nvobco.click Open in urlscan Pro
104.21.11.123 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://nvobco.click/
Effective URL:
https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30/login
Submission: On November 14 via manual (November 14th 2023, 12:53:49 pm UTC) from PT — Scanned from PT

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 104.21.11.123, located in and belongs to CLOUDFLARENET, US. The main domain is nvobco.click.
TLS certificate: Issued by E1 on November 14th 2023. Valid for: 3 months.

This is the only time nvobco.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Novobanco (Banking) Generic Cloudflare (Online)

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
2 12	104.21.11.123 104.21.11.123	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.2.137 151.101.2.137	54113 (FASTLY) (FASTLY)
1	104.26.0.100 104.26.0.100	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	4

12 104.21.11.123 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

nvobco.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.137 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.0.100 (None, )

ASN13335 (CLOUDFLARENET, US)

get.geojs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	nvobco.click 2 redirects nvobco.click	58 KB
1	geojs.io get.geojs.io — Cisco Umbrella Rank: 16027	879 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 762	30 KB
12	3

	Domain	Requested by
12	nvobco.click	2 redirects nvobco.click code.jquery.com
1	get.geojs.io	nvobco.click
1	code.jquery.com	nvobco.click
12	3

This site contains no links.

Subject Issuer	Validity	Valid
nvobco.click E1	`2023-11-14` - `2024-02-12`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-11` - `2024-04-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30/login
Frame ID: 2A70B8468049C46B5CD8340A50064298
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Entrar

Page URL History Show full URLs

http://nvobco.click/ Page URL
http://nvobco.click/cdn-cgi/phish-bypass?atok=smQc13HghkX1KwnaaIAuWov8Q0WcwzWnIj5bwyPS9vk-169996... HTTP 301
http://nvobco.click/ HTTP 301
https://nvobco.click/ Page URL
https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30/login Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

88 kB
Transfer

232 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://nvobco.click/ Page URL
http://nvobco.click/cdn-cgi/phish-bypass?atok=smQc13HghkX1KwnaaIAuWov8Q0WcwzWnIj5bwyPS9vk-1699966419-0-%2F HTTP 301
http://nvobco.click/ HTTP 301
https://nvobco.click/ Page URL
https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

http://nvobco.click/cdn-cgi/phish-bypass?atok=smQc13HghkX1KwnaaIAuWov8Q0WcwzWnIj5bwyPS9vk-1699966419-0-%2F HTTP 301
http://nvobco.click/ HTTP 301
https://nvobco.click/

12 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
nvobco.click/ 4 KB
2 KB 103ms
63ms Document
text/html 104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://nvobco.click/

Protocol

HTTP/1.1

Server

104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

769f8a39522ca5bbf6df36fcba467480450c34f9fce6c1feaaa117e9101ae762

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: pt-PT,pt;q=0.9

Response headers

CF-RAY: 825f660c79252153-MAD
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 14 Nov 2023 12:53:39 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aj05eN7kdY%2BIjc%2BUmsr0pDYVY6gLp3cwr%2FYnc82NWiX1KbOaJaOM9ubIM5Bw445kCZr5GZ2Hp1tdE3dGVF5pGG9RBBxe1v359GjNxoQIFVHKsua5sqohiopJdy0gILE%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN

GET
H/1.1 200
OK cf.errors.css
nvobco.click/cdn-cgi/styles/ 24 KB
5 KB 75ms
75ms Stylesheet
text/css 104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://nvobco.click/cdn-cgi/styles/cf.errors.css

Requested by

Host: nvobco.click
URL: http://nvobco.click/

Protocol

HTTP/1.1

Server

104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: http://nvobco.click/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Tue, 14 Nov 2023 12:53:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 08 Nov 2023 16:16:02 GMT
Server: cloudflare
ETag: W/"654bb442-5e44"
Transfer-Encoding: chunked
X-Frame-Options: DENY
Content-Type: text/css
Vary: Accept-Encoding
Cache-Control: max-age=7200, public
Connection: keep-alive
CF-RAY: 825f660ce9f02153-MAD
Expires: Tue, 14 Nov 2023 14:53:39 GMT

