www.auth-ib-vlacredapp.live Open in urlscan Pro
2606:4700:3034::6815:31d8 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.auth-ib-vlacredapp.live/
Submission: On January 18 via manual (January 18th 2023, 4:54:08 pm UTC) from BR — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 15 HTTP transactions. The main IP is 2606:4700:3034::6815:31d8, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.auth-ib-vlacredapp.live.
TLS certificate: Issued by GTS CA 1P5 on January 10th 2023. Valid for: 3 months.

This is the only time www.auth-ib-vlacredapp.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sistema de Cooperativas de Crédito – Ailos (Financial)

Domain & IP information

	IP Address		AS Autonomous System
11	2606:4700:303... 2606:4700:3034::6815:31d8		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:400d:806::200a		15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2003		15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:5514		13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	5

11 2606:4700:3034::6815:31d8 (United States)

ASN13335 (CLOUDFLARENET, US)

www.auth-ib-vlacredapp.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:806::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	auth-ib-vlacredapp.live www.auth-ib-vlacredapp.live	649 KB
2	gstatic.com fonts.gstatic.com	91 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 357	19 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	2 KB
15	4

	Domain	Requested by
11	www.auth-ib-vlacredapp.live	www.auth-ib-vlacredapp.live
2	fonts.gstatic.com	fonts.googleapis.com
1	cdn.jsdelivr.net	www.auth-ib-vlacredapp.live
1	fonts.googleapis.com	www.auth-ib-vlacredapp.live
15	4

This site contains no links.

Subject Issuer	Validity	Valid
*.auth-ib-vlacredapp.live GTS CA 1P5	`2023-01-10` - `2023-04-10`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-12-12` - `2023-03-06`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.auth-ib-vlacredapp.live/
Frame ID: BBFA43E89764BF2F8A7D0744068C10F1
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

VIACREDI | Conta Online

Detected technologies

Firebase (Databases) Expand

Overall confidence: 100%
Detected patterns

/firebasejs/([\d.]+)/firebase

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

SweetAlert2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/npm/sweetalert2@([\d.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

15
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

890 kB
Transfer

2143 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.auth-ib-vlacredapp.live/ 1 MB
464 KB 772ms
727ms Document
text/html 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: ccb8346293571737d185616b0d949d7271532398169232138696810f96a7e56a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 78b8d9a13dc69201-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 18 Jan 2023 16:54:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FiLBm033fmRk9FSXjCPNbwyqNtClfm4Py21FWOeFtxd1oeaMOfuFqxyWZC36CxJ%2FMZJF%2BRHJpwrkK3zTMtB83skYTBKz8O2SH1BRv2LlAGgqChvKvPHojImDFo7Fl1WHajEBVbHCxG5eSaRHrO3ATP0H2FNBM3uVG5E%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33

GET
H2 200 css2
fonts.googleapis.com/ 33 KB
2 KB 202ms
71ms Stylesheet
text/css 2a00:1450:400d:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap

Requested by

Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

66988964c9a8d6e5e907e3311e688958d3445e2f8496a56c5a7806e333cf237d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 18 Jan 2023 16:54:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 18 Jan 2023 15:30:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 18 Jan 2023 16:54:02 GMT

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 667a7904015e8a7f8efad8c0af3106d275a261adde9de7e801416ecc2fc5a41f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edbd02f128e1b69fc350b2d2ff357992c3e00bf1fef2b3ae973318de36741cde

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 117 KB
117 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e9522727eadd961fb2b15008598abb99dd9216c38d1700eb37ebfc26b393d56e

Request headers

Referer
Origin: https://www.auth-ib-vlacredapp.live
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 117ms
36ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.auth-ib-vlacredapp.live
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 22:49:22 GMT
x-content-type-options: nosniff
age: 65081
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Jan 2024 22:49:22 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v34/ 47 KB
47 KB 162ms
86ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.auth-ib-vlacredapp.live
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 15 Jan 2023 05:12:34 GMT
x-content-type-options: nosniff
age: 301289
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47952
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:22:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 Jan 2024 05:12:34 GMT

