env-p-resgata-9845709.clicketcloud.com Open in urlscan Pro
46.30.203.2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php
Submission: On May 14 via api (May 14th 2023, 1:01:47 pm UTC) from US — Scanned from FR

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 3 domains to perform 11 HTTP transactions. The main IP is 46.30.203.2, located in Epernon, France and belongs to OWENTIS-AS, FR. The main domain is env-p-resgata-9845709.clicketcloud.com.

This is the only time env-p-resgata-9845709.clicketcloud.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	46.30.203.2 46.30.203.2	39444 (OWENTIS-AS) (OWENTIS-AS)
1	2606:4700::68... 2606:4700::6812:1734	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.206.208.236 23.206.208.236	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.36.162.217 23.36.162.217	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	2606:4700:e0:... 2606:4700:e0::ac40:650a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	5

2 46.30.203.2 (Epernon, France)

ASN39444 (OWENTIS-AS, FR)
PTR: ns1.clicketcloud.com

env-p-resgata-9845709.clicketcloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.206.208.236 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-206-208-236.deploy.static.akamaitechnologies.com

estatico.itau.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.36.162.217 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-162-217.deploy.static.akamaitechnologies.com

www.itau.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:e0::ac40:650a (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1602 ka-f.fontawesome.com — Cisco Umbrella Rank: 2850	59 KB
3	itau.com.br estatico.itau.com.br — Cisco Umbrella Rank: 286910 www.itau.com.br — Cisco Umbrella Rank: 71224	120 KB
2	clicketcloud.com env-p-resgata-9845709.clicketcloud.com	3 KB
11	3

	Domain	Requested by
5	ka-f.fontawesome.com	kit.fontawesome.com
2	www.itau.com.br	env-p-resgata-9845709.clicketcloud.com
2	env-p-resgata-9845709.clicketcloud.com	env-p-resgata-9845709.clicketcloud.com
1	estatico.itau.com.br	env-p-resgata-9845709.clicketcloud.com
1	kit.fontawesome.com	env-p-resgata-9845709.clicketcloud.com
11	5

This site contains no links.

Subject Issuer	Validity	Valid
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-22` - `2023-12-23`	a year	crt.sh
www.itau.com.br GeoTrust RSA CA 2018	`2023-02-24` - `2024-02-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-12` - `2023-08-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php
Frame ID: D0E91C80520DBC210C3219E41849C0A9
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Cartão de crédito | Itaú

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Page Statistics

11
Requests

82 %
HTTPS

40 %
IPv6

3
Domains

5
Subdomains

5
IPs

3
Countries

182 kB
Transfer

287 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request aguarde.php Show response
env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/ 2 KB
2 KB 58ms
22ms Document
text/html 46.30.203.2
OWENTIS-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php

Protocol

HTTP/1.1

Server

46.30.203.2 Epernon, France, ASN39444 (OWENTIS-AS, FR),

Reverse DNS

ns1.clicketcloud.com

Software

openresty /

Resource Hash

9e9680881900e158e3e40ce630847386cecdd0d9a440d9976fe073741ab42527

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1029
Content-Type: text/html; charset=UTF-8
Cross-Origin-Embedder-Policy: unsafe-none
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: same-origin
Date: Sun, 14 May 2023 13:01:41 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Permissions-Policy: geolocation=(self), payment=(self)
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: openresty
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Resolver-IP: 46.30.203.2 46.30.203.2
X-XSS-Protection: 1; mode=block;

GET
H/1.1 200
OK style.css
env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/css/ 1 KB
1 KB 22ms
21ms Stylesheet
text/css 46.30.203.2
OWENTIS-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/css/style.css

Requested by

Host: env-p-resgata-9845709.clicketcloud.com
URL: http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php

Protocol

HTTP/1.1

Server

46.30.203.2 Epernon, France, ASN39444 (OWENTIS-AS, FR),

Reverse DNS

ns1.clicketcloud.com

Software

openresty /

Resource Hash

c9c3259499e753716c17302ce3702bdb076d3a44ad8d68fbd7167e478b0a3dd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block;

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Sun, 14 May 2023 13:01:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Cross-Origin-Embedder-Policy: unsafe-none
Cross-Origin-Resource-Policy: same-origin
Connection: keep-alive
Content-Length: 550
X-XSS-Protection: 1; mode=block;
Referrer-Policy: strict-origin-when-cross-origin
Last-Modified: Mon, 20 Jun 2022 15:11:26 GMT
Server: openresty
Cross-Origin-Opener-Policy: same-origin-allow-popups
ETag: "595-5e1e284894380-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Permissions-Policy: geolocation=(self), payment=(self)
Accept-Ranges: bytes
X-Resolver-IP: 46.30.203.2, 46.30.203.2

