oresgateptssite.online Open in urlscan Pro
62.3.58.85 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/resgat
Effective URL:
https://oresgateptssite.online/
Submission: On November 16 via automatic, source phishtank (November 16th 2023, 10:24:31 am UTC) — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 62.3.58.85, located in Moscow, Russian Federation and belongs to TIMEHOST-AS, UA. The main domain is oresgateptssite.online.
TLS certificate: Issued by R3 on November 1st 2023. Valid for: 3 months.

This is the only time oresgateptssite.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco do Brasil (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
12	62.3.58.85 62.3.58.85	212913 (TIMEHOST-AS) (TIMEHOST-AS)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	2

1 67.199.248.10 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 62.3.58.85 (Moscow, Russian Federation)

ASN212913 (TIMEHOST-AS, UA)
PTR: vds348.com

oresgateptssite.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	oresgateptssite.online oresgateptssite.online	828 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 223	11 KB
1	bit.ly 1 redirects bit.ly — Cisco Umbrella Rank: 6111	285 B
13	3

	Domain	Requested by
12	oresgateptssite.online	oresgateptssite.online
1	cdnjs.cloudflare.com	oresgateptssite.online
1	bit.ly	1 redirects
13	3

This site contains no links.

Subject Issuer	Validity	Valid
oresgateptssite.online R3	`2023-11-01` - `2024-01-30`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://oresgateptssite.online/
Frame ID: E0A6FA4B032A4F5FC526ABF225B5D4B3
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Page URL History Show full URLs

https://bit.ly/resgat HTTP 301
https://oresgateptssite.online/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

839 kB
Transfer

883 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/resgat HTTP 301
https://oresgateptssite.online/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
oresgateptssite.online/
Redirect Chain

https://bit.ly/resgat
https://oresgateptssite.online/

20 KB
20 KB

848ms
657ms

Document
text/html

62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: 5496e2006d7e4ffc87328b01a31ff16f5e0c23eefb4f2e6e6cea157d4521a71f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 16 Nov 2023 10:24:26 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=90
content-length: 118
content-security-policy: referrer always;
content-type: text/html; charset=utf-8
date: Thu, 16 Nov 2023 10:24:26 GMT
location: https://oresgateptssite.online/
referrer-policy: unsafe-url
server: nginx
via: 1.1 google

GET
H/1.1 200
OK bootstrap.css
oresgateptssite.online/_assets/css/ 199 KB
200 KB 176ms
95ms Stylesheet
text/css 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://oresgateptssite.online/_assets/css/bootstrap.css
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: 91904cf612623e074def91db221401d1fadeebf3bb29d567552b42011fef1f4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Mon, 13 Mar 2023 21:37:57 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 204186

GET
H/1.1 200
OK page-loader.css
oresgateptssite.online/_assets/css/ 4 KB
4 KB 231ms
77ms Stylesheet
text/css 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://oresgateptssite.online/_assets/css/page-loader.css
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: f896985c2af046737c71d0cb210570e79ac401f4f6538f112dbdcb13613593ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Thu, 25 May 2023 15:56:45 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4188

GET
H/1.1 200
OK style.css
oresgateptssite.online/_assets/css/ 16 KB
16 KB 244ms
81ms Stylesheet
text/css 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://oresgateptssite.online/_assets/css/style.css
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: 849f63154804042db332e3bcc62afd541698de471aec30cb9869920cb7583a38

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Thu, 25 May 2023 18:45:35 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 16430

GET
H/1.1 200
OK popper.min.js Show response
oresgateptssite.online/_assets/js/ 18 KB
18 KB 245ms
80ms Script
application/javascript 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://oresgateptssite.online/_assets/js/popper.min.js
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: 484bacf1d10dc84ba6059651457e67c347e249abb5d009e6327f8f71afec4a90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Mon, 13 Mar 2023 21:39:49 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 18457

GET
H/1.1 200
OK jquery-3.6.0.js Show response
oresgateptssite.online/_assets/js/ 292 KB
293 KB 259ms
85ms Script
application/javascript 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://oresgateptssite.online/_assets/js/jquery-3.6.0.js
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: 6fbb86a67c5f7e8883b26f1215cd331bbf9ebeff732bdfd82d952d9a66f78991

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Mon, 13 Mar 2023 21:39:39 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 299459

GET
H/1.1 200
OK bootstrap.js Show response
oresgateptssite.online/_assets/js/ 145 KB
146 KB 259ms
83ms Script
application/javascript 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://oresgateptssite.online/_assets/js/bootstrap.js
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: 9cc84a2d89d16cf3cc74c2d0f13f7069a0c04ece75420e666c627aa9b8cb56a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Mon, 13 Mar 2023 21:39:20 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 148821