GET
H/1.1 200
OK icon-exclamation.png
nvobco.click/cdn-cgi/images/ 452 B
889 B 48ms
48ms Image
image/png 104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://nvobco.click/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: nvobco.click
URL: http://nvobco.click/cdn-cgi/styles/cf.errors.css

Protocol

HTTP/1.1

Server

104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: http://nvobco.click/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Tue, 14 Nov 2023 12:53:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 08 Nov 2023 16:16:02 GMT
Server: cloudflare
ETag: "654bb442-1c4"
X-Frame-Options: DENY
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=7200, public
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 825f660d7b032153-MAD
Content-Length: 452
Expires: Tue, 14 Nov 2023 14:53:40 GMT

GET
H2

200

/ Show response
nvobco.click/
Redirect Chain

http://nvobco.click/cdn-cgi/phish-bypass?atok=smQc13HghkX1KwnaaIAuWov8Q0WcwzWnIj5bwyPS9vk-1699966419-0-%2F
http://nvobco.click/
https://nvobco.click/

1 KB
1 KB

505ms
406ms

Document
text/html

104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvobco.click/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ee381b9745e7012772f872777096e3b22ab049e6e83f6c8690d4072d14c8c0c1

Request headers

Referer: http://nvobco.click/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: pt-PT,pt;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 825f662e2b8a1519-MAD
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 14 Nov 2023 12:53:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yX5FcsAWM%2B8t%2BPfgBGPGlVUspw1%2B9l9UBkOp%2BR%2BLMlIuLP0fCkBudQ1lunMIhth%2FjX7GZi7x24HXkDExw3jpTY6JHuRiSr%2BaWHHJBjFbeilkfZEfydbV4%2FfhbaMSXjo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: Express

Redirect headers

CF-RAY: 825f662d3f572153-MAD
Cache-Control: max-age=3600
Connection: keep-alive
Date: Tue, 14 Nov 2023 12:53:45 GMT
Expires: Tue, 14 Nov 2023 13:53:45 GMT
Location: https://nvobco.click/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cCK4hSxHdcAr9x1%2FbXVguVre8DFjG24ZfjRposijilgRGRQMe64q6vZIKkFi3kyNbbIO5H1cLZ77ng7rzmpKH7JgBzDAOMsmjlPNNB4K9HeZOPQ8gc41XnSSx1K4upw%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400

GET
H2 200 all.css
nvobco.click/public/styles/ 5 KB
2 KB 140ms
139ms Stylesheet
text/css 104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvobco.click/public/styles/all.css
Requested by: Host: nvobco.click
URL: https://nvobco.click/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: cd13896ab186c6b592a29edda3b6b3add02d94665263c13852b0770fbbeef097

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://nvobco.click/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 14 Nov 2023 12:53:45 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 14 Nov 2022 02:23:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"14b7-18473f32750"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kyJMlDbQ7TW8laS06xSX5RpoFq9KjAyRutIICMlU02sa2Pwv584PGyO8mM0xDaMnqJaq6bEk1QySGfYj8oYWe7BW4cxuRNXPgNdWfZfddstwzCf8Ibb76uVNkKe0pbY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 825f6630be121519-MAD
alt-svc: h3=":443"; ma=86400

GET
H2 200 loader.gif
nvobco.click/public/images/ 5 KB
5 KB 168ms
167ms Image
image/gif 104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nvobco.click/public/images/loader.gif
Requested by: Host: nvobco.click
URL: https://nvobco.click/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 990f3452736f1806199700baf0c66068b20b77c542daedec6959ec0fa2e73c15