GET
H2 200 69c628fa4e.js Show response
kit.fontawesome.com/ 11 KB
4 KB 90ms
45ms Script
text/javascript 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kit.fontawesome.com/69c628fa4e.js

Requested by

Host: env-p-resgata-9845709.clicketcloud.com
URL: http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3e540c6769ffef4193d8ed31a41b8578fcbc74567a4b8ff5588b854edc9e86b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Referer: http://env-p-resgata-9845709.clicketcloud.com/
Origin: http://env-p-resgata-9845709.clicketcloud.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 13:01:41 GMT
strict-transport-security: max-age=31536000; preload
content-encoding: gzip
cf-cache-status: MISS
server: cloudflare
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=60, public, must-revalidate
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
cf-ray: 7c7354d13e01d263-CDG
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F18EG4lhJlrk8YduHVDi

GET
H/1.1 200
OK loading_varejo.gif
estatico.itau.com.br/ibanking/pj/commons/img/ 87 KB
88 KB 341ms
78ms Image
image/gif 23.206.208.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://estatico.itau.com.br/ibanking/pj/commons/img/loading_varejo.gif
Requested by: Host: env-p-resgata-9845709.clicketcloud.com
URL: http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.206.208.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-206-208-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 30d61230c36a11389138ecd63e6fa1154e3edeb9c9069781481d0e4898187dae

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://env-p-resgata-9845709.clicketcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Sun, 14 May 2023 13:01:42 GMT
Last-Modified: Fri, 22 Jan 2021 15:21:58 GMT
ETag: "161d-15cd6-5b97ebfc61180"
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=41407
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 89302
Expires: Mon, 15 May 2023 00:31:49 GMT

GET
H2 200 logo-itau-varejo-desktop.png
www.itau.com.br/assets/images/header/ 5 KB
5 KB 193ms
102ms Image
image/webp 23.36.162.217
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itau.com.br/assets/images/header/logo-itau-varejo-desktop.png
Requested by: Host: env-p-resgata-9845709.clicketcloud.com
URL: http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.162.217 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-162-217.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: d2b82dc5a41a783638f1303c121907e4cefc8b21f8e15449d969c482893554cd

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://env-p-resgata-9845709.clicketcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 13:01:42 GMT
maite: true
last-modified: Wed, 23 Nov 2022 01:15:09 GMT
server: Akamai Image Manager
etag: "e95f6a7db1591f4886246d05f3c64fe5"
access-control-allow-methods: GET, POST, GET, POST
content-type: image/webp
access-control-allow-origin: internet.itau.com.br, internet.itau.com.br
cache-control: private, no-transform, max-age=1726603
server-timing: cdn-cache; desc=HIT, edge; dur=2, ak_p; desc="467797_399431129_1321995277_197_11203_25_0";dur=1
content-length: 4650
expires: Sat, 03 Jun 2023 12:38:25 GMT

GET
H2 200 free.min.css Show response
ka-f.fontawesome.com/releases/v6.4.0/css/ 100 KB
23 KB 98ms
56ms Fetch
text/css 2606:4700:e0::ac40:650a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.0/css/free.min.css?token=69c628fa4e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/69c628fa4e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd28ebf7bdffb45da731413ed6e6940dc60123aa120bfa5a3909a40b2a2ba7e1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://env-p-resgata-9845709.clicketcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 13:01:42 GMT
via: 1.1 17a77a72dc1e9981253a822e540e37c2.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: LHR50-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 23 Mar 2023 21:29:21 GMT
server: cloudflare
etag: W/"5febfb939e2fc4ddf14fffae53b72cf0"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uoixRtihM%2B7UufL7WC%2FJWzTq9pfTiWAAFkClapW48vmt4Xv4ws2ZkxxbQ7Acx5u37sBSwRMC8yHZeaYXY%2FQZMArT9aBFvJwM5NW6PP0%2FG7zIOQVkov5lh6ZVsi%2FqVxU5%2Bjht3D9%2BLC5q%2FBQiTZ1L6IlMWA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7c7354d1efbed174-LHR
access-control-allow-headers: fa-kit-token
x-amz-cf-id: Aw1AGgjZUlgVs-3qvbPzRTRaTnJmsDac9CQI_Mpr4jfj6mvqsgBPTQ==

GET
H2 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v6.4.0/css/ 27 KB
5 KB 308ms
266ms Fetch
text/css 2606:4700:e0::ac40:650a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v4-shims.min.css?token=69c628fa4e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/69c628fa4e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 425741cc35824b5b3b18d4135fbef6afca30662d23638366af151f7e74ba2575

