![](/screenshots/f986dcdb-be06-46f9-ad12-1484d1d43cc9.png)
resgatipontoss.com
Open in
urlscan Pro
108.167.132.253
Malicious Activity!
Public Scan
Effective URL: https://resgatipontoss.com/m-livelo/index.php
Submission: On June 28 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 17th 2023. Valid for: 3 months.
This is the only time resgatipontoss.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Livelo (E-commerce) Banco do Brasil (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 192.185.215.219 192.185.215.219 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 10 | 108.167.132.253 108.167.132.253 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
2 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
11 | 2 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: vega-ip07.prodns.com.br
bemblogado.com.br |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 108-167-132-253.unifiedlayer.com
resgatipontoss.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
resgatipontoss.com
1 redirects
resgatipontoss.com |
129 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 749 |
132 KB |
1 |
bemblogado.com.br
1 redirects
bemblogado.com.br |
92 B |
11 | 3 |
Domain | Requested by | |
---|---|---|
10 | resgatipontoss.com |
1 redirects
resgatipontoss.com
|
2 | code.jquery.com |
resgatipontoss.com
|
1 | bemblogado.com.br | 1 redirects |
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.resgatipontoss.com R3 |
2023-06-17 - 2023-09-15 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://resgatipontoss.com/m-livelo/index.php
Frame ID: B246266DA9EC7601E06C08292388BD19
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/f986dcdb-be06-46f9-ad12-1484d1d43cc9.png)
Page URL History Show full URLs
-
https://bemblogado.com.br/?to=
HTTP 302
https://resgatipontoss.com/ HTTP 302
https://resgatipontoss.com/m-livelo/index.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- ([\d.]+)/jquery-ui(?:\.min)?\.js
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bemblogado.com.br/?to=
HTTP 302
https://resgatipontoss.com/ HTTP 302
https://resgatipontoss.com/m-livelo/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
resgatipontoss.com/m-livelo/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-c.css
resgatipontoss.com/m-livelo/css/ |
16 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.css
code.jquery.com/ui/1.13.2/themes/base/ |
35 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
resgatipontoss.com/m-livelo/js/ |
87 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.min.js
resgatipontoss.com/m-livelo/js/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.js
code.jquery.com/ui/1.13.2/ |
517 KB 124 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c2VuaGE4.js
resgatipontoss.com/m-livelo/js/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
livelo.svg
resgatipontoss.com/m-livelo/images/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bG9hZA==.gif
resgatipontoss.com/m-livelo/images/ |
5 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
YmJsb2dvc2FzZGFhcw==.png
resgatipontoss.com/m-livelo/images/ |
59 KB 59 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
resgatipontoss.com/m-livelo/fonts/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Livelo (E-commerce) Banco do Brasil (Banking)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| $jscomp function| getLocation function| showPosition function| showError function| getPlaceHolder8 function| getPlaceHolderA function| getPlaceHolderG function| getClassA function| getClassG function| b64_to_utf8 function| enviaForm function| calculaDigitoMod11 string| str0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bemblogado.com.br
code.jquery.com
resgatipontoss.com
108.167.132.253
192.185.215.219
2001:4de0:ac18::1:a:2a
2220d04132f5cfab8156477b68ded07a22c8aad051d399ff0fd174b9732e697d
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
336938a5bca62ca5948b99ba07a5e9bcc07ef8bd640685a56e807269f359334a
4e3d748ef94a48cad82d7245e7a367ca43db3217ef635ffa3d95226d2567ceb3
692ee04dd9488f890f4768ef27f2a7d8d3f7b8cd3bd478e7b60b82aefe557854
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
a93839a2c1e9457a6a66474a128ae6221798e5fec089c172e8160b592584dd93
c4b0fb9e123ad9f72c1192b6feff0bb0171be251bb76050b92e5e85c1fe3f757
c8c2157918c9fed0bb9dcc56c96b52dc7af70b05ca0228e467eaf91777751ad7
ec58d19ddb88db54ad26e48e0719b58c2134fcfcb3c40a4087a98a1533ca17f6
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e