urlscan.io logo urlscan.io
SecurityTrails logo

40.117.176.164 Open in urlscan Pro
40.117.176.164  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://40.117.176.164/~~/router_t2.php
Submission: On March 16 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 5 countries across 5 domains to perform 20 HTTP transactions. The main IP is 40.117.176.164, located in Tappahannock, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is 40.117.176.164.
This is the only time 40.117.176.164 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

IP Address AS Autonomous System
1 40.117.176.164 8075 (MICROSOFT...)
1 186.202.9.9 27715 (Locaweb S...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
15 23.67.161.27 16625 (AKAMAI-AS)
1 2404:6800:400... 15169 (GOOGLE)
1 2001:4de0:ac1... 20446 (STACKPATH...)
20 6
1    40.117.176.164 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
40.117.176.164
1    186.202.9.9 (Brazil)

ASN27715 (Locaweb Servicos de Internet SA, BR)
PTR: assets.locaweb.com.br
assets.locaweb.com.br
1    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
netdna.bootstrapcdn.com
15    23.67.161.27 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-67-161-27.deploy.static.akamaitechnologies.com
estatico.itau.com.br
1    2404:6800:4004:825::200e (Australia)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
Apex Domain
Subdomains		 Transfer
15 itau.com.br
estatico.itau.com.br — Cisco Umbrella Rank: 358856
488 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 588
29 KB
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 31
20 KB
1 bootstrapcdn.com
netdna.bootstrapcdn.com — Cisco Umbrella Rank: 2682
8 KB
1 locaweb.com.br
assets.locaweb.com.br
179 KB
20 5
Domain Requested by
15 estatico.itau.com.br 40.117.176.164
estatico.itau.com.br
1 code.jquery.com 40.117.176.164
1 www.google-analytics.com 40.117.176.164
1 netdna.bootstrapcdn.com 40.117.176.164
1 assets.locaweb.com.br 40.117.176.164
20 5

This site contains links to these domains. Also see Links.

Domain
itau.com.br
www.facebook.com
twitter.com
www.youtube.com
Subject Issuer Validity Valid
www.itau.com.br
GeoTrust RSA CA 2018		 2021-05-31 -
2022-06-08		 a year crt.sh

This page contains 1 frames:

Primary Page: http://40.117.176.164/~~/router_t2.php
Frame ID: D4E113DF7CE01DCC5F306AEBF275959F
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

30 Horas

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

75 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

6
IPs

5
Countries

739 kB
Transfer

1683 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js HTTP 307
  • https://netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js
Request Chain 11
  • http://www.google-analytics.com/analytics.js HTTP 307
  • https://www.google-analytics.com/analytics.js

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request router_t2.php
40.117.176.164/~~/ 		15 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Server
40.117.176.164 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 / PHP/7.4.27
Resource Hash
b07dd9c9fc3ca6a9d7cd58fb5b6236a469eab7594f77e12c9d566383e73cbfff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
jp-JP,jp;q=0.9

Response headers

Date
Wed, 16 Mar 2022 00:08:14 GMT
Server
Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27
X-Powered-By
PHP/7.4.27
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
locastyle.js
assets.locaweb.com.br/locastyle/2.0.6/javascripts/ 		179 KB
179 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://assets.locaweb.com.br/locastyle/2.0.6/javascripts/locastyle.js
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Server
186.202.9.9 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS
assets.locaweb.com.br
Software
Locaweb/1.0 /
Resource Hash
43d85469dd056b51984179bd31d2115303f7193fc86740acdb328ccd31ae0b46

