balcao-novobanco.com
Open in
urlscan Pro
188.114.97.3
Malicious Activity!
Public Scan
Effective URL: https://balcao-novobanco.com/web/PTPW1/tpl.asp?si=
Submission: On May 01 via api from HU — Scanned from PT
Summary
TLS certificate: Issued by GTS CA 1P5 on May 1st 2024. Valid for: 3 months.
This is the only time balcao-novobanco.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Novobanco (Banking)Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 194.145.121.100 194.145.121.100 | 9118 (Novo Banco) (Novo Banco) | |
1 | 151.101.194.137 151.101.194.137 | 54113 (FASTLY) (FASTLY) | |
12 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
novobanco.pt
sec.novobanco.pt — Cisco Umbrella Rank: 377277 |
34 KB |
2 |
balcao-novobanco.com
1 redirects
balcao-novobanco.com |
4 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 767 |
30 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
7 | sec.novobanco.pt |
balcao-novobanco.com
sec.novobanco.pt |
2 | balcao-novobanco.com | 1 redirects |
1 | code.jquery.com |
balcao-novobanco.com
|
12 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
balcao-novobanco.com GTS CA 1P5 |
2024-05-01 - 2024-07-30 |
3 months | crt.sh |
sec.novobanco.pt DigiCert SHA2 Extended Validation Server CA |
2023-12-15 - 2024-12-17 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://balcao-novobanco.com/web/PTPW1/tpl.asp?si=
Frame ID: 959C2DE4A6E288561554AB75BBFE7656
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
novobancoPage URL History Show full URLs
-
http://balcao-novobanco.com/
HTTP 307
https://balcao-novobanco.com/ HTTP 302
https://balcao-novobanco.com/web/PTPW1/tpl.asp?si= Page URL
Detected technologies
Microsoft ASP.NET (Web Frameworks) ExpandDetected patterns
- \.aspx?(?:$|\?)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://balcao-novobanco.com/
HTTP 307
https://balcao-novobanco.com/ HTTP 302
https://balcao-novobanco.com/web/PTPW1/tpl.asp?si= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
tpl.asp
balcao-novobanco.com/web/PTPW1/ Redirect Chain
|
14 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tpl.css
sec.novobanco.pt/web/PTPW1/css/ |
34 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
controlos.css
sec.novobanco.pt/web/PTPW1/css/ |
21 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nav.css
sec.novobanco.pt/web/PTPW1/css/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
sec.novobanco.pt/web/PTPW1/css/ |
6 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.7.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
sec.novobanco.pt/web/PTPW1/Resources/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
NovobancoText-Bold.woff
sec.novobanco.pt/web/PTPW1/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons.png
sec.novobanco.pt/web/Resources/Login/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_arrow_left.png
sec.novobanco.pt/web/Resources/Login/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
NovobancoText-Book.woff
sec.novobanco.pt/web/PTPW1/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
NovobancoText-Light.woff
sec.novobanco.pt/web/PTPW1/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- sec.novobanco.pt
- URL
- https://sec.novobanco.pt/web/PTPW1/css/fonts/NovobancoText-Bold.woff
- Domain
- sec.novobanco.pt
- URL
- https://sec.novobanco.pt/web/PTPW1/css/fonts/NovobancoText-Book.woff
- Domain
- sec.novobanco.pt
- URL
- https://sec.novobanco.pt/web/PTPW1/css/fonts/NovobancoText-Light.woff
Verdicts & Comments Add Verdict or Comment
Malicious
page.domain
Submitted on
May 1st 2024, 9:44:50 pm
UTC —
From Portugal
Threats:
Phishing
Brands:
Novobanco
PT
Comment: Fake malicious domain, targets customers of Portuguese bank. Phish kit is visible when a Portuguese IP is used.
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Novobanco (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| metaTag object| headTag object| metaTag2 function| $ function| jQuery function| getUrlVars function| limpar string| pincode number| counter function| numBtn0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
balcao-novobanco.com
code.jquery.com
sec.novobanco.pt
sec.novobanco.pt
151.101.194.137
188.114.97.3
194.145.121.100
0c78febab0fc0ac581d556e2a98147696fc25e972ea52d8b0d75c2022213eadb
68e01d41f1a2d065c4b6faadd26095b0c7e045b81eeaca1b55ddf9281bbe84b0
79bb75afcbd7f186066db99e15b97624bebc8287bd36ffb3fa69cdbf23d09546
8113aebffe146bdd2e25e13c558d7806dc406a1c0bd8ab3bb8571fcc713674f4
a5fa5909d58e0977d63a521cf8c3d348e6ea6c8c0e405b8248f7d49f5a73e8c6
a9ca39976d34bdf231cc9be2e890f01a9f63fc6b59a25fb2a985e59526cad470
b4597411ffacb57b34f0701ee0363eba9d1af6c7f0f3950890d33b0810151b29
f6d749427c0c3ecda7b0032ae29ab6d7c128b06b5afdff4659cded135bbcd5a7
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a