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://nvobco.click/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 14 Nov 2023 12:53:45 GMT
cf-cache-status: MISS
last-modified: Mon, 14 Nov 2022 02:23:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"1444-18473f30040"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fZzMv0eGuwub%2Bl3Pxo2KyCRjitifFG7ZoBRRguVHWak6rsFCwYpK3RS9lyQa13o7NJ9zyBBrIKLDYFMhgbU5pULsfxRZIc9Q5Oa%2FdZXCXD2Bv2%2FuuCQilEZ7tycTdaA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 825f6630ce161519-MAD
alt-svc: h3=":443"; ma=86400
content-length: 5188

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 133ms
39ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: nvobco.click
URL: https://nvobco.click/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://nvobco.click/
Origin: https://nvobco.click
accept-language: pt-PT,pt;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 14 Nov 2023 12:53:45 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 4728324
x-cache: HIT, HIT
content-length: 30875
x-served-by: cache-lga21931-LGA, cache-lis1490052-LIS
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1699966426.811792,VS0,VE0
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 42, 390968

GET
H2 200 geo.js Show response
get.geojs.io/v1/ip/ 374 B
879 B 201ms
92ms Script
application/javascript 104.26.0.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.geojs.io/v1/ip/geo.js

Requested by

Host: nvobco.click
URL: https://nvobco.click/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.0.100 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49d725530e2302b3cf16423ff5338239cf4a10ff6e66fa81ec5dd0d5ab68319f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://nvobco.click/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 14 Nov 2023 12:53:45 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-request-id: 7cbde104f654c8e36945233bb598d7e4-AMS
x-geojs-location: AMS
pragma: no-cache
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=703cB%2BOpuxE%2BW7%2FJCAMPip9eetgcFw7%2F4FkyoUQ5mVe7nY5dZrPu5s7cozvQ74CFSSnK4FisAx0qWwzTDisBvrCJyu93sMlx7MIYYmDQH6%2FTl6rCgX7qymholLabvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
cf-ray: 825f66318a5a2168-MAD

GET
H3 200 201M9D1NDCQLN05ZODY59M4E30.html
nvobco.click/ 80 B
678 B 216ms
215ms XHR
text/html 104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30.html?ip=5.154.174.198&loc=PT&city=Lisbon&reg=Lisbon
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Referer: https://nvobco.click/
X-Requested-With: XMLHttpRequest
accept-language: pt-PT,pt;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 14 Nov 2023 12:53:47 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JlQihcqWPwjmsj6mAp29Q58CApzpUj0%2FzuyTWIe5Fpaw9mIRZWIgT5qhEq1s%2FjOx8T79qYC08pTotAnaaL0NgVzYjW4WG63NlYL141XNRLEO9kgTWnsagJVDjBMRbhU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
cf-ray: 825f66385de3660b-MAD
alt-svc: h3=":443"; ma=86400

GET
H3 200 Primary Request login Show response
nvobco.click/201M9D1NDCQLN05ZODY59M4E30/ 9 KB
7 KB 132ms
132ms Document
text/html 104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30/login
Requested by: Host: nvobco.click
URL: http://nvobco.click/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ccce1f575ea4f378321aee745f20238c8cf4c5954cc04c9578a04c4920f5b6e9

Request headers

Referer: https://nvobco.click/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: pt-PT,pt;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 825f6639b83d660b-MAD
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 14 Nov 2023 12:53:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jwOfeYF6i7w0JFPf3uTWS1wmTs31tiA2wXfD4UTAIGeDuOIwia7wMv%2BoLl7yPR4wxR%2F6b4yv9N6sWJHaMugeoa2j1vtcJHtJ17IZUw%2F2hEJZX%2FNKpX1jgJZaIbLK7b0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: Express

GET
H3 200 all.css
nvobco.click/public/styles/ 5 KB
2 KB 111ms
110ms Stylesheet
text/css 104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvobco.click/public/styles/all.css
Requested by: Host: nvobco.click
URL: https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: cd13896ab186c6b592a29edda3b6b3add02d94665263c13852b0770fbbeef097