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:15 GMT
Last-Modified
Thu, 08 Dec 2016 17:59:19 GMT
Server
Locaweb/1.0
ETag
"58499f77-2ca1d"
Content-Type
application/javascript
Cache-Control
max-age=315360000, private
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
182813
Expires
Thu, 31 Dec 2037 23:55:55 GMT
bootstrap.min.js
netdna.bootstrapcdn.com/bootstrap/3.0.3/js/
Redirect Chain
  • http://netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js
  • https://netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js
27 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
H2
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc1d94f50dd3822e1e53cb96af4f040d2ad8b5c7b984bae5e84efc7641acfada
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 16 Mar 2022 00:08:14 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
617, 617
age
24602775
cdn-cachedat
2021-06-03 23:18:05
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:03:56 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
0741f8190f2e60d3d8e9dda1c2059524
cf-ray
6ec940d50b088a6c-NRT
cdn-requestcountrycode
US
cdn-requestpullsuccess
True

Redirect headers

Location
https://netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
modernizr.js
estatico.itau.com.br/ibanking/commons/js/modernizr/2.8.3/ 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/js/modernizr/2.8.3/modernizr.js
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ab292789c477798ae95e7241f91535b9789122661a094f3c0dcfd3730185c055

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Mar 2021 15:40:48 GMT
ETag
"20803-3b8b-5bd1c5fd3c000"
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=23453
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6539
Expires
Wed, 16 Mar 2022 06:39:07 GMT
normalize.css
estatico.itau.com.br/ibanking/commons/css/ 		8 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/css/normalize.css
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b5da2535938d1f28235c349dfd95e602eab8e837b885c8fc5459818b28897917

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Mar 2021 15:40:03 GMT
ETag
"626e1-1e37-5bd1c5d251ac0"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=75583
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3333
Expires
Wed, 16 Mar 2022 21:07:57 GMT
itau-style.css
estatico.itau.com.br/ibanking/commons/css/ 		408 KB
85 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8c255a7ca29e833f0b857ddb9acf859bbff1d4ef0d4969023bdb1f47519280d9

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Mar 2021 15:40:02 GMT
ETag
"102094-66030-5bd1c5d15d880"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=61521
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86366
Expires
Wed, 16 Mar 2022 17:13:35 GMT
itau-style-pages.css
estatico.itau.com.br/ibanking/commons/css/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/css/itau-style-pages.css
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a23118705846156f54e384df992bf18f94c9b76a27d750173e688ebb73c184f5

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Mar 2021 15:40:02 GMT
ETag
"625bb-b1e-5bd1c5d15d880"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=61488
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1704
Expires
Wed, 16 Mar 2022 17:13:02 GMT
itau-header.css
estatico.itau.com.br/ibanking/commons/css/ 		62 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/css/itau-header.css
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d89ddb5a56ab5cc80d6fba1cac44538df00b02539903462c8526eeaea63bb4e0

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:15 GMT
Content-Encoding
gzip
Last-Modified
Fri, 16 Apr 2021 15:43:51 GMT
ETag
"626f5-f763-5c018d8b45bc0"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=86383
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
11715
Expires
Thu, 17 Mar 2022 00:07:58 GMT
itau-footer.css
estatico.itau.com.br/ibanking/commons/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/css/itau-footer.css
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
93622f43a63e42bf97f01bb7010e660412f54c4d5d3d6f84ce50333beebc8fad

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Mar 2021 15:40:02 GMT
ETag
"626e3-ed8-5bd1c5d15d880"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=63141
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1052
Expires
Wed, 16 Mar 2022 17:40:35 GMT
chosen.css
estatico.itau.com.br/ibanking/commons/css/chosen/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/css/chosen/chosen.css
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
538818d855c973751510b1d7923c1d784c02c83d88924616aa397a9ee96c7a4a

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Mar 2021 15:39:57 GMT
ETag
"625b3-3251-5bd1c5cc98d40"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=23401
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2754
Expires
Wed, 16 Mar 2022 06:38:15 GMT
jquery.min.js
estatico.itau.com.br/ibanking/commons/js/jquery/1.11.1/ 		94 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/js/jquery/1.11.1/jquery.min.js
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Mar 2021 15:40:48 GMT
ETag
"40297-1762a-5bd1c5fd3c000"
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=21141
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
36967
Expires
Wed, 16 Mar 2022 06:00:35 GMT
logo-itau.png
estatico.itau.com.br/ibanking/commons/img/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://estatico.itau.com.br/ibanking/commons/img/logo-itau.png
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0c489fc6a4d1005640a88bfc3f670615236d9a28f2d024a309a5967502be49ac

