novo-2024.com Open in urlscan Pro
172.67.171.39 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://novo-2024.com/
Submission Tags: @phish_report
Submission: On December 26 via api (December 26th 2024, 8:48:13 pm UTC) from FI — Scanned from PT

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 16 HTTP transactions. The main IP is 172.67.171.39, located in United States and belongs to CLOUDFLARENET, US. The main domain is novo-2024.com.
TLS certificate: Issued by WE1 on December 26th 2024. Valid for: 3 months.

This is the only time novo-2024.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Novobanco (Banking)

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
11	172.67.171.39 172.67.171.39	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.246.203 104.17.246.203	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	216.58.212.138 216.58.212.138	15169 (GOOGLE) (GOOGLE)
1	142.250.185.131 142.250.185.131	15169 (GOOGLE) (GOOGLE)
16	4

11 172.67.171.39 (United States)

ASN13335 (CLOUDFLARENET, US)

novo-2024.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.246.203 (None, )

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.212.138 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	novo-2024.com novo-2024.com	92 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	3 KB
2	unpkg.com unpkg.com — Cisco Umbrella Rank: 740	130 KB
1	gstatic.com fonts.gstatic.com	10 KB
16	4

	Domain	Requested by
11	novo-2024.com	novo-2024.com
2	fonts.googleapis.com	novo-2024.com
2	unpkg.com	novo-2024.com unpkg.com
1	fonts.gstatic.com	fonts.googleapis.com
16	4

This site contains no links.

Subject Issuer	Validity	Valid
novo-2024.com WE1	`2024-12-26` - `2025-03-26`	3 months	crt.sh
unpkg.com WE1	`2024-12-12` - `2025-03-12`	3 months	crt.sh
upload.video.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.gstatic.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://novo-2024.com/
Frame ID: 10DBEB32900CA1D3312F79725AE4CAF8
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Particulares | novobanco

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

235 kB
Transfer

568 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
novo-2024.com/ 9 KB
3 KB 530ms
462ms Document
text/html 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9d3272ee2ef6c32ce8d7468fdff4a3630044fd4b3351afc4881e31309250bc1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8f83ee11eda6b109-MAD
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Thu, 26 Dec 2024 20:48:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fJotqhwbp2FzxUS2UsrnxvyDKhOkEOEH%2BOz%2FrKmVoZg2LqTg5Js%2Fply04no8yfIg60JIaI6mT6cju%2FmhJtnuo5OY5fMcaRpGIXR%2B6lRYucyO4s%2FCiLYp1zECCzSJhnC7"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=54338&min_rtt=51205&rtt_var=14337&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4175&recv_bytes=4508&delivery_rate=367&cwnd=12000&unsent_bytes=0&cid=216e035b4819e577&ts=465&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding

GET
H3 200 bootstrap.min.css
novo-2024.com/panel/bootstrap/css/ 156 KB
24 KB 252ms
251ms Stylesheet
text/css 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/panel/bootstrap/css/bootstrap.min.css
Requested by: Host: novo-2024.com
URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "26f1b-5988237fc3800-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WBYHpMZd7J%2FJGYcoJMucF84RzX1777%2BygmJ7dlzUa8mS4n6qisoGCZQzRNU9Tm7Whe7P5B2Cx5w8bLAi%2Fsai5560B6pHtWgq7aYqMn1tLs2WwWgfu%2F7hENFmCOVHMEuc"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=53537&min_rtt=51205&rtt_var=7224&sent=30&recv=22&lost=0&retrans=0&sent_bytes=20640&recv_bytes=7881&delivery_rate=5346&cwnd=12000&unsent_bytes=0&cid=216e035b4819e577&ts=787&x=1", cfExtPri, cfHdrFlush;dur=2
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: text/css
last-modified: Fri, 29 Nov 2019 20:38:56 GMT
vary: Accept-Encoding
priority: u=0,i=?0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f83ee154d1ab109-MAD
accept-ranges: bytes
content-length: 23688
server: cloudflare

GET
H2 200 boxicons.min.css
unpkg.com/boxicons@2.1.4/css/ 66 KB
16 KB 163ms
66ms Stylesheet
text/css 104.17.246.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/boxicons@2.1.4/css/boxicons.min.css