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 14 Nov 2023 12:53:47 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Mon, 14 Nov 2022 02:23:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"14b7-18473f32750"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LUNEOoBDjtvV4tdFB0kwyYrqidcwMA5gtfV1sxPC0zqMvm2K0sKve%2F3J2RAaUruAdK2%2BPJnGCBDYblGTC8szj0vH0qLt3WxdrnU7YQwcx93jQm0EiOCnF%2FGxePEkUPY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 825f663a99c3660b-MAD
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery.min.js Show response
nvobco.click/public/javascripts/ 85 KB
31 KB 166ms
165ms Script
application/javascript 104.21.11.123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvobco.click/public/javascripts/jquery.min.js
Requested by: Host: nvobco.click
URL: https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.11.123 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://nvobco.click/201M9D1NDCQLN05ZODY59M4E30/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 14 Nov 2023 12:53:47 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sun, 03 Jul 2022 18:30:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"15391-181c553fa00"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K%2F4mZEtdxZ39zgxZY3Jf5TocyriJpfnDaNpho6MHNRscKAm5KmrRvLdIaTsSKNddYrVGFASeAfzTOdSV0%2B3RYABmStxXhVx8zmkFIpAtuq%2F9wK%2FRL6XrX%2BVkixKKCXw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 825f663a99c4660b-MAD
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 858f5fc6c36c6f7a6fb9ecde1d295f4ff988f43054379702063cca9054107681

Request headers

accept-language: pt-PT,pt;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Malicious page.domain
Submitted on November 14th 2023, 1:06:52 pm UTC — From Portugal

Threats: Phishing
Brands: Novobanco PT
Comment: Fake malicious site, with phishkit to collect credentials from costumers of Portuguese 'Novobanco'.

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Novobanco (Banking) Generic Cloudflare (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.nvobco.click/	1970-01-20 16:14:12	Name: __cf_mw_byp Value: smQc13HghkX1KwnaaIAuWov8Q0WcwzWnIj5bwyPS9vk-1699966419-0-/
nvobco.click/	1970-01-20 16:27:47	Name: csrf-token Value: 03E4M95YDOZ50NLQCDN1D9M102
nvobco.click/	1970-01-20 16:27:47	Name: visitor Value: 65536ddb01e60a25fcc7d6cb
nvobco.click/	1970-01-20 16:27:47	Name: userId Value: DXMX9U88KJ5DS

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
get.geojs.io
nvobco.click
104.21.11.123
104.26.0.100
151.101.2.137
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
49d725530e2302b3cf16423ff5338239cf4a10ff6e66fa81ec5dd0d5ab68319f
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
769f8a39522ca5bbf6df36fcba467480450c34f9fce6c1feaaa117e9101ae762
858f5fc6c36c6f7a6fb9ecde1d295f4ff988f43054379702063cca9054107681
990f3452736f1806199700baf0c66068b20b77c542daedec6959ec0fa2e73c15
ccce1f575ea4f378321aee745f20238c8cf4c5954cc04c9578a04c4920f5b6e9
cd13896ab186c6b592a29edda3b6b3add02d94665263c13852b0770fbbeef097
ee381b9745e7012772f872777096e3b22ab049e6e83f6c8690d4072d14c8c0c1
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

nvobco.click Open in urlscan Pro 104.21.11.123 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

75 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

88 kBTransfer

232 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Malicious page.domain Submitted on November 14th 2023, 1:06:52 pm UTC — From Portugal

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

4 Cookies

Security Headers

Indicators

nvobco.click Open in urlscan Pro
104.21.11.123 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

88 kB
Transfer

232 kB
Size

4
Cookies

12 HTTP transactions
1 data transactions

Malicious page.domain
Submitted on November 14th 2023, 1:06:52 pm UTC — From Portugal

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!