GET
H2 200 jquery.min.js Show response
www.auth-ib-vlacredapp.live/ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
32 KB 818ms
817ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"15d9d-5bd2f79da1040"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GuTK2NmdG6abvIEDgZqi2JWtMpYQj7aq3P%2B3Evanwua4CYyKTkujr7DxpyahcbiqPvVCgaw%2FsG7udrN7FA1N7xbGRecI6DfezJUAAaGbAmLPvEaQXF96Owyy%2BQLzPKYvY0TWKFoPt1BumfSfcECxatvgINAHejIWdmE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78b8d9adaa329201-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery.cookie.min.js Show response
www.auth-ib-vlacredapp.live/cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/ 1 KB
1013 B 418ms
416ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 04 May 2020 16:11:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"514-5a4d4c98c7240"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qGWLPtnpJIpNDyED9cIJbh3vpCTTRTPrIOuvkpYa0TRhui%2FuiVI6GHOoJGRknJtLnf%2FhEFlxvtqhLOhwO9boxhE43EQOrqR5qcIMYSTRfMloJeWyz4%2F2Ciixd%2BxnXdwmyvLdftn1IAX1RJTGMMlNkgwYPUjByQT56Co%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78b8d9adba479201-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 pusher.min.js Show response
www.auth-ib-vlacredapp.live/js.pusher.com/7.0.3/ 64 KB
18 KB 826ms
824ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/js.pusher.com/7.0.3/pusher.min.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db894e1e33530a0d48f7f2b94a5190994457c3037e2e2218fe8869a568d65d36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Jan 2021 13:57:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"10195-5b9b9ebff03c0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TkKqM2lA1RKTfBOtGt0bzgEqBsTqNT0Yp81Uf%2FsuQamiJnAjFc1zd43XnIZ8BtA1TIPc%2BamQl8q%2FXm6GC1DLwXDjGATTSLNCDP8HS5PuMzpznA0u7kz5btfB2hxZ5HuRfAB9wI2Mkl96dWaiQF7THHy6r4kXlGPk8p4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78b8d9adba4a9201-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 functions.js Show response
www.auth-ib-vlacredapp.live/ib/js/ 86 B
414 B 420ms
418ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/ib/js/functions.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb3c98907281b4c26c890bde49852b19c4bd9628ef10889e77f572c3dc1e8a4a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 04 Jun 2022 18:59:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"56-5e0a3d75937cc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b4cDPp%2F4BYAfvJSEO2mfQieA42RMbKnDknEqWgahgQGYMI0gTJNxf7KHj9FbQm8o7CepSt58a%2BKFPtwxUO1ntDVlyd9CRN61k9yyw%2FrxpO0fKsxlreznW%2B6vvk0xJvhj%2F1KgQHqYLUnUUblH9BgU16wQQs05Gp20Fak%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78b8d9adba4b9201-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery.mask.min.js Show response
www.auth-ib-vlacredapp.live/cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.11.2/ 6 KB
3 KB 405ms
403ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.11.2/jquery.mask.min.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a17f2e9528214109ad7194958c1c3ba5367166dc7163f630d5c02c04a7623ef6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 04 May 2020 16:11:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"16bb-5a4d4c9aaf6c0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5ZPXZfyKqJG%2FIIiqqqDkQUu%2FhjHDPEDCyx1%2BQIDOZe12lzdxS2HUDrXynJvcxka2vA4TpDgqxaNF0Wu4ctOkwTfxWeBcGEVamDgyp670x%2F7NK18rpP9MD6vifmtKoFfZdLiaP3a11KxTZKgDvIiwm7urnWxy%2B4FRzoE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78b8d9adba4e9201-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 main.js Show response
www.auth-ib-vlacredapp.live/ib/js/ 3 KB
1 KB 1006ms
1004ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/ib/js/main.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1cabcb9fc86a0c99a85c542c616b8e03955997bb59aa3c2364d398e9a39df55d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:04 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 04 Jun 2022 23:21:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"aea-5e0a77e05c130"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9TpKs93FK3hi76jurzFWo1APgI8%2BnHPqiZkhEdvQC45nMEiSQKYpvBvidxhdrFX3MfzZ5Em87XKNji0jb89BFyAsXRTq0pFvg0DaQ2HbGadzZ4OUoIrZIGEA5e6KwSRh7c7NUAkkaG0ZT5gnI0O9uyw5TBj5x%2FeFn5o%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78b8d9adba539201-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 sweetalert2@11 Show response
cdn.jsdelivr.net/npm/ 63 KB
19 KB 61ms
27ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/sweetalert2@11