Requested by

Host: novo-2024.com
URL: https://novo-2024.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.246.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

620eea24b0cee1d8cc8395c80f295cf2e7b6fab962493c26b49a8d42b63a4dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: "109bc-IH/O3L/2oFuyFxGxc9h5/AQWzS0"
age: 661647
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01JFEMM629E5PCG40K77FVXZPB-mad
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
via: 1.1 fly.io
cf-ray: 8f83ee15da43e3b0-LIS
access-control-allow-origin: *
server: cloudflare

GET
H3 200 style.css
novo-2024.com/panel/css/ 6 KB
2 KB 252ms
250ms Stylesheet
text/css 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/panel/css/style.css
Requested by: Host: novo-2024.com
URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d49d8210436e04efd90cea81d2b17d453c2c344626d63d1667cd7be0bfff662

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "19e7-62a1746667c80-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZWZuqxJQUBa4NZzCpoWSu2FqX6YMJbdoKKgFyJOxuaFx%2FB%2FvjU%2B%2BZN7Zdif8InsImN3mChA74MWYxwVBkEBFPHTBQ3wfQLXiYIVatY0xz70L9Rp7ZdYAt%2FPo6I4Wzq5f"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=53537&min_rtt=51205&rtt_var=7224&sent=30&recv=22&lost=0&retrans=0&sent_bytes=20640&recv_bytes=7881&delivery_rate=5346&cwnd=12000&unsent_bytes=0&cid=216e035b4819e577&ts=770&x=1", cfExtPri, cfHdrFlush;dur=19
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: text/css
last-modified: Wed, 25 Dec 2024 12:21:54 GMT
vary: Accept-Encoding
priority: u=0,i=?0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f83ee154d1cb109-MAD
accept-ranges: bytes
content-length: 1810
server: cloudflare

GET
H3 200 jquery.min.js Show response
novo-2024.com/panel/bootstrap/jquery/ 86 KB
31 KB 200ms
198ms Script
text/javascript 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/panel/bootstrap/jquery/jquery.min.js
Requested by: Host: novo-2024.com
URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "15851-588362599c800-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l3zMgHrUERo2V54GEe2fJpkkwKdBvsyssSSFIg3Zx3Z92%2FzPseHsKYQaId50pyFyhNRp6eDQvCN6xklnDxRg5Ymc%2F7aynpyDnE1GRbIRP7G%2FxuBwmmSV%2BpM69GYpIX%2F6"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=53774&min_rtt=51205&rtt_var=9002&sent=20&recv=21&lost=0&retrans=0&sent_bytes=9479&recv_bytes=7837&delivery_rate=68972&cwnd=12000&unsent_bytes=0&cid=216e035b4819e577&ts=738&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: text/javascript
last-modified: Mon, 06 May 2019 11:10:24 GMT
vary: Accept-Encoding
priority: u=1,i=?0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f83ee154d1eb109-MAD
accept-ranges: bytes
content-length: 30679
server: cloudflare

GET
H3 200 option.js Show response
novo-2024.com/js/ 153 B
816 B 196ms
195ms Script
text/javascript 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/js/option.js
Requested by: Host: novo-2024.com
URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9102dcea7cff32b93c50ed12956b8b2b713fd7584301f6f72167530f2fd99c58

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "99-621e809a1ec80-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SwK1vMgavLN9OOXDFsQeTeeM6BQdpnueeeXk5%2F5Lekar3q%2B1eysjZCo6Svmp8FsFYq8BaKnayXEHONaO%2FIgO5IQpP0pA3Ifenki76B%2Fifobw3PjeqSrbAALMFHBrQBIz"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=53774&min_rtt=51205&rtt_var=9002&sent=19&recv=21&lost=0&retrans=0&sent_bytes=8640&recv_bytes=7837&delivery_rate=68972&cwnd=12000&unsent_bytes=0&cid=216e035b4819e577&ts=733&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: text/javascript
last-modified: Thu, 12 Sep 2024 08:38:58 GMT
vary: Accept-Encoding
priority: u=1,i=?0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f83ee154d1fb109-MAD
accept-ranges: bytes
content-length: 141
server: cloudflare