GET
H/1.1 200
OK jquery.mask.js Show response
oresgateptssite.online/_assets/js/ 23 KB
23 KB 307ms
76ms Script
application/javascript 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://oresgateptssite.online/_assets/js/jquery.mask.js
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Mon, 13 Mar 2023 21:39:46 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 23176

GET
H/1.1 200
OK control-painel.js Show response
oresgateptssite.online/_assets/js/ 41 KB
42 KB 387ms
81ms Script
application/javascript 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://oresgateptssite.online/_assets/js/control-painel.js?data=60fc312c43ac50eeff2703a6039d75c8
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: a441740c5128c46ea2428a8ffa385d80ccae577679b4a3bb09839e3810e749e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Sat, 27 May 2023 16:53:50 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 42413

GET
H/1.1 200
OK logo-bb.jpg
oresgateptssite.online/_assets/images/ 2 KB
2 KB 80ms
80ms Image
image/jpeg 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oresgateptssite.online/_assets/images/logo-bb.jpg
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: fc1c5d8c9aa750b035f80171038766b502616cd3f1b52abbff668a712c485274

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Mon, 13 Mar 2023 21:38:51 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 2101

GET
H/1.1 200
OK telefone.jpeg
oresgateptssite.online/_assets/images/ 3 KB
3 KB 81ms
81ms Image
image/jpeg 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oresgateptssite.online/_assets/images/telefone.jpeg
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: a276d28d2a6fd91dc1d57ce529320f25c09e61cf7394175150c3c79a945907f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Mon, 13 Mar 2023 21:38:54 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 3274

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.2/css/ 58 KB
11 KB 145ms
47ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.2/css/all.min.css

Requested by

Host: oresgateptssite.online
URL: https://oresgateptssite.online/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1fb8d8337cd22568295b0ed998c85c58f0b4cd083af0b0db21cb0af80002f2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 10:24:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 744155
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10472
last-modified: Wed, 13 Jan 2021 22:29:05 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fff7431-e7d0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yBI5hhCkE6aB6nX0h1eDTYR5GPxmDUsPvbG5C1OfXFehl2JqiqdBxpLQXZCAL7%2FdN85TC1ShiC2SHHWluqYBfCjF15wv5RNvRr1dpCqcssa83vaxygax%2BJBwhXFr4%2BuQMdZa1NZfDy45gJsI8mRTdezp"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 826f063e3c801953-FRA
expires: Tue, 05 Nov 2024 10:24:27 GMT

GET
H/1.1 200
OK livelo-novo.png
oresgateptssite.online/_assets/images/ 60 KB
60 KB 80ms
79ms Image
image/png 62.3.58.85
TIMEHOST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oresgateptssite.online/_assets/images/livelo-novo.png
Requested by: Host: oresgateptssite.online
URL: https://oresgateptssite.online/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.3.58.85 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS: vds348.com
Software: Apache /
Resource Hash: e4bd933f9c8fc5d70501767eb66fba219a103513e3b0be2d5752bebbc9644bb2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oresgateptssite.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 10:24:27 GMT
Last-Modified: Mon, 13 Mar 2023 21:38:49 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 61684

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco do Brasil (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bit.ly/	1970-01-20 20:34:42	Name: _bit Value: nagaoq-3103360a170d9061f8-00k

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
cdnjs.cloudflare.com
oresgateptssite.online
2606:4700::6811:190e
62.3.58.85
67.199.248.10
484bacf1d10dc84ba6059651457e67c347e249abb5d009e6327f8f71afec4a90
5496e2006d7e4ffc87328b01a31ff16f5e0c23eefb4f2e6e6cea157d4521a71f
6fbb86a67c5f7e8883b26f1215cd331bbf9ebeff732bdfd82d952d9a66f78991
849f63154804042db332e3bcc62afd541698de471aec30cb9869920cb7583a38
91904cf612623e074def91db221401d1fadeebf3bb29d567552b42011fef1f4d
9cc84a2d89d16cf3cc74c2d0f13f7069a0c04ece75420e666c627aa9b8cb56a5
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
a276d28d2a6fd91dc1d57ce529320f25c09e61cf7394175150c3c79a945907f4
a441740c5128c46ea2428a8ffa385d80ccae577679b4a3bb09839e3810e749e9
d1fb8d8337cd22568295b0ed998c85c58f0b4cd083af0b0db21cb0af80002f2d
e4bd933f9c8fc5d70501767eb66fba219a103513e3b0be2d5752bebbc9644bb2
f896985c2af046737c71d0cb210570e79ac401f4f6538f112dbdcb13613593ee
fc1c5d8c9aa750b035f80171038766b502616cd3f1b52abbff668a712c485274

oresgateptssite.online Open in urlscan Pro 62.3.58.85 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

839 kBTransfer

883 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

oresgateptssite.online Open in urlscan Pro
62.3.58.85 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

839 kB
Transfer

883 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!