itau-info-py.webcindario.com
Open in
urlscan Pro
5.57.226.202
Malicious Activity!
Public Scan
Submission: On April 15 via api from HU — Scanned from ES
Summary
TLS certificate: Issued by R3 on February 13th 2024. Valid for: 3 months.
This is the only time itau-info-py.webcindario.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 5.57.226.202 5.57.226.202 | 29119 (SERVIHOST...) (SERVIHOSTING-AS AireNetworks) | |
2 | 142.250.186.130 142.250.186.130 | 15169 (GOOGLE) (GOOGLE) | |
2 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2001:4860:480... 2001:4860:4802:36::178 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2620:116:800d... 2620:116:800d:21:c5a4:625:6563:a5bb | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a00:1450:400... 2a00:1450:4001:80b::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:9000:20c... 2600:9000:20c3:9e00:6:44e3:f8c0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:400c:c0a::9c | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.186.164 142.250.186.164 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:82f::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.185.206 142.250.185.206 | 15169 (GOOGLE) (GOOGLE) | |
27 | 14 |
ASN29119 (SERVIHOSTING-AS AireNetworks, ES)
itau-info-py.webcindario.com |
ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net
pagead2.googlesyndication.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN16509 (AMAZON-02, US)
secure.quantserve.com | |
pixel.quantserve.com |
ASN15169 (GOOGLE, US)
fundingchoicesmessages.google.com |
ASN16509 (AMAZON-02, US)
rules.quantcount.com |
ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f4.1e100.net
www.google.com |
ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f14.1e100.net
fundingchoicesmessages.google.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
webcindario.com
itau-info-py.webcindario.com |
127 KB |
4 |
google.com
fundingchoicesmessages.google.com — Cisco Umbrella Rank: 665 www.google.com — Cisco Umbrella Rank: 2 |
122 KB |
2 |
gstatic.com
fonts.gstatic.com |
168 KB |
2 |
quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 1372 pixel.quantserve.com — Cisco Umbrella Rank: 1152 |
10 KB |
2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 33 |
21 KB |
2 |
miarroba.info
hosting.miarroba.info |
1 KB |
2 |
googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 109 |
188 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35 |
6 KB |
1 |
google.es
www.google.es — Cisco Umbrella Rank: 24897 |
408 B |
1 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 87 |
358 B |
1 |
quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 1381 |
641 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 42 |
71 KB |
27 | 12 |
Domain | Requested by | |
---|---|---|
8 | itau-info-py.webcindario.com |
itau-info-py.webcindario.com
|
3 | fundingchoicesmessages.google.com |
pagead2.googlesyndication.com
|
2 | fonts.gstatic.com |
itau-info-py.webcindario.com
|
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | hosting.miarroba.info |
itau-info-py.webcindario.com
|
2 | pagead2.googlesyndication.com |
itau-info-py.webcindario.com
pagead2.googlesyndication.com |
1 | fonts.googleapis.com | |
1 | pixel.quantserve.com |
itau-info-py.webcindario.com
|
1 | www.google.es |
itau-info-py.webcindario.com
|
1 | www.google.com |
itau-info-py.webcindario.com
|
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | rules.quantcount.com |
secure.quantserve.com
|
1 | secure.quantserve.com |
www.googletagmanager.com
|
1 | www.googletagmanager.com |
itau-info-py.webcindario.com
|
27 | 14 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.webcindario.com R3 |
2024-02-13 - 2024-05-13 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
miarroba.info E1 |
2024-04-02 - 2024-07-01 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
quantserve.com R3 |
2024-02-25 - 2024-05-25 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
*.google.es GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://itau-info-py.webcindario.com/
Frame ID: 4E12F8C786F3A249DB5979BF0DF73A78
Requests: 26 HTTP requests in this frame
Frame:
https://hosting.miarroba.info/607f6b0b381bbc1f64fa027d62891072_cookie.php
Frame ID: B0C98D4890AFF1426278609811CBB584
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
InicioDetected technologies
Google AdSense (Advertising Networks) ExpandDetected patterns
- googlesyndication\.com/
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtm\.js
Quantcast Measure (Analytics) Expand
Detected patterns
- \.quantserve\.com/quant\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
itau-info-py.webcindario.com/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ |
145 KB 50 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgn.css
itau-info-py.webcindario.com/ff/ |
141 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LOGO_ita.png
itau-info-py.webcindario.com/ff/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bottom.png
itau-info-py.webcindario.com/ff/ |
28 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
hosting.miarroba.info/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
195 KB 71 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
air-blog.jpg
itau-info-py.webcindario.com/ff/ |
28 KB 28 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
requerido_ban.png
itau-info-py.webcindario.com/login/css/custom-theme/images/ |
4 KB 4 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans.woff
itau-info-py.webcindario.com/Fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202404090101/ |
408 KB 138 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
607f6b0b381bbc1f64fa027d62891072_cookie.php
hosting.miarroba.info/ Frame B0C9 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
quant.js
secure.quantserve.com/ |
23 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ca-pub-7294310421616689
fundingchoicesmessages.google.com/i/ |
180 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
4 B 218 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rules-p-d5x2uDVHd7ALE.js
rules.quantcount.com/ |
160 B 641 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
4 B 358 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ga-audiences
www.google.com/ads/ |
42 B 63 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.es/ads/ |
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pixel;r=636781210;source=gtm;rf=0;a=p-d5x2uDVHd7ALE;url=https%3A%2F%2Fitau-info-py.webcindario.com%2F;uht=2;fpan=1;fpa=P0-518643427-1713193450851;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=...
