xn--liibeeraodecontrato-2vb7f.com Open in urlscan Pro Puny
liibeeraçãodecontrato.com IDN
2606:4700:3032::ac43:c898 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://xn--liibeeraodecontrato-2vb7f.com/
Effective URL:
https://xn--liibeeraodecontrato-2vb7f.com/
Submission: On March 09 via api (March 9th 2024, 2:06:13 pm UTC) from BR — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 2606:4700:3032::ac43:c898, located in United States and belongs to CLOUDFLARENET, US. The main domain is xn--liibeeraodecontrato-2vb7f.com.
TLS certificate: Issued by E1 on March 8th 2024. Valid for: 3 months.

This is the only time xn--liibeeraodecontrato-2vb7f.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Caixa (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3034::6815:2c8c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	2606:4700:303... 2606:4700:3032::ac43:c898	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	2

1 2606:4700:3034::6815:2c8c (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

xn--liibeeraodecontrato-2vb7f.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:4700:3032::ac43:c898 (United States)

ASN13335 (CLOUDFLARENET, US)

xn--liibeeraodecontrato-2vb7f.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

userstatics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	xn--liibeeraodecontrato-2vb7f.com 1 redirects xn--liibeeraodecontrato-2vb7f.com	5 MB
1	userstatics.com userstatics.com — Cisco Umbrella Rank: 75655	714 B
16	2

	Domain	Requested by
16	xn--liibeeraodecontrato-2vb7f.com	1 redirects xn--liibeeraodecontrato-2vb7f.com
1	userstatics.com	xn--liibeeraodecontrato-2vb7f.com
16	2

This site contains no links.

Subject Issuer	Validity	Valid
xn--liibeeraodecontrato-2vb7f.com E1	`2024-03-08` - `2024-06-06`	3 months	crt.sh
userstatics.com E1	`2024-01-29` - `2024-04-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://xn--liibeeraodecontrato-2vb7f.com/
Frame ID: F9AF502F122B39716582BAC8E92CFE6A
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Empréstimo Auxilio Brasil

Page URL History Show full URLs

http://xn--liibeeraodecontrato-2vb7f.com/ HTTP 301
https://xn--liibeeraodecontrato-2vb7f.com/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

SweetAlert2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+?href="[^"]+sweetalert2(?:\.min)?\.css
sweetalert2(?:\.all)?(?:\.min)?\.js