GET
H3 200 browser.js Show response
novo-2024.com/js/ 177 B
835 B 137ms
135ms Script
text/javascript 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/js/browser.js
Requested by: Host: novo-2024.com
URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88b3ddfe6a6325ec3b23e94ba04b24c6ad057e582eb73c4588db425a1a91d73b

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "b1-621f20f413d80-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7MBYpS%2FjATL5p5yjBksUPw1li%2FkNkUsr1QFdw4U7wQGVUbsLWoQA8R%2FvMeGozZ0AQMW4WJxC7VnudvZaM2svH9vRHFCCC9h9lDubhZzWscI24HMpB9jxMkJQ58iHw7Fk"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=53774&min_rtt=51205&rtt_var=9002&sent=18&recv=21&lost=0&retrans=0&sent_bytes=7782&recv_bytes=7837&delivery_rate=68972&cwnd=12000&unsent_bytes=0&cid=216e035b4819e577&ts=674&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: text/javascript
last-modified: Thu, 12 Sep 2024 20:36:22 GMT
vary: Accept-Encoding
priority: u=1,i=?0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f83ee154d21b109-MAD
accept-ranges: bytes
content-length: 158
server: cloudflare

GET
H3 200 logo.png
novo-2024.com/panel/images/ 2 KB
3 KB 317ms
316ms Image
image/png 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://novo-2024.com/panel/images/logo.png
Requested by: Host: novo-2024.com
URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9ca39976d34bdf231cc9be2e890f01a9f63fc6b59a25fb2a985e59526cad470

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
etag: "95d-5c8daeb338080"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u2%2BTo2HkKyrWMsZXqzcLpNr2xjUCIsElwsXs4t%2BhA5gyDQSd4iExyma4kgMsFtoVOmXYkFwjYbJD5JxA3lSIrtOqqVFRYECF1QIeDsqiZFutQI4N1I4qVjGbasrAnl20"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f83ee154d22b109-MAD
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=53553&min_rtt=51205&rtt_var=3057&sent=83&recv=39&lost=0&retrans=0&sent_bytes=77489&recv_bytes=8613&delivery_rate=120955&cwnd=45600&unsent_bytes=0&cid=216e035b4819e577&ts=856&x=1", cfExtPri, cfHdrFlush;dur=0
content-length: 2397
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: image/png
last-modified: Fri, 06 Aug 2021 02:37:38 GMT
server: cloudflare
priority: u=2,i

GET
H3 200 popper.min.js Show response
novo-2024.com/panel/bootstrap/js/ 19 KB
7 KB 302ms
301ms Script
text/javascript 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/panel/bootstrap/js/popper.min.js
Requested by: Host: novo-2024.com
URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1550d30e03f777fb25a2761e42fd8640fc2891fe3f8319524e5a0f17ede803d

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "4af7-5afd8607aa380-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WCU0c0kbkewj8AhMdIdaldEbWzrQNG%2BixRJf3Ua%2FNd4u2kQXMAStezYf6kuR49umn3GxbNyNkNW9YLA%2BfPtOVDJtbMAlhSROhYhdnpws7kmTf4Jps8pUYwjAiI5tOONV"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=54388&min_rtt=51205&rtt_var=2696&sent=52&recv=27&lost=0&retrans=0&sent_bytes=43782&recv_bytes=8096&delivery_rate=74779&cwnd=24000&unsent_bytes=0&cid=216e035b4819e577&ts=819&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: text/javascript
last-modified: Mon, 21 Sep 2020 20:05:50 GMT
vary: Accept-Encoding
priority: u=2,i=?0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f83ee154d23b109-MAD
accept-ranges: bytes
content-length: 6915
server: cloudflare

