positively-model-cat.ngrok-free.app
Open in
urlscan Pro
2600:1f16:d83:1200::6e:0
Malicious Activity!
Public Scan
Effective URL: https://positively-model-cat.ngrok-free.app/itau/
Submission: On November 21 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on October 11th 2023. Valid for: 3 months.
This is the only time positively-model-cat.ngrok-free.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 76.76.21.61 76.76.21.61 | 16509 (AMAZON-02) (AMAZON-02) | |
1 7 | 2600:1f16:d83... 2600:1f16:d83:1200::6e:0 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a04:4e42:600... 2a04:4e42:600::649 | 54113 (FASTLY) (FASTLY) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c09::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 34.117.59.81 34.117.59.81 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 | 2607:f8b0:400... 2607:f8b0:4004:c17::5e | 15169 (GOOGLE) (GOOGLE) | |
12 | 6 |
ASN16509 (AMAZON-02, US)
reloadbcr3492psdasasd8882731jhd.vercel.app |
ASN16509 (AMAZON-02, US)
positively-model-cat.ngrok-free.app |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com
ipinfo.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
ngrok-free.app
1 redirects
positively-model-cat.ngrok-free.app |
369 KB |
2 |
gstatic.com
fonts.gstatic.com |
31 KB |
1 |
ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 7097 |
552 B |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
1 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 762 |
78 KB |
1 |
vercel.app
reloadbcr3492psdasasd8882731jhd.vercel.app |
500 B |
12 | 6 |
Domain | Requested by | |
---|---|---|
7 | positively-model-cat.ngrok-free.app |
1 redirects
reloadbcr3492psdasasd8882731jhd.vercel.app
positively-model-cat.ngrok-free.app |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | ipinfo.io |
code.jquery.com
|
1 | fonts.googleapis.com |
positively-model-cat.ngrok-free.app
|
1 | code.jquery.com |
positively-model-cat.ngrok-free.app
|
1 | reloadbcr3492psdasasd8882731jhd.vercel.app | |
12 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.vercel.app R3 |
2023-09-25 - 2023-12-24 |
3 months | crt.sh |
*.ngrok-free.app R3 |
2023-10-11 - 2024-01-09 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
ipinfo.io R3 |
2023-11-07 - 2024-02-05 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://positively-model-cat.ngrok-free.app/itau/
Frame ID: 1EF823A46A3AC6707B7E590179F4CED2
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
ItauPage URL History Show full URLs
- https://reloadbcr3492psdasasd8882731jhd.vercel.app/indexitau.html Page URL
-
https://positively-model-cat.ngrok-free.app/itau
HTTP 301
http://positively-model-cat.ngrok-free.app/itau/ HTTP 307
https://positively-model-cat.ngrok-free.app/itau/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://reloadbcr3492psdasasd8882731jhd.vercel.app/indexitau.html Page URL
-
https://positively-model-cat.ngrok-free.app/itau
HTTP 301
http://positively-model-cat.ngrok-free.app/itau/ HTTP 307
https://positively-model-cat.ngrok-free.app/itau/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
indexitau.html
reloadbcr3492psdasasd8882731jhd.vercel.app/ |
227 B 500 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
positively-model-cat.ngrok-free.app/itau/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
positively-model-cat.ngrok-free.app/itau/files/ |
17 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.js
code.jquery.com/ |
262 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
javamagic.js
positively-model-cat.ngrok-free.app/itau/files/ |
695 B 816 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ipinfo.io/ |
303 B 552 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
positively-model-cat.ngrok-free.app/itau/files/ |
28 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jsconeccion.js
positively-model-cat.ngrok-free.app/itau/files/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fondito.png
positively-model-cat.ngrok-free.app/itau/files/ |
318 KB 319 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery object| button1 object| username object| pass function| ACTION2 function| ACTION3 function| checkAlert1 function| checkAlert20 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
ipinfo.io
positively-model-cat.ngrok-free.app
reloadbcr3492psdasasd8882731jhd.vercel.app
2600:1f16:d83:1200::6e:0
2607:f8b0:4004:c09::5f
2607:f8b0:4004:c17::5e
2a04:4e42:600::649
34.117.59.81
76.76.21.61
0d9027289ffa5d9f6c8b4e0782bb31bbff2cef5ee3708ccbcb7a22df9128bb21
0f303f31706d39866cced9dcc17b61fb8423674278d7f6051d66b3a79ffbca18
13d731f00e42b49a0b780a1d316180e7bd4d3d7824477eef37ef4c961285a939
40b28efb35697da04fc732de83240317bb102fdc28795839dea1dd4e433cdc70
42d0669150069cffc8e51a621fd467be21feb44841343f5909e267cf9aa00e9f
4db7d493be22cd92de079c2e04060e06bc70392221d583c1f1c1c6c20d9619cb
782e3085dd2d33d68a73ef702adfb286aa5855ae2245bdd378bbe45366418278
940b5e1b96b1c50e111cc2122726c23f03a9230bcb8008a6999784c18ec0b008
af94db5fb10d6311f345358cd8d3f3d67de33a161da9884c678d602aa1ef9319
cf0fa8dfca1233f2ec60348748c372190bab07c993c7f3ba7b7d514274764c14
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615