clicknodinheiro.com.br Open in urlscan Pro
2606:4700:3035::681b:8660 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
Submission: On September 29 via automatic, source openphish (September 29th 2020, 1:19:01 pm UTC)

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3035::681b:8660, located in United States and belongs to CLOUDFLARENET, US. The main domain is clicknodinheiro.com.br.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 23rd 2020. Valid for: a year.

This is the only time clicknodinheiro.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commonwealth Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
16	2606:4700:303... 2606:4700:3035::681b:8660	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:a823	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	2

16 2606:4700:3035::681b:8660 (United States)

ASN13335 (CLOUDFLARENET, US)

clicknodinheiro.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a823 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	clicknodinheiro.com.br clicknodinheiro.com.br	593 KB
1	cloudflare.com ajax.cloudflare.com	4 KB
17	2

	Domain	Requested by
16	clicknodinheiro.com.br	clicknodinheiro.com.br ajax.cloudflare.com
1	ajax.cloudflare.com	clicknodinheiro.com.br
17	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-05-23` - `2021-05-23`	a year	crt.sh
ajax.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-11` - `2022-08-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
Frame ID: 6BC3B986EFDB1672C9F5A65B5D4B1C95
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

17
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

597 kB
Transfer

1695 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login.php Show response
clicknodinheiro.com.br/yhdio/233e6e285e294e6/ 6 KB
2 KB 606ms
588ms Document
text/html 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8041c9e800acb23f7935f960f8f550b446dd1f41bcc2e20df4c49144618ef38

Request headers

:method: GET
:authority: clicknodinheiro.com.br
:scheme: https
:path: /yhdio/233e6e285e294e6/login.php?signin=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 29 Sep 2020 13:18:41 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=db0f686003b4aa743894c80dadcf443261601385520; expires=Thu, 29-Oct-20 13:18:40 GMT; path=/; domain=.clicknodinheiro.com.br; HttpOnly; SameSite=Lax PHPSESSID=09a86f84b90e8abe52eda4cc0e76f823; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 057b9cf60a0000beba1ca8b200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5da5fdd01cc0beba-FRA
content-encoding: br

GET
H2 200 bootstrap.min.css
clicknodinheiro.com.br/yhdio/assets/css/ 138 KB
19 KB 22ms
19ms Stylesheet
text/css 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/css/bootstrap.min.css
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd3c862beba-FRA
cf-request-id: 057b9cf85e0000beba1ca9c200000001

GET
H2 200 helpers.css
clicknodinheiro.com.br/yhdio/assets/css/ 41 KB
3 KB 18ms
16ms Stylesheet
text/css 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/css/helpers.css
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd3c863beba-FRA
cf-request-id: 057b9cf85f0000beba1ca9d200000001

GET
H2 200 fonts.css
clicknodinheiro.com.br/yhdio/assets/css/ 2 KB
406 B 17ms
14ms Stylesheet
text/css 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/css/fonts.css
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b59fe62e81c750a2ef12a0af668e5555f5515071979336574b1067bc7fca4

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd3c864beba-FRA
cf-request-id: 057b9cf85f0000beba1ca9e200000001

GET
H2 200 main.css
clicknodinheiro.com.br/yhdio/assets/css/ 6 KB
1 KB 21ms
18ms Stylesheet
text/css 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/css/main.css
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e22b64ec93a6f2dac37ccffe20b269ebf8935b6e94b95066b8f6c582204482fe

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd3c865beba-FRA
cf-request-id: 057b9cf85f0000beba1ca9f200000001

GET
H2 200 logo.gif
clicknodinheiro.com.br/yhdio/assets/images/ 5 KB
5 KB 22ms
20ms Image
image/gif 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clicknodinheiro.com.br/yhdio/assets/images/logo.gif
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5da5fdd3c866beba-FRA
content-length: 4852
cf-request-id: 057b9cf85f0000beba1caa0200000001