GET
H3 200 bootstrap.min.js Show response
novo-2024.com/panel/bootstrap/js/ 59 KB
16 KB 348ms
348ms Script
text/javascript 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/panel/bootstrap/js/bootstrap.min.js
Requested by: Host: novo-2024.com
URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
etag: "ea6a-5988237fc3800-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HMJMIZ41UHsiRZMZVb7Z6HvtOYgg%2F%2Bm6KY4M9eN0CLmnfdDL8MrF7%2Bnyg5hlyOZbLYd%2FIvSV3DBakQk4k%2FfgH65O6bnMfI%2F%2Bkg1IROaEy4iEI1u8P5WWKulQoXijzufj"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=55669&min_rtt=51171&rtt_var=5292&sent=87&recv=54&lost=0&retrans=0&sent_bytes=80622&recv_bytes=9271&delivery_rate=602704&cwnd=45600&unsent_bytes=0&cid=216e035b4819e577&ts=902&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: text/javascript
last-modified: Fri, 29 Nov 2019 20:38:56 GMT
vary: Accept-Encoding
priority: u=2,i=?0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f83ee155d5fb109-MAD
accept-ranges: bytes
content-length: 15921
server: cloudflare

GET
H3 200 script.js Show response
novo-2024.com/panel/ 0
644 B 287ms
286ms Script
text/javascript 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/panel/script.js
Requested by: Host: novo-2024.com
URL: https://novo-2024.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
etag: "0-62a02cd202100"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pSAJIgmrylOtxtMW07VvCvArt25bNDw%2BngAitFupS0IEmeiH65lthUTS16yVvgK9iO79ca0Lp%2BNOVQA64JJ4pTeutoCNgPzoCvC4sbr4gv0UNvEw1DRrotYLh5QBKItY"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f83ee155d60b109-MAD
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=56161&min_rtt=51205&rtt_var=5568&sent=53&recv=28&lost=0&retrans=0&sent_bytes=44640&recv_bytes=8140&delivery_rate=83866&cwnd=24000&unsent_bytes=0&cid=216e035b4819e577&ts=827&x=1", cfExtPri, cfHdrFlush;dur=13
content-length: 0
date: Thu, 26 Dec 2024 20:48:08 GMT
content-type: text/javascript
last-modified: Tue, 24 Dec 2024 11:56:20 GMT
server: cloudflare
priority: u=2,i=?0

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
1 KB 260ms
97ms Stylesheet
text/css 216.58.212.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Noto+Sans+PhagsPa&display=swap

Requested by

Host: novo-2024.com
URL: https://novo-2024.com/panel/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f10.1e100.net

Software

ESF /

Resource Hash

d513838bb813daa3c300c56b0ec197180108c6c79fea83c827e3fb18125324b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, max-age=86400
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 26 Dec 2024 20:48:09 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 20:48:09 GMT
x-xss-protection: 0
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 css2
fonts.googleapis.com/ 29 KB
2 KB 250ms
87ms Stylesheet
text/css 216.58.212.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap

Requested by

Host: novo-2024.com
URL: https://novo-2024.com/panel/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f10.1e100.net

Software

ESF /

Resource Hash

4ac697fbc5b9f380a257e982b8aaa87e0bdbdaf927b1d3b4d3b77d947ebd0051

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, max-age=86400
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 26 Dec 2024 20:48:09 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 20:48:09 GMT
x-xss-protection: 0
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server: ESF
x-frame-options: SAMEORIGIN

GET
H3 200 XLY8IYr5bJNDGYxPGjyYbaEjwQR-LGlrasclG3eS.woff2
fonts.gstatic.com/s/notosansphagspa/v23/ 10 KB
10 KB 165ms
79ms Font
font/woff2 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosansphagspa/v23/XLY8IYr5bJNDGYxPGjyYbaEjwQR-LGlrasclG3eS.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+PhagsPa&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

a14de4ae9c2a7234f0ac3d7eb08b625eebf16917ee92de05728ffe6425c96988

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Origin: https://novo-2024.com
Referer: https://fonts.googleapis.com/

Response headers

age: 39455
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 26 Dec 2025 09:50:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Dec 2024 09:50:34 GMT
last-modified: Mon, 09 Dec 2024 20:56:46 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10168
x-xss-protection: 0
server: sffe

GET
H2 200 boxicons.woff2
unpkg.com/boxicons@2.1.4/fonts/ 113 KB
113 KB 157ms
64ms Font
font/woff2 104.17.246.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/boxicons@2.1.4/fonts/boxicons.woff2

Requested by

Host: unpkg.com
URL: https://unpkg.com/boxicons@2.1.4/css/boxicons.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.246.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b87cbc74f3ffaf08314a5d81b501be6fc36f553dbe446ef5a4b29f0138ba0b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Origin: https://novo-2024.com
Referer: https://unpkg.com/boxicons@2.1.4/css/boxicons.min.css

