attcadbolsa.com Open in urlscan Pro
172.67.214.29 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://acesso-social-live.com/
Effective URL:
https://attcadbolsa.com/auth?flow=inputUsername
Submission Tags: suspect
Submission: On May 27 via api (May 27th 2024, 4:43:37 pm UTC) from BR — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 15 HTTP transactions. The main IP is 172.67.214.29, located in United States and belongs to CLOUDFLARENET, US. The main domain is attcadbolsa.com.
TLS certificate: Issued by GTS CA 1P5 on April 17th 2024. Valid for: 3 months.

This is the only time attcadbolsa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Caixa (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	3.33.152.147 3.33.152.147	16509 (AMAZON-02) (AMAZON-02)
1 1	2606:4700:303... 2606:4700:3032::6815:25e1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	172.67.214.29 172.67.214.29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.245.31.89 18.245.31.89	16509 (AMAZON-02) (AMAZON-02)
15	2

1 3.33.152.147 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a4ec4c6ea1c92e2e6.awsglobalaccelerator.com

acesso-social-live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3032::6815:25e1 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

attcadbolsa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 172.67.214.29 (United States)

ASN13335 (CLOUDFLARENET, US)

attcadbolsa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.31.89 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-31-89.fra56.r.cloudfront.net

cdn.socket.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	attcadbolsa.com 1 redirects attcadbolsa.com	102 KB
1	socket.io cdn.socket.io — Cisco Umbrella Rank: 36572	15 KB
1	acesso-social-live.com 1 redirects acesso-social-live.com	316 B
15	3

	Domain	Requested by
15	attcadbolsa.com	1 redirects attcadbolsa.com
1	cdn.socket.io	attcadbolsa.com
1	acesso-social-live.com	1 redirects
15	3

This site contains no links.

Subject Issuer	Validity	Valid
attcadbolsa.com GTS CA 1P5	`2024-04-17` - `2024-07-16`	3 months	crt.sh
cdn.socket.io Amazon RSA 2048 M03	`2023-10-22` - `2024-11-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://attcadbolsa.com/auth?flow=inputUsername
Frame ID: 2FF066534C8FF74995C3B067125CF4E7
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

CAIXA

Page URL History Show full URLs

http://acesso-social-live.com/ HTTP 307
https://acesso-social-live.com/ HTTP 307
http://acesso-social-live.com/ HTTP 301
http://attcadbolsa.com/ HTTP 307
https://attcadbolsa.com/ HTTP 302
https://attcadbolsa.com/auth?flow=inputUsername Page URL

Detected technologies

Socket.io (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

socket\.io.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

116 kB
Transfer

266 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://acesso-social-live.com/ HTTP 307
https://acesso-social-live.com/ HTTP 307
http://acesso-social-live.com/ HTTP 301
http://attcadbolsa.com/ HTTP 307
https://attcadbolsa.com/ HTTP 302
https://attcadbolsa.com/auth?flow=inputUsername Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request auth Show response
attcadbolsa.com/
Redirect Chain

http://acesso-social-live.com/
https://acesso-social-live.com/
http://acesso-social-live.com/
http://attcadbolsa.com/
https://attcadbolsa.com/
https://attcadbolsa.com/auth?flow=inputUsername

5 KB
2 KB

665ms
664ms

Document
text/html

172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 64f47dac58ac1396c702a238a73e3bce43d340c508305dbde78dfdc7ae9bd07f

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
referer: https://www.google.com

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 88a776de9f46bbc2-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 27 May 2024 16:43:31 GMT
last-modified: Mon, 25 Mar 2024 17:27:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=71gtnogran%2FHXmNTk3anQHRE0jIzb3BrfTeLqzPf98qgqtTowQK6dS8RjnEJSAHPot0J0CoPGSNx%2F029ut1%2BLBYjugvGB7saxqWYlWwQQb1xK0VSkB1gMZ1j6IufR%2FUR7J0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 88a776da6a9739c8-FRA
content-type: text/html; charset=utf-8
date: Mon, 27 May 2024 16:43:30 GMT
location: /auth?flow=inputUsername
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zpMCYCQSIzGZg%2FLur3x97KU0JATVYPZkHXlCswYv%2Fp%2FepK6yGn6D0hXxVOrElF6KxAjbM4II9uq9%2BQ8t6EtzmwMV7jYLkpRjWNjQyi9mv51SCeV5INfI0wwEM6RLRKCZOIVdQU2eGeB0%2FgogPhU%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept
x-powered-by: Express