GET
H2 200 img.jpg
clicknodinheiro.com.br/yhdio/assets/images/ 9 KB
9 KB 17ms
15ms Image
image/jpeg 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clicknodinheiro.com.br/yhdio/assets/images/img.jpg
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd6fef508543b6769b06c39aeb9e81ff35bad074cd41adf18ac92f2d55f60ce0

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5da5fdd3c867beba-FRA
content-length: 9467
cf-request-id: 057b9cf85f0000beba1caa1200000001

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
4 KB 35ms
12ms Script
application/javascript 2606:4700::6810:a823
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Fri, 25 Sep 2020 21:34:15 GMT
server: cloudflare
etag: W/"5f6e6257-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 5da5fdd3fc1cbea6-FRA
cf-request-id: 057b9cf8760000bea6d61cd200000001
expires: Thu, 01 Oct 2020 13:18:41 GMT

GET
H2 200 login-bg.png
clicknodinheiro.com.br/yhdio/assets/images/ 254 B
544 B 17ms
16ms Image
image/png 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clicknodinheiro.com.br/yhdio/assets/images/login-bg.png
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/assets/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0755c4aa02ff90cf951d4752166ce52ea98cb85b86186f954dcc5d9d9cd02c0

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/assets/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 424
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5da5fdd3f8aebeba-FRA
cf-int-pingora-origin-digest: {"ext_ip":"162.158.94.103","ext_port":43630,"upstream_rtt":128,"upstream_reused":false,"cipher":"TLS_AES_256_GCM_SHA384","tls_version":"TLSv1.3","cert_digest":"/o3cln20gwbtxtvSesORVa7ZQ3ZwGR1fj5ik70SD4/k","http_version":2}
content-length: 254
cf-request-id: 057b9cf87c0000beba1caa5200000001

GET
H2 200 imgs.png
clicknodinheiro.com.br/yhdio/assets/images/ 14 KB
14 KB 13ms
13ms Image
image/png 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clicknodinheiro.com.br/yhdio/assets/images/imgs.png
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/assets/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/assets/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 424
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5da5fdd3f8b1beba-FRA
content-length: 14207
cf-request-id: 057b9cf87d0000beba1caa7200000001

GET
H2 200 MyriadPro-Bold.otf
clicknodinheiro.com.br/yhdio/assets/fonts/ 93 KB
60 KB 21ms
20ms Font
font/otf 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/fonts/MyriadPro-Bold.otf
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/assets/css/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c2ba3c35316ae8e6730758bfdf60e1f90d0db8a1044b122d03b6b75b55942a8

Request headers

Origin: https://clicknodinheiro.com.br
Referer: https://clicknodinheiro.com.br/yhdio/assets/css/fonts.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 424
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/otf
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd3f8b5beba-FRA
cf-request-id: 057b9cf87e0000beba1caa8200000001

GET
H2 200 MyriadPro-Regular.otf
clicknodinheiro.com.br/yhdio/assets/fonts/ 92 KB
60 KB 55ms
55ms Font
font/otf 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/fonts/MyriadPro-Regular.otf
Requested by: Host: clicknodinheiro.com.br
URL: https://clicknodinheiro.com.br/yhdio/assets/css/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8f1b80682c8fc7f594791983ad8a217f17a8abd6062c7430d42c50f63711039

Request headers

Origin: https://clicknodinheiro.com.br
Referer: https://clicknodinheiro.com.br/yhdio/assets/css/fonts.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 424
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/otf
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd3f8b7beba-FRA
cf-int-pingora-origin-digest: {"ext_ip":"162.158.90.203","ext_port":35968,"upstream_rtt":128,"upstream_reused":false,"cipher":"TLS_AES_256_GCM_SHA384","tls_version":"TLSv1.3","cert_digest":"/o3cln20gwbtxtvSesORVa7ZQ3ZwGR1fj5ik70SD4/k","http_version":2}
cf-request-id: 057b9cf87f0000beba1caa9200000001

