www.bancoltau.com Open in urlscan Pro
107.180.54.182  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index5.html Show response www.bancoltau.com/	4 KB 2 KB	187ms 94ms	Document text/html	107.180.54.182 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://www.bancoltau.com/index5.html Protocol HTTP/1.1 Server 107.180.54.182 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-107-180-54-182.ip.secureserver.net Software Apache / Resource Hash bb1abd434bd2531e26f05b2a6d98605b819cfda8f3a5371106079668c0fd0a5f Request headers Host www.bancoltau.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id FCA42F4A3AD06B881AF134A726DC7646 Response headers Date Fri, 07 Sep 2018 20:21:27 GMT Server Apache Last-Modified Tue, 04 Sep 2018 19:51:23 GMT ETag "396015c-d96-57510fb851d1c-gzip" Accept-Ranges bytes Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 1605 Keep-Alive timeout=5 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	aaaa.png www.bancoltau.com/images/	5 KB 5 KB	95ms 94ms	Image image/png	107.180.54.182 GoDaddy.com
General Check archive.org Show headers Download Go to Show image Full URL http://www.bancoltau.com/images/aaaa.png Requested by Host: www.bancoltau.com URL: http://www.bancoltau.com/index5.html Protocol HTTP/1.1 Server 107.180.54.182 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-107-180-54-182.ip.secureserver.net Software Apache / Resource Hash be3d056ebc046ed3b4214142429edbc40590d87dee868666280c39bf3f52f333 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.bancoltau.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://www.bancoltau.com/index5.html Connection keep-alive Cache-Control no-cache Referer http://www.bancoltau.com/index5.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 07 Sep 2018 20:21:27 GMT Last-Modified Tue, 04 Sep 2018 19:51:38 GMT Server Apache ETag "3960167-14c9-57510fc712333" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 5321
GET S	200	tcc_l.combined.1.0.6.min.js Show response img1.wsimg.com/tcc/	12 KB 5 KB	20ms 7ms	Script application/x-javascript	104.111.234.198 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js Requested by Host: www.bancoltau.com URL: http://www.bancoltau.com/index5.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.234.198 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a104-111-234-198.deploy.static.akamaitechnologies.com Software / Resource Hash aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350 Request headers Referer http://www.bancoltau.com/index5.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Fri, 07 Sep 2018 20:21:27 GMT content-encoding gzip last-modified Fri, 31 Mar 2017 16:26:41 GMT status 200 etag "52ef5c943baad21:0" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 4564 expires Sat, 07 Sep 2019 20:21:27 GMT
GET H/1.1	200 OK	count.php Show response stats.hosting24.com/	0 161 B	359ms 110ms	Script text/html	31.170.160.65 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL http://stats.hosting24.com/count.php Requested by Host: www.bancoltau.com URL: http://www.bancoltau.com/index5.html Protocol HTTP/1.1 Server 31.170.160.65 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software Apache / PHP/5.2.17 Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://www.bancoltau.com/index5.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 07 Sep 2018 20:21:28 GMT Server Apache Connection close X-Powered-By PHP/5.2.17 Content-Length 0 Content-Type text/html
GET H/1.1	200 OK	5.png www.bancoltau.com/images/	471 B 739 B	186ms 94ms	Image image/png	107.180.54.182 GoDaddy.com
General Check archive.org Show headers Download Go to Show image Full URL http://www.bancoltau.com/images/5.png Requested by Host: www.bancoltau.com URL: http://www.bancoltau.com/index5.html Protocol HTTP/1.1 Server 107.180.54.182 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-107-180-54-182.ip.secureserver.net Software Apache / Resource Hash 68b1182318737ad5addec7c5d0710ba3a02eafb677a3e7c991239b94c18905df Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.bancoltau.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://www.bancoltau.com/index5.html Connection keep-alive Cache-Control no-cache Referer http://www.bancoltau.com/index5.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 07 Sep 2018 20:21:27 GMT Last-Modified Tue, 04 Sep 2018 19:51:30 GMT Server Apache ETag "3960163-1d7-57510fbf937df" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 471
GET H/1.1	200 OK	event img.secureserver.net/t/1/tl/	43 B 588 B	341ms 167ms	Image image/gif	45.40.130.22 GoDaddy.com
General Check archive.org Show headers Download Go to Show image Full URL http://img.secureserver.net/t/1/tl/event?cts=1536351688319&tce=1536351687656&tcs=1536351687564&tdc=1536351688116&tdclee=1536351688116&tdcles=1536351688116&tdi=1536351688116&tdl=1536351687752&tdle=1536351687564&tdls=1536351687564&tfs=1536351687563&tns=1536351687563&trqs=1536351687657&tre=1536351687751&trps=1536351687750&tles=1536351688116&tlee=1536351688116&ht=perf&dh=www.bancoltau.com&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F67.0.3396.87%20Safari%2F537.36&vci=214418192&cv=1.0.6&z=1249510733&vg=1ff813c8-8326-4a58-ad6b-0e03f53ded62&vtg=1ff813c8-8326-4a58-ad6b-0e03f53ded62&ap=cpsh&trfd=%7B%22cts%22%3A1536351687778%2C%22tccl.baseHost%22%3A%22secureserver.net%22%2C%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22a2plcpnl0534%22%7D&dp=%2Findex5.html Protocol HTTP/1.1 Server 45.40.130.22 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-45-40-130-22.ip.secureserver.net Software Microsoft-IIS/8.5 / ARR/2.5, ASP.NET Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Request headers Referer http://www.bancoltau.com/index5.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 07 Sep 2018 20:21:28 GMT Server Microsoft-IIS/8.5 X-Powered-By ARR/2.5, ASP.NET Access-Control-Max-Age 1000 Access-Control-Allow-Methods GET, PUT, POST, DELETE, OPTIONS P3P CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" Access-Control-Allow-Origin http://www.bancoltau.com, * Cache-Control 0 Content-Type image/gif Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept Content-Length 43

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| maxLengthCheck function| mascaraTelefone object| _trfd function| tcg function| tcp object| perfhandler object| TCCTracker object| _trfq object| true

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

img.secureserver.net
img1.wsimg.com
stats.hosting24.com
www.bancoltau.com
104.111.234.198
107.180.54.182
31.170.160.65
45.40.130.22
68b1182318737ad5addec7c5d0710ba3a02eafb677a3e7c991239b94c18905df
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
bb1abd434bd2531e26f05b2a6d98605b819cfda8f3a5371106079668c0fd0a5f
be3d056ebc046ed3b4214142429edbc40590d87dee868666280c39bf3f52f333
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855