Requested by

Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc0ed06b27904f269631d72e5a29843334c86ae216b1c9e1abf03719f282c620

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 12406
x-jsd-version: 11.7.0
content-encoding: br
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230057-FRA, cache-yyz4577-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"fb64-34eqtuU2wFHLf+AFCtoJcVba3Uo"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8hgr2Hca%2BC91pE2N1rXfY7yVTjQ7BP4fVoBVryu%2F4YuuAmzjzTNH%2FVLBDlbnDLCAlzjnk0ipZ0rSWGjyIWnIdZLt7hZZUrk7P9LqNyQNGIzXjjuYkv9CnQU1m0LdQg2X7urCphjoGMfLu2tZ0HU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 78b8d9aded8c9a2d-FRA

GET
H2 200 firebase-app.js Show response
www.auth-ib-vlacredapp.live/www.gstatic.com/firebasejs/8.10.0/ 22 KB
7 KB 618ms
616ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/www.gstatic.com/firebasejs/8.10.0/firebase-app.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a78d872dee0b66e1fd7cfdab14645678b8f9596cf42b212029825029acda4dfc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 19 Aug 2021 20:25:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5669-5c9ef5af62200"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z97li3cfIFULIE1JDmRTDIwXS%2FdH0aOyraSM0Wl5prwENcb5icM0oKSd5A%2BvbR%2FnxgbdIuRE54KW7q4OSHwU408UOZ07ypX%2BSDj0SGc0foEwiKi9HTbVbY1n5lggOj7F0eZbmPW4CoWIJxOFWntAgrKawQeA5ogrmwE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78b8d9adba579201-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 firebase-firestore.js Show response
www.auth-ib-vlacredapp.live/www.gstatic.com/firebasejs/8.10.0/ 329 KB
92 KB 1245ms
1244ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/www.gstatic.com/firebasejs/8.10.0/firebase-firestore.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 985c4e83789779028a994e33db07cc9e3e5a1ae783df634a78e9db0b44d81573

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:04 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 19 Aug 2021 20:25:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"52416-5c9ef5af62200"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HgD8W3eGThnmGjl3Vn7yUyy2hUOqCjI0ZmXkh1O%2FpMIgOt8tvrNHp%2ByLZElyACkK29K7PXPSIGYxRzYX%2F5uvxuM5kS%2ByLs4eyuVxERrnbt0OIX97oSDn12V61vNQHypljpT18DW7AOuIMJGSyYrN8zoOZ8TvwikXyAE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78b8d9adba589201-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
DATA 200
OK truncated
/ 13 KB
13 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8701b2ed392e823f8a35712a45a94e733685cf8a5b7afb6906f7cbdddec950a5