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:15 GMT
Last-Modified
Tue, 09 Mar 2021 15:40:19 GMT
ETag
"1014ed-19f6-5bd1c5e193ec0"
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=27492
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6646
Expires
Wed, 16 Mar 2022 07:46:27 GMT
analytics.js
www.google-analytics.com/
Redirect Chain
  • http://www.google-analytics.com/analytics.js
  • https://www.google-analytics.com/analytics.js
49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
H2
Server
2404:6800:4004:825::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
1425
date
Tue, 15 Mar 2022 23:44:30 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Wed, 16 Mar 2022 01:44:30 GMT

Redirect headers

Location
https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
jquery-2.0.3.min.js
code.jquery.com/ 		82 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://code.jquery.com/jquery-2.0.3.min.js
Requested by
Host: 40.117.176.164
URL: http://40.117.176.164/~~/router_t2.php
Protocol
HTTP/1.1
Server
2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
b13cb5989e08fcb02314209d101e1102f3d299109bdc253b62aa1da21c9e38ba

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://40.117.176.164/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:15 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 Aug 2021 17:47:53 GMT
Server
nginx
ETag
W/"611feac9-1469c"
Vary
Accept-Encoding
X-HW
1647389295.dop213.pa1.t,1647389295.cds036.pa1.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
29305
bootstrap.min.css
estatico.itau.com.br/ibanking/commons/css/ 		204 KB
28 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/css/bootstrap.min.css
Requested by
Host: estatico.itau.com.br
URL: https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
28de0d68e967be7095076ec76c05d44a3059015e46aef4bcde882488d1441660

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Mar 2021 15:39:57 GMT
ETag
"102275-3306a-5bd1c5cc98d40"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=56602
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
28799
Expires
Wed, 16 Mar 2022 15:51:39 GMT
acessibilidade-novainternet.css
estatico.itau.com.br/ibanking/commons/css/ 		55 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/css/acessibilidade-novainternet.css
Requested by
Host: estatico.itau.com.br
URL: https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
372fa34a79e23974775697d0d2fe45d9c707655a7c307ea7aee7873d353a6cce

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Mar 2021 15:39:57 GMT
ETag
"10231a-ddb9-5bd1c5cc98d40"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=60902
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10679
Expires
Wed, 16 Mar 2022 17:03:19 GMT
angularjs-iwebcomponents-pf.css
estatico.itau.com.br/ibanking/commons/css/ 		318 KB
148 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://estatico.itau.com.br/ibanking/commons/css/angularjs-iwebcomponents-pf.css
Requested by
Host: estatico.itau.com.br
URL: https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4cd957eb53ab34a984ee7487599065d499f75c5e24150ca893e8d377b5080000

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:17 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Jan 2022 13:52:58 GMT
ETag
"1022f1-4f710-5d562e3264280"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=86397
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
151165
Expires
Thu, 17 Mar 2022 00:08:14 GMT
bg-itau.gif
estatico.itau.com.br/ibanking/commons/img/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://estatico.itau.com.br/ibanking/commons/img/bg-itau.gif
Requested by
Host: estatico.itau.com.br
URL: https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4de407fc76d38586d90abfe4dae2528b49066ba4745db0c38fa78c99c939f8e8

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:17 GMT
Last-Modified
Tue, 09 Mar 2021 15:40:07 GMT
ETag
"101290-589e-5bd1c5d6223c0"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=23507
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
22686
Expires
Wed, 16 Mar 2022 06:40:04 GMT
sprite-icon-peq.png
estatico.itau.com.br/ibanking/commons/img/ 		118 KB
118 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://estatico.itau.com.br/ibanking/commons/img/sprite-icon-peq.png
Requested by
Host: estatico.itau.com.br
URL: https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5977c3dbce96535178589debd3760c749cf49a68ee3d20d9b5ff398ae002c78e