Response headers

cf-cache-status: HIT
etag: "1c3e0-dYYItuOc1CPdme7DmA+Oiq4NlrA"
age: 673362
x-content-type-options: nosniff
date: Thu, 26 Dec 2024 20:48:09 GMT
content-type: font/woff2
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01JFE9EQ02QN7G91G2VZTVSS7W-mad
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
via: 1.1 fly.io
cf-ray: 8f83ee1988194892-LIS
accept-ranges: bytes
access-control-allow-origin: *
content-length: 115680
server: cloudflare

GET
H3 200 favicon.ico
novo-2024.com/ 9 KB
3 KB 386ms
386ms Other
text/html 172.67.171.39
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://novo-2024.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.171.39 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9d3272ee2ef6c32ce8d7468fdff4a3630044fd4b3351afc4881e31309250bc1

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://novo-2024.com/

Response headers

cache-control: no-store, no-cache, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q4o0hWMaon6hiXL3MBg2vmZgBrLd4ra3M%2F8Q5djdhYSfI%2B%2Ft0bg30ENbISqoLBNTqdIDQWBMRJkB0%2BwBTDfZCO6pTssl0Q8VlY3bTM4apDD9vu%2FfYT6tZwavoPjhNJxt"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f83ee1ae9abb109-MAD
expires: Thu, 19 Nov 1981 08:52:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=58220&min_rtt=51083&rtt_var=5480&sent=105&recv=65&lost=0&retrans=0&sent_bytes=97662&recv_bytes=10115&delivery_rate=25850&cwnd=45600&unsent_bytes=0&cid=216e035b4819e577&ts=1822&x=1", cfExtPri, cfHdrFlush;dur=0
date: Thu, 26 Dec 2024 20:48:09 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

Verdicts & Comments Add Verdict or Comment

Malicious page.domain
Submitted on December 26th 2024, 8:54:27 pm UTC — From Portugal

Threats: Phishing
Brands: Novobanco PT
Comment: Phishing domain, targets customers of Portuguese bank (real domain is 'novobanco.pt'). Phish kit is viewable when a Portuguese IP is used.

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Novobanco (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			novo-2024.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 26vopvgh4lu243m2rrk3cuhc42

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://novo-2024.com/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
novo-2024.com
unpkg.com
104.17.246.203
142.250.185.131
172.67.171.39
216.58.212.138
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
4ac697fbc5b9f380a257e982b8aaa87e0bdbdaf927b1d3b4d3b77d947ebd0051
4b87cbc74f3ffaf08314a5d81b501be6fc36f553dbe446ef5a4b29f0138ba0b0
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
620eea24b0cee1d8cc8395c80f295cf2e7b6fab962493c26b49a8d42b63a4dc9
6d49d8210436e04efd90cea81d2b17d453c2c344626d63d1667cd7be0bfff662
88b3ddfe6a6325ec3b23e94ba04b24c6ad057e582eb73c4588db425a1a91d73b
9102dcea7cff32b93c50ed12956b8b2b713fd7584301f6f72167530f2fd99c58
a14de4ae9c2a7234f0ac3d7eb08b625eebf16917ee92de05728ffe6425c96988
a9ca39976d34bdf231cc9be2e890f01a9f63fc6b59a25fb2a985e59526cad470
c9d3272ee2ef6c32ce8d7468fdff4a3630044fd4b3351afc4881e31309250bc1
d1550d30e03f777fb25a2761e42fd8640fc2891fe3f8319524e5a0f17ede803d
d513838bb813daa3c300c56b0ec197180108c6c79fea83c827e3fb18125324b8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

novo-2024.com Open in urlscan Pro 172.67.171.39 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

235 kBTransfer

568 kBSize

1 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Malicious page.domain Submitted on December 26th 2024, 8:54:27 pm UTC — From Portugal

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

novo-2024.com Open in urlscan Pro
172.67.171.39 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

235 kB
Transfer

568 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Malicious page.domain
Submitted on December 26th 2024, 8:54:27 pm UTC — From Portugal

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!