Page Statistics

16
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

4669 kB
Transfer

5040 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://xn--liibeeraodecontrato-2vb7f.com/ HTTP 301
https://xn--liibeeraodecontrato-2vb7f.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response xn--liibeeraodecontrato-2vb7f.com/ Redirect Chain http://xn--liibeeraodecontrato-2vb7f.com/ https://xn--liibeeraodecontrato-2vb7f.com/	10 KB 3 KB	521ms 433ms	Document text/html	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/8.2.12 Resource Hash `61191c03ed92a40bcd0c72abe56c3be8ccd599a73438e1fcd7f09431da160772` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 861b9fb1ac7e9be6-FRA content-encoding br content-type text/html; charset=UTF-8 date Sat, 09 Mar 2024 14:06:08 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LyZwo6cTF2L5nUPy1z8RaeAZzI4pG6ss0cNhNHBmZNYVFzmvHkMH4UJCDsGEdJege8Md2j57AYGQmYVnUAwP%2FWfguabRU98Meguvj3xt5rbvWvHjZhviE7QVC%2FcLFgMOA9poXeP4tjLknYNCxtGQhXGi4X1JtWcvKdHDy5l66NU%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/8.2.12 Redirect headers CF-RAY 861b9fb0c8f39183-FRA Cache-Control max-age=3600 Connection keep-alive Date Sat, 09 Mar 2024 14:06:07 GMT Expires Sat, 09 Mar 2024 15:06:07 GMT Location https://xn--liibeeraodecontrato-2vb7f.com/ NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Unb82TpDotQhzEluZ40ba4BbgyLd4fJpj%2FClNYdoqhHhOy8Uxq0iwJ40jz6wW%2F5ud510qvyBZ4nJyXNtrhO%2BxO6MRzsrA2BtXXyyXfzyam1S9tOPDaiyXFyXBZyWwaz4iYE%2BoxM0dxqCvEZ%2BIyp6EOXKYnOr02KUX%2F5kn0WWv1M%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400
GET H2	200	index.css xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/	3 KB 1 KB	439ms 437ms	Stylesheet text/css	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/index.css Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `df22f350b3aa8616d1717e2125575073d29ac5ed8886139b855a08ec8c657300` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT content-encoding br cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"ba7-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sebkrl%2BwZChwHJyrStViIq9n%2F09vUpbLDI%2FsRhoiC3Q2NAIKOaTNZuwXnCFeCF1agekmUz5V1e4C40rYWcKZ3cWdcG6r2dVt8K90T5GNZjcFyjHJxd4ZWDKPWX3AJ5StyteK2v0mivu4epty5W3mzGfBktCd4qOztvtVl9AY6TQ%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 861b9fb4682b9be6-FRA alt-svc h3=":443"; ma=86400
GET H2	200	bootstrap.min.css xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/	227 KB 33 KB	1393ms 1392ms	Stylesheet text/css	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/bootstrap.min.css Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `16ee7f3d53462650bbd32e263c48c0ea759574fcf620c681ad719008912c461a` Request headers Referer https://xn--liibeeraodecontrato-2vb7f.com/ Origin https://xn--liibeeraodecontrato-2vb7f.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:09 GMT content-encoding br cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"38cf3-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m80%2FBUxF8zFYjluB4kMFh%2FJo6ohCCodbIrgXxNQZhg%2F%2B5OI4kiAKIIvQHHnPGVoTu6SCpY%2BxMciGK0Auj0OJrk5wbwZpGY1W%2BGEk9BncylJ0AJEFspYb9QK9Xhktm4BKnOlhRyEEvxi1ubkOz5PtrTyZhyCeRkhtYLTUE9zrwOI%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 861b9fb4682c9be6-FRA alt-svc h3=":443"; ma=86400
GET H2	200	all.min.css xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/	100 KB 23 KB	1011ms 1010ms	Stylesheet text/css	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/all.min.css Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4785b6972fb2353f0b4e7bb64ff081d2f3cbbfc555de4132b41cd9fb2faef104` Request headers Referer Origin https://xn--liibeeraodecontrato-2vb7f.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:09 GMT content-encoding br cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"18e4d-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5nXhoHXvI%2FEhHmmT38u8cJ5IXwLBuIV%2BAtBsRtssfJ0yOzoYXcHjuXJpT0NXk6NzhUtjZ0Sx78WKeE0%2FJ0kIMx6xEjXsTAcYDnvz5KqXIGNBUzDpmYcjBPkAJBwMksli9K%2Bjd340QAeeQff0u8GhFGMOL%2BxcPxzAFLWKc1GLzq4%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 861b9fb4682f9be6-FRA alt-svc h3=":443"; ma=86400
GET H2	200	sweetalert2.min.css xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/	22 KB 5 KB	665ms 663ms	Stylesheet text/css	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/sweetalert2.min.css Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b594b8d833ee6135c84734924c94bd83028fbfcfa98256c17cdb4950dbddc96e` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT content-encoding br cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"58a2-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G5Y1X0hFj5ht%2FkrbQY%2FsXb9SDSszlVpqj86lLm%2FnN9ZGita2Y%2BzDJwiMFmz4l%2Fs8g0CZDNhtpB5r8G7aeAqQkQ3Mt2jGn72Ke77uKglDDb2L%2BQ88xU214PKyUsgatAANIPCl0QzrGX8%2BRTcFPj8Jpp3ry0mIIzVyiCToFeSkcPE%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 861b9fb468319be6-FRA alt-svc h3=":443"; ma=86400
