional.com.br
Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/blue-ui.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:18 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found dcefont.ttf
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/fonts/ 0
0 123ms
123ms Font
text/html 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/fonts/dcefont.ttf
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/blue-ui.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash

Request headers

Origin: https://www.agnacional.com.br
Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/blue-ui.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:19 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found opensans-regular.ttf
www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/ 0
0 123ms
123ms Font
text/html 162.241.47.79
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/css/opensans-regular.ttf
Requested by: Host: www.agnacional.com.br
URL: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.47.79 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps.agnacional.com.br
Software: Apache /
Resource Hash

Request headers

Origin: https://www.agnacional.com.br
Referer: https://www.agnacional.com.br/pleitocom/.well-known/Chase/Chase/6daa64c2a72188c8699f4b61d1611cdc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Sep 2020 12:20:19 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=95
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.agnacional.com.br/	1969-12-31 23:59:59	Name: PHPSESSID Value: ghhmfjssfmgv95ujh38q4o15m2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cerradomalte.com.br
www.agnacional.com.br
www.cerradomalte.com.br
162.241.47.79
2606:4700:3034::ac43:b119
2a03:b0c0:1:e0::397:3001
2e8c3233428a93ef9bb4be8188eaed6dbbfa559618f014b08cc6c97dd6ff8bfb
4dcf3aa360ee96e6cf8b9f57b214499e20503a3c24eb0ffb8f2229e3c2114795
52902c490ab6a22be69c83c3b9cd20172e805f8c092ee23d97d5f4ab1adb3a70
80a18543ba3fff90a23a10df2d435680fcefee6c962dd9d20ab3f51c2abaf162
922579c97e77c029923625e04383db0a7d2060e94170a7493f7f15b111eb832b
be2e9a139a53a358658b746924656ebcb08cafe09636949e4cdcd2cde9ce6d5d
c687f4b606e85ba4dbbedc39c4f791603bd0fce63a8f1ddf67a08848d0961fc5
d2113460c69de50edc6206a20deec3c2bc2733929f53817f1faca74ab34c33e3

www.agnacional.com.br Open in urlscan Pro 162.241.47.79 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

92 %HTTPS

67 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

480 kBTransfer

477 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

www.agnacional.com.br Open in urlscan Pro
162.241.47.79 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

480 kB
Transfer

477 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!