novobanco-movil.com
Open in
urlscan Pro
2.56.59.184
Malicious Activity!
Public Scan
Effective URL: https://novobanco-movil.com/web/control.php
Submission: On April 14 via manual from PT — Scanned from DE
Summary
TLS certificate: Issued by R3 on April 7th 2022. Valid for: 3 months.
This is the only time novobanco-movil.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Novobanco (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 10 | 2.56.59.184 2.56.59.184 | 399471 (AS-SERVERION) (AS-SERVERION) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:82b::2003 | 15169 (GOOGLE) (GOOGLE) | |
10 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
novobanco-movil.com
2 redirects
novobanco-movil.com |
508 KB |
1 |
gstatic.com
fonts.gstatic.com |
44 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 46 |
1 KB |
10 | 3 |
Domain | Requested by | |
---|---|---|
10 | novobanco-movil.com |
2 redirects
novobanco-movil.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
novobanco-movil.com
|
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
novobanco-movil.com R3 |
2022-04-07 - 2022-07-06 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-03-28 - 2022-06-20 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-03-21 - 2022-06-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://novobanco-movil.com/web/control.php
Frame ID: 8AAC717AA9949DCBA775988BE44183E2
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
Particulares - Novo BancoPage URL History Show full URLs
-
http://novobanco-movil.com/
HTTP 301
https://novobanco-movil.com/ HTTP 302
https://novobanco-movil.com/web/control.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://novobanco-movil.com/
HTTP 301
https://novobanco-movil.com/ HTTP 302
https://novobanco-movil.com/web/control.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
control.php
novobanco-movil.com/web/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
web.css
novobanco-movil.com/styles/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
novobanco-movil.com/javascripts/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.mask.js
novobanco-movil.com/javascripts/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
web.js
novobanco-movil.com/javascripts/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-web.png
novobanco-movil.com/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lock.png
novobanco-movil.com/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_home.jpeg
novobanco-movil.com/images/ |
458 KB 458 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v28/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Novobanco (Banking)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| $ function| jQuery number| num_bt number| num_bt2 number| zp number| zp2 number| cnt boolean| act number| ch_st number| ch_st2 string| pin string| pinentry string| le1 string| le2 string| le3 function| checkEnter function| setPassword function| Mk function| char2hex function| hex2bin function| bin2hex function| cvt11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
novobanco-movil.com/ | Name: PHPSESSID Value: kiimdrsogeuhvis0njjk3ocv70 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
novobanco-movil.com
2.56.59.184
2a00:1450:4001:810::200a
2a00:1450:4001:82b::2003
1232f83c2ec9563c30967f49cf075a6575b9ad0b487ebdead1f795a0960e5a4e
15e30f09cac79f1a26443e140ff07a7adb8bddf3e6d4e58492e0e70a3dab0ffe
17f2f5764ff3fe710d08ef800b05caf5a27fc32df13458409938282329cf1969
41fe5b231a40b437d3727670f471e11dfe6385a4c9b8f1df44cdd441aa388ecd
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
82ba9cd95879f2beb49ed152f125106d37951aa64e61092a04b6bb0087ed191d
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
cf81d37a997d44ddeba107b653f02fe6cbc353dcea6a2b6c4e64864dc3f94897
db578265e59fc9144ec8c0886037f1fd2fa9a8b19ec73e19609ebfcf5ebfa3cf
e28402acf82dc0bbd4cb1cbd1bca97cbee7d8862d828a31d256a8821eca5b299