GET H2	200	aux_brasil.png xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/	24 KB 25 KB	665ms 663ms	Image image/png	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/aux_brasil.png Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `714c76b566247379dbb72bc485b762433a0c5a19277f538bbb0daab84db031f7` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "6157-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k%2BsRAHtZUOja6%2BVR6k6eP5WimVXzRFY3pX44%2FmH7jzAcjuL%2B%2BNgIWscRUjCHoAVddvIA4KdLichS1j1K4dr2cmbdbIa5eVogelfLvZiTNRfhP4YjjcDeyzKM4FLEiGve2lks4VfMaPgry%2FqzEF%2Bec5v%2B091DF4vCI0LeQIt%2Bpvs%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 861b9fb478379be6-FRA alt-svc h3=":443"; ma=86400 content-length 24919
GET H2	200	bolsa_familia_logo.png xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/	18 KB 18 KB	439ms 438ms	Image image/png	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/bolsa_familia_logo.png Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c547741d4973888d9f430629a7c626a0dc36515ef33c7b4c8bc86a73a3360160` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT cf-cache-status REVALIDATED last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "47fd-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U1vVAFRtDpQPVX6HgLWdIQ5Z3y9l6xNK%2BkWZT4SgZ9JMNdIZnNouTATB98lj6anwp4OgTg2Qq82FRPf%2BNpTHKYKdx8P6wN0R4r6dY3MW5GpX1aRXb62akC0MZPsKl19NX50jADq2Ggm5INr1coxjbAkluITAkPxho3TUBAFWsSI%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 861b9fb478389be6-FRA alt-svc h3=":443"; ma=86400 content-length 18429
GET H2	200	8638314_whatsapp_compress.png xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/	4 MB 4 MB	446ms 445ms	Image image/png	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/8638314_whatsapp_compress.png Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5edac30d081073096f7d5b8e7c14841e1fc25e1488378985d058e89056943432` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT cf-cache-status REVALIDATED last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "3f4b33-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bVSg7ImXVEKorMtd0eYZVTx0zVhTJKkAi5%2F2EWFIuR0XLn5jO40CdxvXH5L6iiWPC2vZ4ILI9C2ZtKYgGetFXNONVfFXLAkhetBy%2BxJ6i7aKtr1znRKbw2W6duFo%2FeKakm02ul6DH4qykhpJceQFYct8pYpe2GcB0TpgSW%2BwYVA%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 861b9fb4783a9be6-FRA alt-svc h3=":443"; ma=86400 content-length 4148019
GET H2	200	tutorial_1.png xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/	210 KB 211 KB	830ms 829ms	Image image/png	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/tutorial_1.png Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `af3b21fef32af9e224f88c344c2a09554c5c5041e5a62f0dff96806ce8906995` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "347d7-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7HxD1yDGd8YDFwc0oCq4I1R2F70in3ZyhSIxwPcj6QJbZnHsn7Pg0eCLReIt%2BKH6hZMZqKnm%2FZUCkf0SmdUcyQj1zMUa5akRiZ5SWjCEHUlrQcAZhGHFFCJlJQr7S0z88Q4X4pqoWPktgNGP4j5A29MaM3vTP8hmJLNbfDpzQNA%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 861b9fb4783b9be6-FRA alt-svc h3=":443"; ma=86400 content-length 214999
GET H2	200	x-volume-positiva-54-v2.png xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/	1 KB 1 KB	441ms 440ms	Image image/png	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/x-volume-positiva-54-v2.png Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `311f1ab2729014aa567869f260192aa0de9283534efa405bd36d1b8d8f235270` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT cf-cache-status REVALIDATED last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "4a4-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uF8A%2BOVCCQuafo028pLUXPC%2F9tDmnnnytjASiF%2BOWDm9wrl1LnFJWbkwWQLkJLOootoPRZQtjGVfQKDbPFiMiwISFJ1Xe1eV3QAQW01MXLHI8y%2FXOD5UGLIiDz5fyF3xOdcbHVNZOvepi2h0e7JFYBKZnQyQYTz6zsE3ODIYyjc%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 861b9fb4783d9be6-FRA alt-svc h3=":443"; ma=86400 content-length 1188
GET H2	200	ic-acesso-informacao-54-v2.png xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/	2 KB 2 KB	485ms 485ms	Image image/png	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/images/ic-acesso-informacao-54-v2.png Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8651eae74447f591887264b3e8d5407f67475149f8ef903840449e10f5e35604` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "6ea-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JNc5zNcu430kp2VuCgphDpaaF%2F4WEtF%2BPzI%2Ff%2Fg%2Fy6oTbyULCbUoOGhjKXFgTt8rjmLu%2Fi01rSkROblbG0iOJ%2FMsP6V3Bi1EXCY9rlOZBuBMWebYG51911AQQ6RI%2Bqq5iaU7akhifDIie82iP5scDXPZ938fwmjHWYN5DdzIGcY%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 861b9fb4a8839be6-FRA alt-svc h3=":443"; ma=86400 content-length 1770
GET H2	200	sweetalert2.min.js Show response xn--liibeeraodecontrato-2vb7f.com/assets/index_files/js/	40 KB 14 KB	829ms 828ms	Script text/javascript	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/js/sweetalert2.min.js Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `254035f46a1e99ce2bb3c0bf1a19658809e8351e2a9d5f7ebc57193ee0a4cbf0` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT content-encoding br cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"a179-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DL%2FYXy7FzFtcS3tBWb7dq3TbimwtcLnsUOHPOfhjbjbKhKhxwuFoNi4Jij170fBXev3KQY393vXNuQWRbtE5GCVYNQc42Z%2F0g93gv1TYK608DEr2Qvf989JiQsxU9jTm2aC04KfrRlRa5%2Fe9k6JqdWYiOEpMYG5APUO%2FIqh58fI%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript cache-control max-age=14400 cf-ray 861b9fb4783f9be6-FRA alt-svc h3=":443"; ma=86400