pixel.quantserve.com/ |
35 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AGSKWxXBqKRVB7P_WTP9Z-lj0OIOBrz1UmNdi20GxC8VwExJwGQWEpXpWxhuKZwhmO7lut5mphFeqgZKa-8Z1Bpfw7Q0u3htiXKmmGhLcNfF7jDebcSnHtVW3xgRpKLCrWDeuFwEkrcocw==
fundingchoicesmessages.google.com/f/ |
416 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
107 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
fonts.gstatic.com/s/opensans/v40/ |
42 KB 43 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flUhRq6tzZclQEJ-Vdg-IuiaDsNcIhQ8tQ.woff2
fonts.gstatic.com/s/materialicons/v140/ |
126 KB 126 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
AGSKWxWa4v_HVIYpRttHBtbhhq_2YSpYstOlDNCUACW17VTYfbwMS_ro7T_cn5u8x1tuiLL6W2xrdfFOBhje_McYZsHnT9Y1_avM-fSf8FUF1KFe6G3sdeTJWhhfhinv0wc2yEDDL7GQMg==
fundingchoicesmessages.google.com/el/ |
0 27 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
itau-info-py.webcindario.com/ |
4 KB 2 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)61 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| dataLayer function| soloNumeros object| google_js_reporting_queue number| google_srt object| google_persistent_state_async object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| google_tag_data object| google_reactive_ads_global_state object| adsbygoogle object| google_sa_queue function| google_process_slots function| google_spfd number| google_unique_id object| google_sv_map number| google_rum_task_id_counter string| google_user_agent_client_hint object| google_tag_manager string| GoogleAnalyticsObject function| mia_ga object| _qevents function| google_sa_impl object| googlefc boolean| adsbygoogle_ama_fc_has_run object| gaplugins object| gaGlobal object| gaData function| quantserve function| __qc object| ezt object| _qoptions object| default_ContributorServingResponseClientJs object| _F_toggles object| __googlefc string| __fcInvoked string| __fcexpdef string| Njc2YmEyNzM3MGQ0MmI4OWxvYWRlcl9qcw== string| Njc2YmEyNzM3MGQ0MmI4OWNhY2hlZF9qcw== object| __fcInternalApiManager boolean| __fcInternalApiPostMessageReady object| __tcfapiEventListeners function| __tcfapi object| __tcfapiManager boolean| __tcfapiPostMessageReady function| __uspapi object| __uspapiManager boolean| __uspapiPostMessageReady object| __gppEventListeners function| __gpp object| __gppManager boolean| __gppPostMessageReady4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.itau-info-py.webcindario.com/ | Name: _ga Value: GA1.3.336832730.1713193451 |
|
.itau-info-py.webcindario.com/ | Name: _gid Value: GA1.3.796758115.1713193451 |
|
.itau-info-py.webcindario.com/ | Name: _gat_UA-597118-7 Value: 1 |
|
.webcindario.com/ | Name: __qca Value: P0-518643427-1713193450851 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
hosting.miarroba.info
itau-info-py.webcindario.com
pagead2.googlesyndication.com
pixel.quantserve.com
rules.quantcount.com
secure.quantserve.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.es
www.googletagmanager.com
142.250.185.206
142.250.186.130
142.250.186.164
188.114.97.3
2001:4860:4802:36::178
2600:9000:20c3:9e00:6:44e3:f8c0:93a1
2620:116:800d:21:c5a4:625:6563:a5bb
2a00:1450:4001:808::2008
2a00:1450:4001:80b::200a
2a00:1450:4001:80b::200e
2a00:1450:4001:812::2003
2a00:1450:4001:82f::2003
2a00:1450:400c:c0a::9c
5.57.226.202
0651bcf21bec23bf6798211206b92104f70f337291eaa6820397ea4cabd2da3f
2e3286de4dbf7d2cf279d2f6fbcbe67d4a8eea0e9685fd6aadf62227fa99bd4b
3aff6206d924c35025b595d4876ee279d1519269999e066aa8ffc41189050527
45a4c240a17a4d5f925ef0e125b86d882c6ad7549028d9cbf6f4f06fd1dd897d
48356c1f6c22a6ded888dd97b2e8f82a428e992ceab0bb9c9d13c5b1caecbdcc
4a4dbc62fa335e411b94a532be091c58c0c0c4fa731339f11722577d3cf6443b
530450c99b610df9f0e84a708d7fb384e2c28ad8b9b0f05a948510b5f1cd76d3
59e59a6f0d77d21b2ffafe6e5e446a8233b755ca1ec6e7a30f3e47777e172a70
711e9a4ca4356beee907e5b14837b097dc1267d5465128b4cc44deb432aa107d
757545bad8ef2acca1e74f30d179c36fc152f43cb1eef04b1193f6d8ad372c40
76460e705cc668b3f517809abed94e599230b18e920d2d865f52f54aa76b7ede
94a23e7f96fbde62943e5fc93c59212f68a57d2587fe51f056d20ce802e8249c
94dcf5556e059d9e35d347a9fdd7c295ec5d8001d8c00693dfc2a7d18f9fb0f3
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
c62dd072c8429ea3e2c6a50f7553e289c9e836b6375baee2b71a4c7b264a38fb
d165c7651b60df29b6987f9850815a5c47baacd6778a877ba4a14c7b6b15c0ed
d60c833406c5cca9095b3cabd40d6f65e486a0a4c0b59105031c9a6e94595f5a
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c37996f6404fc8b5257720ca77065bff34264a416584c2ca5cbc4c21f94bcf
ee833ec82772d038aabee277cd8a72d68a96daf1d6e528f69220d782829d71d9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ffde23061ced5884cf19fb4baee2c2e27235f027ea4996d5253734245c4875cf