Request headers

Referer
Origin: https://www.auth-ib-vlacredapp.live
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H3 200 all.css
www.auth-ib-vlacredapp.live/pro.fontawesome.com/releases/v5.10.0/css/ 154 KB
29 KB 1036ms
1035ms Stylesheet
text/css 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/pro.fontawesome.com/releases/v5.10.0/css/all.css
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 657acd7d31812fbfcfac85fdfb24c488528f7a00e67054a7e3eb56de540fb33e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:05 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 28 Jun 2021 16:54:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"26730-5c5d657e74200"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=20nvfvWNZXm9B%2Bb4U1URL01Ud1Kv7WSL%2Bve7PyKDwxEj3W5cJj9%2FQ4jCPZXCmXMioSHK4bxeFVbXrm2dxtcZ5INE0V3PM5eBouIkjyIspp5DW7m4FBC5KvDi4bmybdcG%2BEmVj3ylS%2B9ufkXftRSUGdvZYY294FD5iPU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78b8d9b5dc829bdc-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 404 start_request_all_index Show response
www.auth-ib-vlacredapp.live/api/ 314 B
727 B 422ms
422ms XHR
text/html 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/api/start_request_all_index
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb6660f124dbb5085e7ad3cc095c3e91199edf25a9090d733a0b4fe36877ac2a

Request headers

Accept: */*
Referer: https://www.auth-ib-vlacredapp.live/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 18 Jan 2023 16:54:04 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6%2F91AZiHs4vDxBTrDSir8wcZbCYZkYwkRmvhWfJjL6gQqrUtYmhKkF1KgjdVvn6IhflrlitNrsT8810ZmcefrnL5NwjmAeEb8%2B0U0MuVwvJ9Ub6pYWN5O7JY6x%2FDUT9spfGe4k7gDbqZ2BfJcFuCkHmRRBC474BN%2Ftc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cf-ray: 78b8d9b5ecb19bdc-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sistema de Cooperativas de Crédito – Ailos (Financial)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery function| Pusher function| validateEmail function| DataPushCommand function| Update function| Update2 function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal object| firebase object| url string| nome function| iniciar_presensa_online object| link function| ManterOnline object| semana object| dataAtual object| aMes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.auth-ib-vlacredapp.live/	1969-12-31 23:59:59	Name: PHPSESSID Value: 47h6skid28d2hcnv63ff9n6di4

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.auth-ib-vlacredapp.live/api/start_request_all_index Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
www.auth-ib-vlacredapp.live
2606:4700:3034::6815:31d8
2606:4700::6810:5514
2a00:1450:4001:812::2003
2a00:1450:400d:806::200a
1cabcb9fc86a0c99a85c542c616b8e03955997bb59aa3c2364d398e9a39df55d
657acd7d31812fbfcfac85fdfb24c488528f7a00e67054a7e3eb56de540fb33e
667a7904015e8a7f8efad8c0af3106d275a261adde9de7e801416ecc2fc5a41f
66988964c9a8d6e5e907e3311e688958d3445e2f8496a56c5a7806e333cf237d
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
8701b2ed392e823f8a35712a45a94e733685cf8a5b7afb6906f7cbdddec950a5
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
985c4e83789779028a994e33db07cc9e3e5a1ae783df634a78e9db0b44d81573
a17f2e9528214109ad7194958c1c3ba5367166dc7163f630d5c02c04a7623ef6
a78d872dee0b66e1fd7cfdab14645678b8f9596cf42b212029825029acda4dfc
cb6660f124dbb5085e7ad3cc095c3e91199edf25a9090d733a0b4fe36877ac2a
ccb8346293571737d185616b0d949d7271532398169232138696810f96a7e56a
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
db894e1e33530a0d48f7f2b94a5190994457c3037e2e2218fe8869a568d65d36
dc0ed06b27904f269631d72e5a29843334c86ae216b1c9e1abf03719f282c620
e9522727eadd961fb2b15008598abb99dd9216c38d1700eb37ebfc26b393d56e
edbd02f128e1b69fc350b2d2ff357992c3e00bf1fef2b3ae973318de36741cde
fb3c98907281b4c26c890bde49852b19c4bd9628ef10889e77f572c3dc1e8a4a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e