![](/screenshots/c371d51f-17df-45ed-b081-47439969b08a.png)
porposta-unica.com
Open in
urlscan Pro
198.46.91.8
Malicious Activity!
Public Scan
Submission: On March 20 via manual from US — Scanned from DE
Summary
This is the only time porposta-unica.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Serasa (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 198.46.91.8 198.46.91.8 | 54641 (IMH-IAD) (IMH-IAD) | |
1 | 2606:4700::68... 2606:4700::6810:5614 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 45.60.13.174 45.60.13.174 | 19551 (INCAPSULA) (INCAPSULA) | |
3 | 2a00:1450:400... 2a00:1450:4001:80f::2003 | 15169 (GOOGLE) (GOOGLE) | |
8 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
gstatic.com
fonts.gstatic.com |
86 KB |
2 |
porposta-unica.com
porposta-unica.com |
49 KB |
1 |
serasa.com.br
www.serasa.com.br |
|
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 437 |
7 KB |
8 | 4 |
Domain | Requested by | |
---|---|---|
3 | fonts.gstatic.com |
porposta-unica.com
|
2 | porposta-unica.com |
porposta-unica.com
|
1 | www.serasa.com.br |
porposta-unica.com
|
1 | cdn.jsdelivr.net |
porposta-unica.com
|
8 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
*.serasaexperian.com.br GlobalSign RSA OV SSL CA 2018 |
2023-08-01 - 2024-09-01 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-26 - 2024-05-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://porposta-unica.com/aplicativo/
Frame ID: 58AD2B2880887AAD1112A9560F298984
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/c371d51f-17df-45ed-b081-47439969b08a.png)
Page Title
Fazer login - SerasaDetected technologies
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
porposta-unica.com/aplicativo/ |
44 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
disable-devtool@latest
cdn.jsdelivr.net/npm/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serasa-logo-full-004a91d5ce87257d803b0516311e112c.svg
www.serasa.com.br/assets/web/authorization-front/2.15.4/_next/static/images/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
application.js
porposta-unica.com/aplicativo/ |
88 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
modal-close-74f0df029374a2c330a1b9c1073e5ef4.svg
www.serasa.com.br/assets/web/authorization-front/2.15.4/_next/static/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v30/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v30/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Me5g.woff
fonts.gstatic.com/s/roboto/v30/ |
64 KB 64 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.serasa.com.br
- URL
- https://www.serasa.com.br/assets/web/authorization-front/2.15.4/_next/static/images/modal-close-74f0df029374a2c330a1b9c1073e5ef4.svg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Serasa (Financial)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| DisableDevtool function| _0x3828 function| _0x2983 function| _0x19a36a function| _0x558a84 function| formatCPF function| _0x3fc7fe function| validateCPF function| _0x48f651 function| _0x4a229d function| _0x1462832 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.serasa.com.br/ | Name: visid_incap_1911258 Value: tzmSjxDlQVGHAxe5Wefa4xJh+2UAAAAAQUIPAAAAAACvmM9lpi/pmoPNhthH9BYM |
|
.serasa.com.br/ | Name: incap_ses_727_1911258 Value: QgIHYZiuEWy05H0I0NMWChJh+2UAAAAAvQebO5e54f7N4JOlCSHQZQ== |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
fonts.gstatic.com
porposta-unica.com
www.serasa.com.br
www.serasa.com.br
198.46.91.8
2606:4700::6810:5614
2a00:1450:4001:80f::2003
45.60.13.174
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
13dd82c5194e731ac899a17121c7331078cf27964f8e9d2a90a3770e9332ab54
2a741550c18b132b0ef573f818fc79d6c09169be71d538b968ceac551c178ad3
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
9ccb382c2ebb02287433fa9d183cf49a1279f813c59811272d06275842dca617
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41533d5c6eab361631aa3cf8bf7b8a2e6babfcc42a1aa950b2b0cd80c109b8f