GET
H2 200 socket.io.min.js Show response
cdn.socket.io/4.7.2/ 49 KB
15 KB 169ms
46ms Script
application/javascript 18.245.31.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.socket.io/4.7.2/socket.io.min.js

Requested by

Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.31.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-31-89.fra56.r.cloudfront.net

Software

Vercel /

Resource Hash

83df4abc7eec941f1d29ae254e80bac0bb82d398fbe2e8ee4ea2a7efc8e704f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 08 Jan 2024 22:46:20 GMT
content-encoding: gzip
via: 1.1 83f37b03194be210134265ef78592588.cloudfront.net (CloudFront)
strict-transport-security: max-age=63072000
x-amz-cf-pop: FRA56-P8
age: 12130321
x-cache: Hit from cloudfront
content-disposition: inline; filename="socket.io.min.js"
server: Vercel
x-vercel-id: fra1::vnf4r-1704753980261-d8f784e7e651
etag: W/"4e14b9a049f4bc16901e8e5ff726a16f"
x-vercel-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
x-amz-cf-id: Jl8HCrJgcXvZcoujmnd3imMdHTSStUuiBbDhxBREX1IvETH1XzT4XA==

GET
H3 200 sessionHelpers.js Show response
attcadbolsa.com/js/ 8 KB
3 KB 678ms
674ms Script
application/javascript 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/js/sessionHelpers.js
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0bc0e8914dd49c2616964a3f5425bd462131e8b59333bcb87adbae4f8d0b97ad

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 23 Apr 2024 15:20:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"201d-18f0b8b0bc8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ja%2Bi4aLPPXsi4uJM7zpcgF8Z6MzRupzJ3V5%2BnV87uOwG4yMH3k3sqhKlZdwUZOnpnYm03s3hAMv1WDcWNHsEqqVUqmOQgJHBCUo8yX46PoboZCuzkSYtlEF%2B6i3WqpOPA0A%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 88a776e2dd0bbbc2-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.css
attcadbolsa.com/css/ 25 KB
5 KB 987ms
983ms Stylesheet
text/css 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/css/main.css?v=3
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 3fd4831c4c7cdc3d26a978b40241a16a7795c65d9f0f9c0b887602b719007a4a

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 04 Feb 2024 12:27:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"621f-18d74167b98"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pi3THxLqtcLez3MFUnT%2B60HVNeWKjJbRFhGLmT5hG3uJ3QbB6jKpp1YUutYfIJUqhI968neFdeok2r6QfFi2NsdN76XMlznXBKX%2F9y%2FeeF6E2ezV%2BxWvheU6oU3meFSQQ7A%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 88a776e2dd0cbbc2-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 fsso.css
attcadbolsa.com/css/ 1 KB
916 B 668ms
664ms Stylesheet
text/css 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/css/fsso.css
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 736161c02d6980a800ee35c57b869cbd6f352c411203b89e794b53edc56cdf5e

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 02 Feb 2024 10:59:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"4fa-18d697907a0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KZCQWGzcQKV2fImeRfaHTsjTVnogV8iS68SlAIL78punVG6juKvTkUB7rzEIq79eCxSk4egZFN2LVtDjP%2Fe4UU%2Fxd3vptr4NHqJVstfIGwzfHBXQ4Nsy6gFWTO%2B1qE6vgko%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 88a776e2dd0dbbc2-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery.js Show response
attcadbolsa.com/js/ 85 KB
31 KB 1200ms
1196ms Script
application/javascript 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/js/jquery.js
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 99e691fae5e88eb36bafb24758b35f0f990708295f8f2abe2221891e328f776a

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 02 Feb 2024 10:35:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"155ed-18d69636878"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NyrTm2%2BuBCD2ujNjFwhCOD6Y1YJboAoo%2FI%2FfDcCfJIhGkCC3ixxmffWSo5FDiX0WH5N7x5wbbUSJ4X9xqXCKsp7x3dzRXmqyR%2F2c3B1g4np8BFXpJIVDu4kWQxoInmRe02w%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 88a776e2dd0ebbc2-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 imask.min.js Show response
attcadbolsa.com/js/ 44 KB
13 KB 1157ms
1154ms Script
application/javascript 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/js/imask.min.js
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 63c6bca75c5ba6da5336acef9f07f249f52b6ef6343f5d1ec46916139b30ee16

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 02 Feb 2024 10:36:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"b1f1-18d6963d1f0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fXELET66BQpZrL56y4TJKFQtVZ%2F%2FNyDr3iGCkIYPyBGNrGmSb5TJhV6%2Fjd50SzzxsSb3EOlleZdtDsFfXEl5CKFKWvPHIpQW3XJBCwgohvofi4KTF%2BhbjWx6VTrKZzaiMlY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 88a776e2dd10bbc2-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 validate.js Show response
attcadbolsa.com/js/ 4 KB
2 KB 687ms
684ms Script
application/javascript 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/js/validate.js
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: eb545b8ac4e9673641214567329f2d88a8546e1a7a10e0be37ce709fd94f0fb4