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://estatico.itau.com.br/ibanking/commons/css/itau-style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:17 GMT
Last-Modified
Tue, 09 Mar 2021 15:40:20 GMT
ETag
"101eef-1d86a-5bd1c5e288100"
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=23342
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
120938
Expires
Wed, 16 Mar 2022 06:37:19 GMT
sprite-social.png
estatico.itau.com.br/ibanking/commons/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://estatico.itau.com.br/ibanking/commons/img/sprite-social.png
Requested by
Host: estatico.itau.com.br
URL: https://estatico.itau.com.br/ibanking/commons/css/itau-footer.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.161.27 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-161-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7c39a17d06e60246090b71f94008de8ef7bcd2ad59189376f02e3273ae9e9de4

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://estatico.itau.com.br/ibanking/commons/css/itau-footer.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Wed, 16 Mar 2022 00:08:17 GMT
Last-Modified
Tue, 09 Mar 2021 15:40:20 GMT
ETag
"1013b7-af8-5bd1c5e288100"
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=23456
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2808
Expires
Wed, 16 Mar 2022 06:39:13 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored object| locastyle object| hopscotch object| html5 object| Modernizr function| yepnope function| $ function| jQuery function| mascara function| campo_numerico function| cnpj_cpf function| mascara_cnpj function| mascara_cpf function| valida_cnpj function| valida_cpf object| google_tag_data function| ga object| gaplugins object| Select2 object| JST

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.locaweb.com.br
code.jquery.com
estatico.itau.com.br
netdna.bootstrapcdn.com
www.google-analytics.com
186.202.9.9
2001:4de0:ac18::1:a:3b
23.67.161.27
2404:6800:4004:825::200e
2606:4700::6812:acf
40.117.176.164
0c489fc6a4d1005640a88bfc3f670615236d9a28f2d024a309a5967502be49ac
28de0d68e967be7095076ec76c05d44a3059015e46aef4bcde882488d1441660
372fa34a79e23974775697d0d2fe45d9c707655a7c307ea7aee7873d353a6cce
43d85469dd056b51984179bd31d2115303f7193fc86740acdb328ccd31ae0b46
4cd957eb53ab34a984ee7487599065d499f75c5e24150ca893e8d377b5080000
4de407fc76d38586d90abfe4dae2528b49066ba4745db0c38fa78c99c939f8e8
538818d855c973751510b1d7923c1d784c02c83d88924616aa397a9ee96c7a4a
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
5977c3dbce96535178589debd3760c749cf49a68ee3d20d9b5ff398ae002c78e
7c39a17d06e60246090b71f94008de8ef7bcd2ad59189376f02e3273ae9e9de4
8c255a7ca29e833f0b857ddb9acf859bbff1d4ef0d4969023bdb1f47519280d9
93622f43a63e42bf97f01bb7010e660412f54c4d5d3d6f84ce50333beebc8fad
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a23118705846156f54e384df992bf18f94c9b76a27d750173e688ebb73c184f5
ab292789c477798ae95e7241f91535b9789122661a094f3c0dcfd3730185c055
b07dd9c9fc3ca6a9d7cd58fb5b6236a469eab7594f77e12c9d566383e73cbfff
b13cb5989e08fcb02314209d101e1102f3d299109bdc253b62aa1da21c9e38ba
b5da2535938d1f28235c349dfd95e602eab8e837b885c8fc5459818b28897917
d89ddb5a56ab5cc80d6fba1cac44538df00b02539903462c8526eeaea63bb4e0
fc1d94f50dd3822e1e53cb96af4f040d2ad8b5c7b984bae5e84efc7641acfada