novoobanco.sbs
Open in
urlscan Pro
45.141.215.108
Malicious Activity!
Public Scan
Effective URL: https://novoobanco.sbs/CION114JI0LFL5GOSQSA2KBYKP/login
Submission: On August 21 via manual from PT — Scanned from PT
Summary
TLS certificate: Issued by R10 on August 20th 2024. Valid for: 3 months.
This is the only time novoobanco.sbs was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Novobanco (Banking)Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 45.141.215.108 45.141.215.108 | 210558 (SERVICES-...) (SERVICES-1337-GMBH 1337-SERVICES-GMBH-NETWORK) | |
1 | 151.101.2.137 151.101.2.137 | 54113 (FASTLY) (FASTLY) | |
1 | 104.26.1.100 104.26.1.100 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 4 |
ASN210558 (SERVICES-1337-GMBH 1337-SERVICES-GMBH-NETWORK, DE)
novoobanco.sbs |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
novoobanco.sbs
novoobanco.sbs |
64 KB |
1 |
geojs.io
get.geojs.io — Cisco Umbrella Rank: 19497 |
829 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
31 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
10 | novoobanco.sbs |
novoobanco.sbs
code.jquery.com |
1 | get.geojs.io |
novoobanco.sbs
|
1 | code.jquery.com |
novoobanco.sbs
|
12 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
novoobanco.sbs R10 |
2024-08-20 - 2024-11-18 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
geojs.io WE1 |
2024-07-07 - 2024-10-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://novoobanco.sbs/CION114JI0LFL5GOSQSA2KBYKP/login
Frame ID: 6DE2B4441F466D8E7A20BB3290A58604
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
EntrarPage URL History Show full URLs
-
http://novoobanco.sbs/
HTTP 307
https://novoobanco.sbs/ Page URL
- https://novoobanco.sbs/CION114JI0LFL5GOSQSA2KBYKP/login Page URL
Detected technologies
FingerprintJS (JavaScript libraries) ExpandDetected patterns
- fingerprint(\d)?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://novoobanco.sbs/
HTTP 307
https://novoobanco.sbs/ Page URL
- https://novoobanco.sbs/CION114JI0LFL5GOSQSA2KBYKP/login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://novoobanco.sbs/ HTTP 307
- https://novoobanco.sbs/
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
novoobanco.sbs/ Redirect Chain
|
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all.css
novoobanco.sbs/public/styles/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loader.gif
novoobanco.sbs/public/images/ |
5 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
geo.js
get.geojs.io/v1/ip/ |
337 B 829 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
novoobanco.sbs/ |
150 B 482 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CION114JI0LFL5GOSQSA2KBYKP.html
novoobanco.sbs/ |
80 B 626 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login
novoobanco.sbs/CION114JI0LFL5GOSQSA2KBYKP/ |
9 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all.css
novoobanco.sbs/public/styles/ |
5 KB 274 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sibsfingerprint.js
novoobanco.sbs/web/Resources/js/ |
1 KB 934 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
novoobanco.sbs/public/javascripts/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fingerprint2.js
novoobanco.sbs/web/Resources/js/ |
58 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
page.domain
Submitted on
August 21st 2024, 1:09:58 am
UTC —
From Portugal
Threats:
Phishing
Brands:
Novobanco
PT
Comment: Fake phishing domain, targets customers of Portuguese bank.
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Novobanco (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| loadScript function| getFingerprint function| $ function| jQuery function| Fingerprint2 string| murmur3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
novoobanco.sbs/ | Name: csrf-token Value: PKYBK2ASQSOG5LFL0IJ411NOIC |
|
novoobanco.sbs/ | Name: visitor Value: 66c53d45801a5c6e77b75848 |
|
novoobanco.sbs/ | Name: userId Value: JS7BQSOM9OBT6 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
get.geojs.io
novoobanco.sbs
104.26.1.100
151.101.2.137
45.141.215.108
0e82f44abb154c9969b20615a1951cd5d42c8b52ecd38a07cddcdf3b92e3dfd2
0fe2faecb3b49209f95e818590169b38fdbba81eafdc1d97e0d7a3b7e4088855
44147327ad9359927a3688458ebe40cce4040807c9e2b7655230a21bcc0c9f01
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
571ef8942f9c26bca5c18ce7884fd61dbc4bfeed7a5a6f1e191a3536538660f3
5c1c028cedd52ff1a18e20266d818ec61ca4997db2cfd7456c35feb8418de1fa
6e21162bc64073fe9e3d3d6375ca24d04fed1912a5b7716aac0cb0f2d16fae7c
858f5fc6c36c6f7a6fb9ecde1d295f4ff988f43054379702063cca9054107681
990f3452736f1806199700baf0c66068b20b77c542daedec6959ec0fa2e73c15
cd13896ab186c6b592a29edda3b6b3add02d94665263c13852b0770fbbeef097
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e