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 05 Feb 2024 06:54:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"116b-18d780c1be0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jyCvaacrfCiFYgJKe9E8IQ%2BqGvPMJZ2wCiSd0Sc5y4lbrXTQb7k2UyUJZbTek%2Fka8bv8qSl92ghPyNrtqrTj%2Bg1GhySYRzTnMs7dEt%2BbqHl%2FKYdS7rF74xGC4lWe27kVHs0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 88a776e2dd11bbc2-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 logo-caixa.png
attcadbolsa.com/images/ 4 KB
5 KB 673ms
670ms Image
image/png 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attcadbolsa.com/images/logo-caixa.png
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a10b2226b24cb524fc090fc6b617601ddfa9c6bfc32b95c415b8057f0b32b340

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:32 GMT
cf-cache-status: MISS
last-modified: Fri, 02 Feb 2024 10:39:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"1083-18d6966cba8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=drU%2F%2FOlGzQZK5U4RjLNqq389qF%2F2%2F1S6W8gAEqNFz%2BIPZUNTrHBDnI%2BufqMYla3qcoZJes92oQVtdNp8TkpcKiCqeuNezkucmVe2UfN4z5dDrxmPcq9o767LnDFBA6aTWQY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 88a776e2dd12bbc2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 4227

GET
H3 200 interrogacao.svg
attcadbolsa.com/images/ 1021 B
996 B 678ms
675ms Image
image/svg+xml 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attcadbolsa.com/images/interrogacao.svg
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: eb36e7473ecb490885c097151ae7b39578df4140aaf254db51b4082f83840dc1

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 20 Jan 2024 08:53:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"3fd-18d261342c8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TKVKr7%2B7m%2BSrykcNa9EKjgBuU4dvhrtCicPW43YhFSIP7QamfX6Rp8RaLVN3MWMeyUYGsjm5VlhjVdt5BkuJ0avULUYa0NR0xmUrhbi9GGFOw2IloYMlIa%2FaCzx2wUXL%2Fu4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 88a776e2dd15bbc2-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 caixatem-white.png
attcadbolsa.com/images/ 17 KB
17 KB 969ms
969ms Image
image/png 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attcadbolsa.com/images/caixatem-white.png
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 88fb48c350619c7ede48413118c899900d5801f565f16bf2f78b23c753128c79

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:33 GMT
cf-cache-status: MISS
last-modified: Tue, 02 Jan 2024 20:24:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"43f3-18ccbd8faa0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zp3nVGG7UHPxLdJ5x8PRXLyVEEEyGwPLkgKD4qy%2FVLuvjfE8amtc4zGqkZ4Zy0VaNAfgrfqgcw%2FxMc6syAjBZpTVU8LsB%2FtflilG3Ng%2BQQYzXizT%2FlCEJC%2F6ysrCXP4FHIA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 88a776e71bb7bbc2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 17395

GET
H3 200 helpers.js Show response
attcadbolsa.com/js/ 4 KB
2 KB 672ms
672ms Script
application/javascript 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/js/helpers.js
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/auth?flow=inputUsername
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d0b35815e7476d0367ee28e2cce8f169f70b5a2673c4eb39994644eab5fe5a96

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 26 Mar 2024 00:21:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"106f-18e78220be8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ekdEZdinCTJwoiSfiGS%2B9AAgmzZazR%2BhvO38aGZTDd3Ld28rwRqq2BojZvoxonFg3rFCWpfTC%2BCvwlN768%2BOQinfWcg1YbLv%2BNj5XGEDZPVQ3Dm21bksBDxMxQfw1JnrP9Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 88a776e71bc4bbc2-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 futuraBook.woff
attcadbolsa.com/fonts/ 12 KB
13 KB 674ms
674ms Font
font/woff 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/fonts/futuraBook.woff
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/css/main.css?v=3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: cef588bc026161c06f8f09683b4dbe9478955be7d9704bf81b625725b3d495d5

Request headers

Referer: https://www.google.com
Origin: https://attcadbolsa.com
Accept-Language: de-DE,de;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:33 GMT
cf-cache-status: MISS
last-modified: Fri, 02 Feb 2024 11:00:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"31e0-18d697a1cf8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=00ymd%2BNrNB3PBvj%2Fwb79vcHr8uyPlEbe6e%2BUXPvGVweYmAARWbbQ70oxzAUgznsO%2BSXx7eiP1prhK6H1%2F6SAtX4Rs9Pq1bm81gBvJm%2FLYT0GC3ejiK8bd%2BexS1Tsn8cM%2BUI%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 88a776eb7a6dbbc2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 12768