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://env-p-resgata-9845709.clicketcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 13:01:42 GMT
via: 1.1 346bf51bc00fbeaa3f4c461a781bceb0.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: JFK50-P8
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 23 Mar 2023 21:29:20 GMT
server: cloudflare
etag: W/"5193a6de5225940ae4ef5f7c82126be9"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=haQeIjI0QKaGx5hnjquEAbSNuBydHKYy5ap%2BgMBP6lbV370wyOV%2BAPesHS%2BL2PXq4nxte77fK3Pb%2BK6VYOFiALlR2SMl7Lvg%2BsYxcE9Y2%2BntDLMLaz%2BqnlbVPH7AgCKZrpMk48Omw2lCMeaqAWMQGCCuuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7c7354d1efc1d174-LHR
access-control-allow-headers: fa-kit-token
x-amz-cf-id: ze4Ja1w9sKYgK1VG142oJz1a-5i86OvsA5RlgirtD0K72mzzY7UjTw==

GET
H2 200 free-v5-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.4.0/css/ 823 B
735 B 103ms
61ms Fetch
text/css 2606:4700:e0::ac40:650a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v5-font-face.min.css?token=69c628fa4e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/69c628fa4e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d144babd74738640f3133de675f5fa21c7fb58bfbd430dbd967ca813403afbfd

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://env-p-resgata-9845709.clicketcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 13:01:42 GMT
via: 1.1 4e17b9920844b6a8df812cad8c3506ec.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: LHR50-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 23 Mar 2023 21:29:20 GMT
server: cloudflare
etag: W/"5856e3f07fbc36fc4d430a95a577a87f"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zm%2Bk%2BkOENs949%2BTIUtLvtCMq9JVnKCcpG%2FGq5jPmuEOWCZ%2B055ZPM6cIERznJzaY9V3pi%2BdvO%2FbB8B9Sbcijzy503pmljCHRHHrb8qIp%2FqzXktXrHV0CbZ0%2B7efqVIW6QVeB%2B6mzuuVB%2Fvmo%2B6iLYfdzlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7c7354d1efc4d174-LHR
access-control-allow-headers: fa-kit-token
x-amz-cf-id: sRbSuEPhOpvXfGwTE3q9JC-f_obAvsOClsJl98cBbxLkyItKr_dp4Q==

GET
H2 200 free-v4-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.4.0/css/ 2 KB
1 KB 76ms
34ms Fetch
text/css 2606:4700:e0::ac40:650a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.0/css/free-v4-font-face.min.css?token=69c628fa4e
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/69c628fa4e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af59041c11cf929a2d34e75e190b5da8ef037bd0fbe81a863c3bdcf430dd6b76

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://env-p-resgata-9845709.clicketcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 13:01:42 GMT
via: 1.1 14b9e21ac67dd643dc9e782cb20c49a2.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: JFK50-P8
age: 358431
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 23 Mar 2023 21:29:20 GMT
server: cloudflare
etag: W/"9e7f9f634ace089bcdacc3fcc5f23ce5"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=50y34SnKLAcfMQyYXaW1wogk61nFAS%2BeLHKE2wymMcZrxI7K79wlQ1gOuODsoijzPQMjX9MM89jd00ArOe6%2FY3gecBfTXWzvElMjavL31Fo%2FGzkx%2Fc2lYyUP2efmUnC3INTTqM2WCeWK3i4NPC3h2%2FxkEA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7c7354d1efc5d174-LHR
access-control-allow-headers: fa-kit-token
x-amz-cf-id: PMB6TSU-wgt1sqWgi7f8Rbyp-izhUY-TwfekPoa25JDo64-GLkiy0w==

GET
H2 200 Mobile_320x464_3.png
www.itau.com.br/assets/dam/publisher/01_itau/42_landing_pages/new_home/main_banner_rotating/credito/ 27 KB
27 KB 176ms
103ms Image
image/avif 23.36.162.217
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itau.com.br/assets/dam/publisher/01_itau/42_landing_pages/new_home/main_banner_rotating/credito/Mobile_320x464_3.png
Requested by: Host: env-p-resgata-9845709.clicketcloud.com
URL: http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.162.217 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-162-217.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: a1ac382c7468118b61fdbbce00dd1325ef08f8a4f0789950c7b14b06cadb0cd2

