desbloqueio.ltau30appacesso.ml
Open in
urlscan Pro
2606:4700:30::6818:6191
Malicious Activity!
Public Scan
Effective URL: https://desbloqueio.ltau30appacesso.ml/home.php
Submission: On December 12 via manual from BR
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 3rd 2018. Valid for: a year.
This is the only time desbloqueio.ltau30appacesso.ml was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:30:... 2606:4700:30::6818:6091 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 12 | 2606:4700:30:... 2606:4700:30::6818:6191 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:818::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 2a00:1450:400... 2a00:1450:4001:825::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
15 | 3 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
desbloqueio.ltau30appacesso.ml |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
desbloqueio.ltau30appacesso.ml |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
ltau30appacesso.ml
2 redirects
desbloqueio.ltau30appacesso.ml |
647 KB |
3 |
gstatic.com
fonts.gstatic.com |
26 KB |
1 |
googleapis.com
fonts.googleapis.com |
849 B |
15 | 3 |
Domain | Requested by | |
---|---|---|
13 | desbloqueio.ltau30appacesso.ml |
2 redirects
desbloqueio.ltau30appacesso.ml
|
3 | fonts.gstatic.com |
desbloqueio.ltau30appacesso.ml
|
1 | fonts.googleapis.com |
desbloqueio.ltau30appacesso.ml
|
15 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2018-12-03 - 2019-12-03 |
a year | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2018-11-27 - 2019-02-19 |
3 months | crt.sh |
*.google.com Google Internet Authority G3 |
2018-11-07 - 2019-01-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://desbloqueio.ltau30appacesso.ml/home.php
Frame ID: C5FBDF2710AFFEB6C9FB3C26ED89D2DE
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://desbloqueio.ltau30appacesso.ml/
HTTP 301
https://desbloqueio.ltau30appacesso.ml/ HTTP 302
https://desbloqueio.ltau30appacesso.ml/home.php Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://desbloqueio.ltau30appacesso.ml/
HTTP 301
https://desbloqueio.ltau30appacesso.ml/ HTTP 302
https://desbloqueio.ltau30appacesso.ml/home.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.php
desbloqueio.ltau30appacesso.ml/ Redirect Chain
|
3 KB 882 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geral.css
desbloqueio.ltau30appacesso.ml/estilos/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geral.js
desbloqueio.ltau30appacesso.ml/javascripts/ |
5 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
12 KB 849 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
desbloqueio.ltau30appacesso.ml/imagens/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
setas_menu.png
desbloqueio.ltau30appacesso.ml/imagens/ |
977 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cadeado_button_home.png
desbloqueio.ltau30appacesso.ml/imagens/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
horas.gif
desbloqueio.ltau30appacesso.ml/imagens/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_all.jpg
desbloqueio.ltau30appacesso.ml/imagens/ |
629 KB 630 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_header.gif
desbloqueio.ltau30appacesso.ml/imagens/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v15/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_select_item.png
desbloqueio.ltau30appacesso.ml/imagens/ |
959 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_button_home.png
desbloqueio.ltau30appacesso.ml/imagens/ |
982 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| check_enter_index function| enviar_numero function| check_password function| show_modal function| check_final function| checkCard function| SomenteNumero function| validarCPF function| remove1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ltau30appacesso.ml/ | Name: __cfduid Value: d7609ca728010b6ff5966f8c46db921551544639726 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
desbloqueio.ltau30appacesso.ml
fonts.googleapis.com
fonts.gstatic.com
2606:4700:30::6818:6091
2606:4700:30::6818:6191
2a00:1450:4001:818::200a
2a00:1450:4001:825::2003
2cb325f998ad135de2e7e879713fe7256fb50f66af870ea9f5bc1d3e63bc854d
41f324f60a6ef6623f2a5c3612c571aa37b89a044836d983e6b80a067d785cde
4bb7073a502aad4b76360daf16268a145051587618478a5b3c3c78a71fc0a66e
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
65eea5b0a27bfdf46700003c824a2340e76c21896bb3b9fa6c4f8135fd2d720f
6d99563e9563eb69ad189118b0c2ae042e82e7d71d5de9d6f00b7f4bbaf9678d
6da034f63fc7905eef461a3db2fcd4328c8fa53d7676df7686e9d310f40f6d4d
6dadb48e134dfaffa09bbc4cd92ef1288e7eab40760b5c5a83152e854215c4f2
7245dbd1481a7c3bc402a3c83c366fdf74d9f203134e4396ab7fa66ee95b6cd3
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
add6f086fd81490771e3f20ef5862e896904ebac7c7af72f90db8fc318a33da3
d133ba6c3606f15996eaecffe9eb3ac1341711db1f4a1851a72b7c619d6b95b9
d3d76b234f969d47c970c066cd5e3a9c9d2d07f08c5924486dbab16d005a920b
f91d7bcfea1bcd314005371d7a0929f8e22f3bde3d305adc489cdd2df13ede77
fe32c9921874b35b87acb0a3b558784ca7b9fed91ed34c1d2a68b6566c9d09be