login.appdigtalcxa.site
Open in
urlscan Pro
2606:4700:3036::6812:3a2c
Malicious Activity!
Public Scan
Effective URL: https://login.appdigtalcxa.site/senha?senha=error
Submission: On December 21 via manual from BR
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 21st 2020. Valid for: a year.
This is the only time login.appdigtalcxa.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Caixa (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 17 | 2606:4700:303... 2606:4700:3036::6812:3a2c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:808::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a04:4e42:1b:... 2a04:4e42:1b::621 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::200e | 15169 (GOOGLE) (GOOGLE) | |
21 | 5 |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
appdigtalcxa.site
1 redirects
login.appdigtalcxa.site |
141 KB |
2 |
googletagmanager.com
www.googletagmanager.com |
90 KB |
1 |
google-analytics.com
www.google-analytics.com |
167 B |
1 |
jsdelivr.net
cdn.jsdelivr.net |
19 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
21 | 5 |
Domain | Requested by | |
---|---|---|
17 | login.appdigtalcxa.site |
1 redirects
login.appdigtalcxa.site
|
2 | www.googletagmanager.com |
login.appdigtalcxa.site
www.googletagmanager.com |
1 | www.google-analytics.com |
www.googletagmanager.com
|
1 | cdn.jsdelivr.net |
login.appdigtalcxa.site
|
1 | ajax.googleapis.com |
login.appdigtalcxa.site
|
21 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.caixa.gov.br |
internetbanking.caixa.gov.br |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-12-21 - 2021-12-20 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2020-10-26 - 2021-04-17 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://login.appdigtalcxa.site/senha?senha=error
Frame ID: 47C592D8554CB591BBEA9734F3A32DFC
Requests: 21 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://login.appdigtalcxa.site/senha?senha=error
HTTP 301
https://login.appdigtalcxa.site/senha?senha=error Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Caixa Econômica | Internet Banking
Search URL Search Domain Scan URL
Title: Segurança
Search URL Search Domain Scan URL
Title: .
Search URL Search Domain Scan URL
Title: .
Search URL Search Domain Scan URL
Title: .
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://login.appdigtalcxa.site/senha?senha=error
HTTP 301
https://login.appdigtalcxa.site/senha?senha=error Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
senha
login.appdigtalcxa.site/ Redirect Chain
|
31 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
96 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2@10
cdn.jsdelivr.net/npm/ |
71 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.css
login.appdigtalcxa.site/css/ |
134 B 436 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
login.appdigtalcxa.site/css/ |
156 B 470 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
principal.css
login.appdigtalcxa.site/css/ |
352 B 479 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.css
login.appdigtalcxa.site/css/ |
552 B 550 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap_desktop.css
login.appdigtalcxa.site/css/ |
141 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_desktop.css
login.appdigtalcxa.site/css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
login.appdigtalcxa.site/css/ |
67 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
print.css
login.appdigtalcxa.site/css/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
principal_desktop.css
login.appdigtalcxa.site/css/ |
62 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
datalist.css
login.appdigtalcxa.site/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sprites.png
login.appdigtalcxa.site/img/ |
80 KB 80 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icoidentusuario.png
login.appdigtalcxa.site/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
setasteclado.png
login.appdigtalcxa.site/img/ |
651 B 1005 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
keyboardUpFlag.png
login.appdigtalcxa.site/img/ |
509 B 1000 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
keyboardLeftFlag.png
login.appdigtalcxa.site/img/ |
534 B 875 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
js
www.googletagmanager.com/gtag/ |
133 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 167 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Caixa (Government)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| gtag object| dataLayer function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal object| google_tag_manager object| google_tag_data object| gaGlobal function| onYouTubeIframeAPIReady2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
login.appdigtalcxa.site/ | Name: PHPSESSID Value: 05mm65dj7j5qjb8sdbishvj9j3 |
|
.appdigtalcxa.site/ | Name: __cfduid Value: d202adf2e481431eb8c71e41293f879651608580278 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.jsdelivr.net
login.appdigtalcxa.site
www.google-analytics.com
www.googletagmanager.com
2606:4700:3036::6812:3a2c
2a00:1450:4001:808::2008
2a00:1450:4001:808::200a
2a00:1450:4001:809::200e
2a04:4e42:1b::621
169c138e458f8f5f1448b3384cdcbef360d4b1768ef2e903e656117fcc11a00d
23e15be484d2d41161cf0d54c2878212e03eefb57ee8ded99e5798fa2834d2f0
2da31905269f3c66b37ccd91316029f98579464921cd8eba8417c45aa9e75f02
3c9f66858390c6ead05796c65d551aff2c264b88eda081eae4f7a5273480ceab
3d7b2b4e76908627d3fef7e2f06189c7b79601566578903539d64ceb1025b574
420f0bebeae20143724fe7a9295a1877b7e8d1cfa12e837b046822d7dc20a8f8
49003f039c1ddba7ee993abe9e77ea44540cd43b53bf9d03df9a00bcf9fb4abf
5e6ec809f8ddba569f57c1193209c72acb155a5ff9dd7626e50bc45c8aaf8829
62802f8c7b934cc18327e0d2f4b7d84411f5d3a8eff81ec81e19c0988af550c9
89e0cbc3d878080eef2313ca1459dcf9f741ffd1ff2c4a285fe9a2ff9b7e79c5
8f587cb8a75399b59f0613d30c9177e087672839d6e4b1b98383f14b6b3ce204
97345e23289f65783ef335e091d1471dcafb2bd3b91ebaa4bf2b463904743958
9c1cdd5c5cbf33b4c09b091b6a01980bc4d700ce7e43ed1992bb6534bb74c07d
a4846d0e700ef323df48199c6002649bcca72a55f02a4b983a2f307a600a7c86
b07f3473f3a889798a93b7b02c3b9399d4814e82765b988aa54edb93f4d5f2c5
bd3f0a55ed9a38ab3288129d8915fce8332c05026716fc37778104a7f2918541
c3892915c37eb021a8fe755d9ce38777b98c6c7bd9c1e090f824a485cadfe460
c8e9b11de3b0891b15359b17aeb1179e1bc73c5c10879b731250dcd904a7d52c
d3855e3a866d4aabdccc89a57dd56d5e87ae1eb70c0d6992335300250fd6a745
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d