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://env-p-resgata-9845709.clicketcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 13:01:42 GMT
maite: true
last-modified: Mon, 17 Apr 2023 18:23:04 GMT
server: Akamai Image Manager
etag: "4cf227e6b58a0f8dff856ed4efbe381a"
access-control-allow-methods: GET, POST, GET, POST
content-type: image/avif
access-control-allow-origin: internet.itau.com.br, internet.itau.com.br
cache-control: private, no-transform, max-age=2432428
server-timing: cdn-cache; desc=HIT, edge; dur=28, ak_p; desc="467797_399431129_1321995278_2885_12028_25_0";dur=1
content-length: 27267
expires: Sun, 11 Jun 2023 16:42:10 GMT

GET
H2 200 free-fa-regular-400.woff2
ka-f.fontawesome.com/releases/v6.4.0/webfonts/ 24 KB
25 KB 26ms
25ms Font
font/woff2 2606:4700:e0::ac40:650a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.0/webfonts/free-fa-regular-400.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:650a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c4dcd77ed1c9917c299952dc2ac06c35657113c35c1ad10587f285c3208aac9

Request headers

Referer: http://env-p-resgata-9845709.clicketcloud.com/
Origin: http://env-p-resgata-9845709.clicketcloud.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 13:01:42 GMT
via: 1.1 f73d71dfa047571774d2c0460e5108ec.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: LHR50-P1
age: 172755
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 24952
last-modified: Fri, 24 Mar 2023 05:23:18 GMT
server: cloudflare
etag: "a343e0aaf1f0863b6bccb382abbfca31"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mv9xvXAZFI3fYs9uF4xZRN8YruuGXM6okdqZOWpHwr%2B1kkMR%2FAhK5a1E6KE0d4tdd7AQkQrr2sXcI2CbLHeUFaakGd4Iw2UIFOHQMD6JQjnrmLfvaLOh3RtCNNJ9bnAo0ONofflPfq7lbBTzXBkZyJYuew%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 7c7354d39b46d174-LHR
access-control-allow-headers: fa-kit-token
x-amz-cf-id: C1yLxD47leYFV8DDQkGsgfYg6fZX0VNRikyUUS_1xtjfJtF2nJRB5w==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| FontAwesomeKitConfig

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			env-p-resgata-9845709.clicketcloud.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: d248e1a5a621afe44db594464b6384a7

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: http://env-p-resgata-9845709.clicketcloud.com/como-resgatar-pontos-do-itaucard/itau30horas/mobi/aguarde.php Message: The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy. It was defined either in the final response or a redirect. Please deliver the response using the HTTPS protocol. You can also use the 'localhost' origin instead. See https://www.w3.org/TR/powerful-features/#potentially-trustworthy-origin and https://html.spec.whatwg.org/#the-cross-origin-opener-policy-header.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

env-p-resgata-9845709.clicketcloud.com
estatico.itau.com.br
ka-f.fontawesome.com
kit.fontawesome.com
www.itau.com.br
23.206.208.236
23.36.162.217
2606:4700::6812:1734
2606:4700:e0::ac40:650a
46.30.203.2
1c4dcd77ed1c9917c299952dc2ac06c35657113c35c1ad10587f285c3208aac9
30d61230c36a11389138ecd63e6fa1154e3edeb9c9069781481d0e4898187dae
425741cc35824b5b3b18d4135fbef6afca30662d23638366af151f7e74ba2575
9e9680881900e158e3e40ce630847386cecdd0d9a440d9976fe073741ab42527
a1ac382c7468118b61fdbbce00dd1325ef08f8a4f0789950c7b14b06cadb0cd2
af59041c11cf929a2d34e75e190b5da8ef037bd0fbe81a863c3bdcf430dd6b76
c9c3259499e753716c17302ce3702bdb076d3a44ad8d68fbd7167e478b0a3dd7
d144babd74738640f3133de675f5fa21c7fb58bfbd430dbd967ca813403afbfd
d2b82dc5a41a783638f1303c121907e4cefc8b21f8e15449d969c482893554cd
d3e540c6769ffef4193d8ed31a41b8578fcbc74567a4b8ff5588b854edc9e86b
fd28ebf7bdffb45da731413ed6e6940dc60123aa120bfa5a3909a40b2a2ba7e1

env-p-resgata-9845709.clicketcloud.com Open in urlscan Pro 46.30.203.2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

82 %HTTPS

40 %IPv6

3 Domains

5 Subdomains

5 IPs

3 Countries

182 kBTransfer

287 kBSize

1 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

env-p-resgata-9845709.clicketcloud.com Open in urlscan Pro
46.30.203.2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

40 %
IPv6

3
Domains

5
Subdomains

5
IPs

3
Countries

182 kB
Transfer

287 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!