GET H2	200	bootstrap.bundle.min.js Show response xn--liibeeraodecontrato-2vb7f.com/assets/index_files/js/	79 KB 24 KB	858ms 858ms	Script text/javascript	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/js/bootstrap.bundle.min.js Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a23bc241647e57f561aef14b09c3e9c6ea14caf2358278cc725eeb179b303ea3` Request headers Referer https://xn--liibeeraodecontrato-2vb7f.com/ Origin https://xn--liibeeraodecontrato-2vb7f.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:08 GMT content-encoding br cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"13b4d-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XxZ6ZeJPuxGk2OdjusYwwaziU9ukWd%2FWSJ%2F0gPLlZT%2FajnKMrlqCYI0R68N9v%2BmNXjIJMYYtUJPLpI6JU4Og4YveMqaCfS7ZoEzNGgdlRFmn2iRiFqKVv1hx5U2rlcd1OncUf1yWjVhVc7yTyQzetLh%2B72xAa5k6NlB9X21Wea8%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript cache-control max-age=14400 cf-ray 861b9fb4a8809be6-FRA alt-svc h3=":443"; ma=86400
GET H3	200	fa-solid-900.woff2 xn--liibeeraodecontrato-2vb7f.com/assets/index_files/fonts/	147 KB 147 KB	855ms 855ms	Font font/woff2	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/fonts/fa-solid-900.woff2 Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/all.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7152a6933ee3d690ec2af3d09da9d701723d16aa3410a6d80f28ff8866f3b880` Request headers Referer https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/all.min.css Origin https://xn--liibeeraodecontrato-2vb7f.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:10 GMT cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "24a6c-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w7ESxb9w6R%2FGCDVqHloydH0CwmSe2aOmzAyTFeateDe2RI%2B2PrsxQntGVuRZPcsViF2oedr9HRt95wd2%2BQbfE%2FQguqb%2BjUbHuMSJutPnKF6HDuIK4Pfxszaq4XvDdgcuxduCzkopVTcjr6XsHB2N1%2Bf85QuqQpTeoA%2BXyTluGo4%3D"}],"group":"cf-nel","max_age":604800} content-type font/woff2 cache-control max-age=14400 accept-ranges bytes cf-ray 861b9fbd389e1cab-FRA alt-svc h3=":443"; ma=86400 content-length 150124
GET H3	200	fa-brands-400.woff2 xn--liibeeraodecontrato-2vb7f.com/assets/index_files/fonts/	105 KB 106 KB	815ms 815ms	Font font/woff2	2606:4700:3032::ac43:c898 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/fonts/fa-brands-400.woff2 Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/all.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::ac43:c898 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `748332090c4b8e20f95d0ff59f0be20fa9c889359d3b36d4b886d73376054207` Request headers Referer https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/css/all.min.css Origin https://xn--liibeeraodecontrato-2vb7f.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:10 GMT cf-cache-status MISS last-modified Mon, 20 Nov 2023 02:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "1a5f4-60a8c39948d80" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JdxQB1sQAi0ToZAQVF27rApc8fKXbQFW8esPeXzcSqdDVvcY2ksenjinpstE%2FvQWkFpGZqxo9fVhdX43JfAGYAB9zAMj2j53WPsC2aHO%2Bb3vZnuxHVGK1DB8bDgU%2F2uqG5tvEfnf5fCCnT%2FwFCyl5vM%2FGP5brT8LdUPbwotODAQ%3D"}],"group":"cf-nel","max_age":604800} content-type font/woff2 cache-control max-age=14400 accept-ranges bytes cf-ray 861b9fbd389f1cab-FRA alt-svc h3=":443"; ma=86400 content-length 108020
GET H2	200	script.js Show response userstatics.com/get/	133 B 714 B	178ms 86ms	Script text/html	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://userstatics.com/get/script.js?referrer=https://xn--liibeeraodecontrato-2vb7f.com/ Requested by Host: xn--liibeeraodecontrato-2vb7f.com URL: https://xn--liibeeraodecontrato-2vb7f.com/assets/index_files/js/bootstrap.bundle.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/8.2.1 Resource Hash `df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26` Request headers accept-language de-DE,de;q=0.9 Referer https://xn--liibeeraodecontrato-2vb7f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 14:06:10 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/8.2.1 vary Accept-Encoding access-control-allow-methods GET, POST content-type text/html; charset=utf-8 access-control-allow-origin https://xn--liibeeraodecontrato-2vb7f.com report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CFV48gp5Q2BKG1lf2kTkvHID29GbDzmPEZ8765b0EL%2FARByefswQy8LApjBgFXdGQxfU7ZKquJU%2BXw3idFtJ5zhtj5GfLOlM5xtbbvfTf%2B0weW13etuJYNaD07d%2B1h5cQjw%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-credentials true cf-ray 861b9fc40c201d92-FRA access-control-allow-headers X-Requested-With,content-type alt-svc h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Caixa (Government)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