GET
H2 200 main.js Show response
clicknodinheiro.com.br/yhdio/assets/js/ 2 KB
548 B 17ms
16ms Script
application/javascript 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/js/main.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0efb38dc6a7d9501f748243c833e3067981d4f0e8b767d8be21c7dceefba170e

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd438f5beba-FRA
cf-request-id: 057b9cf8a00000beba1caaa200000001

GET
H2 200 fontawesome.min.js Show response
clicknodinheiro.com.br/yhdio/assets/js/ 1 MB
360 KB 64ms
63ms Script
application/javascript 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/js/fontawesome.min.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd438f8beba-FRA
cf-request-id: 057b9cf8a00000beba1caab200000001

GET
H2 200 bootstrap.min.js Show response
clicknodinheiro.com.br/yhdio/assets/js/ 133 KB
23 KB 21ms
20ms Script
application/javascript 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/js/bootstrap.min.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2caa6404ddb0de2b9d191b1e2c8b5c35c68ca48f2a9521140bbf83b27c063700

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd438f9beba-FRA
cf-request-id: 057b9cf8a00000beba1caac200000001

GET
H2 200 popper.min.js Show response
clicknodinheiro.com.br/yhdio/assets/js/ 20 KB
7 KB 14ms
13ms Script
application/javascript 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/js/popper.min.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd438fabeba-FRA
cf-request-id: 057b9cf8a00000beba1caad200000001

GET
H2 200 jquery.min.js Show response
clicknodinheiro.com.br/yhdio/assets/js/ 86 KB
29 KB 19ms
18ms Script
application/javascript 2606:4700:3035::681b:8660
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://clicknodinheiro.com.br/yhdio/assets/js/jquery.min.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681b:8660 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a

Request headers

Referer: https://clicknodinheiro.com.br/yhdio/233e6e285e294e6/login.php?signin=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:18:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 28 Sep 2020 20:42:12 GMT
server: cloudflare
age: 425
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 5da5fdd438fcbeba-FRA
cf-request-id: 057b9cf8a10000beba1caae200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commonwealth Bank (Banking)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			clicknodinheiro.com.br/	1969-12-31 23:59:59	Name: PHPSESSID Value: 09a86f84b90e8abe52eda4cc0e76f823
			.clicknodinheiro.com.br/	1970-01-19 13:32:57	Name: __cfduid Value: db0f686003b4aa743894c80dadcf443261601385520

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
clicknodinheiro.com.br
2606:4700:3035::681b:8660
2606:4700::6810:a823
0c2ba3c35316ae8e6730758bfdf60e1f90d0db8a1044b122d03b6b75b55942a8
0efb38dc6a7d9501f748243c833e3067981d4f0e8b767d8be21c7dceefba170e
21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
2caa6404ddb0de2b9d191b1e2c8b5c35c68ca48f2a9521140bbf83b27c063700
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
3b7b59fe62e81c750a2ef12a0af668e5555f5515071979336574b1067bc7fca4
4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341
d8f1b80682c8fc7f594791983ad8a217f17a8abd6062c7430d42c50f63711039
e22b64ec93a6f2dac37ccffe20b269ebf8935b6e94b95066b8f6c582204482fe
f0755c4aa02ff90cf951d4752166ce52ea98cb85b86186f954dcc5d9d9cd02c0
f8041c9e800acb23f7935f960f8f550b446dd1f41bcc2e20df4c49144618ef38
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765
fd6fef508543b6769b06c39aeb9e81ff35bad074cd41adf18ac92f2d55f60ce0

clicknodinheiro.com.br Open in urlscan Pro 2606:4700:3035::681b:8660 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

597 kBTransfer

1695 kBSize

2 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

2 Cookies

Indicators

clicknodinheiro.com.br Open in urlscan Pro
2606:4700:3035::681b:8660 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

597 kB
Transfer

1695 kB
Size

2
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!