GET
H3 200 fsso.woff2
attcadbolsa.com/fonts/ 4 KB
4 KB 673ms
673ms Font
font/woff2 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/fonts/fsso.woff2?
Requested by: Host: attcadbolsa.com
URL: https://attcadbolsa.com/css/fsso.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f4d77754b30e09df3ae9f69513eb48fc68e092d2599cc29cd961b8254e311dbb

Request headers

Referer: https://www.google.com
Origin: https://attcadbolsa.com
Accept-Language: de-DE,de;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:33 GMT
cf-cache-status: MISS
last-modified: Fri, 02 Feb 2024 10:57:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"ea0-18d69779870"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Av5Pyl3%2Fo%2FlOKY5v4qgTliMgC0LKKV5cgUZOUT2IMsUBPXdjjKY8Yd1RmHhjLkO6g%2Br%2FiAQoYo9FB3iyij%2FXYU4pJhW84LINvG8xl7%2FSWMrmig6JlBi9GZzODdAnyLq7Z8%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 88a776eb7a70bbc2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 3744

GET
H3 200 favicon.ico
attcadbolsa.com/images/ 1 KB
2 KB 683ms
683ms Other
image/x-icon 172.67.214.29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://attcadbolsa.com/images/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.214.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 311f1ab2729014aa567869f260192aa0de9283534efa405bd36d1b8d8f235270

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.google.com
User-Agent: Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

date: Mon, 27 May 2024 16:43:34 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 02 Jan 2024 20:24:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"4a4-18ccbd8fe88"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XWBoxGU4YLvdNFllKLgq4veaFy8YcBJx8LnMz9dpHezPg0sTfLLyey4sFPKLv0FMFfgFy%2BnOy815n6tHu56mhxgcFQNirvkchO2P5PHL5ue0IJWFrrZG8j2a%2F09dSMZD%2Bns%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/x-icon
cache-control: public, max-age=14400
cf-ray: 88a776efb8c5bbc2-FRA
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Caixa (Government)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			attcadbolsa.com/	1970-01-20 21:03:53	Name: connect.sid Value: s%3Au3j_GeOTQ6h2S_G1tARF4p_ze-bXYvpi.XBk4%2Be7YsBjiPpmEAcerq2iILjIQtGl1rElxgH0vGoI

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acesso-social-live.com
attcadbolsa.com
cdn.socket.io
172.67.214.29
18.245.31.89
2606:4700:3032::6815:25e1
3.33.152.147
0bc0e8914dd49c2616964a3f5425bd462131e8b59333bcb87adbae4f8d0b97ad
311f1ab2729014aa567869f260192aa0de9283534efa405bd36d1b8d8f235270
3fd4831c4c7cdc3d26a978b40241a16a7795c65d9f0f9c0b887602b719007a4a
63c6bca75c5ba6da5336acef9f07f249f52b6ef6343f5d1ec46916139b30ee16
64f47dac58ac1396c702a238a73e3bce43d340c508305dbde78dfdc7ae9bd07f
736161c02d6980a800ee35c57b869cbd6f352c411203b89e794b53edc56cdf5e
83df4abc7eec941f1d29ae254e80bac0bb82d398fbe2e8ee4ea2a7efc8e704f1
88fb48c350619c7ede48413118c899900d5801f565f16bf2f78b23c753128c79
99e691fae5e88eb36bafb24758b35f0f990708295f8f2abe2221891e328f776a
a10b2226b24cb524fc090fc6b617601ddfa9c6bfc32b95c415b8057f0b32b340
cef588bc026161c06f8f09683b4dbe9478955be7d9704bf81b625725b3d495d5
d0b35815e7476d0367ee28e2cce8f169f70b5a2673c4eb39994644eab5fe5a96
eb36e7473ecb490885c097151ae7b39578df4140aaf254db51b4082f83840dc1
eb545b8ac4e9673641214567329f2d88a8546e1a7a10e0be37ce709fd94f0fb4
f4d77754b30e09df3ae9f69513eb48fc68e092d2599cc29cd961b8254e311dbb

attcadbolsa.com Open in urlscan Pro 172.67.214.29 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

25 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

116 kBTransfer

266 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

1 Cookies

Indicators

attcadbolsa.com Open in urlscan Pro
172.67.214.29 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

116 kB
Transfer

266 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!