userstatics.com
xn--liibeeraodecontrato-2vb7f.com
188.114.96.3
2606:4700:3032::ac43:c898
2606:4700:3034::6815:2c8c
16ee7f3d53462650bbd32e263c48c0ea759574fcf620c681ad719008912c461a
254035f46a1e99ce2bb3c0bf1a19658809e8351e2a9d5f7ebc57193ee0a4cbf0
311f1ab2729014aa567869f260192aa0de9283534efa405bd36d1b8d8f235270
4785b6972fb2353f0b4e7bb64ff081d2f3cbbfc555de4132b41cd9fb2faef104
5edac30d081073096f7d5b8e7c14841e1fc25e1488378985d058e89056943432
61191c03ed92a40bcd0c72abe56c3be8ccd599a73438e1fcd7f09431da160772
714c76b566247379dbb72bc485b762433a0c5a19277f538bbb0daab84db031f7
7152a6933ee3d690ec2af3d09da9d701723d16aa3410a6d80f28ff8866f3b880
748332090c4b8e20f95d0ff59f0be20fa9c889359d3b36d4b886d73376054207
8651eae74447f591887264b3e8d5407f67475149f8ef903840449e10f5e35604
a23bc241647e57f561aef14b09c3e9c6ea14caf2358278cc725eeb179b303ea3
af3b21fef32af9e224f88c344c2a09554c5c5041e5a62f0dff96806ce8906995
b594b8d833ee6135c84734924c94bd83028fbfcfa98256c17cdb4950dbddc96e
c547741d4973888d9f430629a7c626a0dc36515ef33c7b4c8bc86a73a3360160
df22f350b3aa8616d1717e2125575073d29ac5ed8886139b855a08ec8c657300
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26

xn--liibeeraodecontrato-2vb7f.com Open in urlscan Pro Puny liibeeraçãodecontrato.com IDN 2606:4700:3032::ac43:c898 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

67 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

4669 kBTransfer

5040 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

xn--liibeeraodecontrato-2vb7f.com Open in urlscan Pro Puny
liibeeraçãodecontrato.com IDN
2606:4700:3032::ac43:c898 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

4669 kB
Transfer

5040 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!