www.auth-ib-vlacredapp.live Open in urlscan Pro
2606:4700:3034::6815:31d8 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.auth-ib-vlacredapp.live/
Submission: On January 16 via manual (January 16th 2023, 1:04:48 pm UTC) from BR — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 15 HTTP transactions. The main IP is 2606:4700:3034::6815:31d8, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.auth-ib-vlacredapp.live.
TLS certificate: Issued by GTS CA 1P5 on January 10th 2023. Valid for: 3 months.

This is the only time www.auth-ib-vlacredapp.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sistema de Cooperativas de Crédito – Ailos (Financial)

Domain & IP information

	IP Address		AS Autonomous System
11	2606:4700:303... 2606:4700:3034::6815:31d8		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:400d:803::200a		15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:80a::2003		15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:400... 2a04:4e42:400::485		54113 (FASTLY) (FASTLY)
15	5

11 2606:4700:3034::6815:31d8 (United States)

ASN13335 (CLOUDFLARENET, US)

www.auth-ib-vlacredapp.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:803::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	auth-ib-vlacredapp.live www.auth-ib-vlacredapp.live	648 KB
2	gstatic.com fonts.gstatic.com	91 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 357	18 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	2 KB
15	4

	Domain	Requested by
11	www.auth-ib-vlacredapp.live	www.auth-ib-vlacredapp.live
2	fonts.gstatic.com	fonts.googleapis.com
1	cdn.jsdelivr.net	www.auth-ib-vlacredapp.live
1	fonts.googleapis.com	www.auth-ib-vlacredapp.live
15	4

This site contains no links.

Subject Issuer	Validity	Valid
*.auth-ib-vlacredapp.live GTS CA 1P5	`2023-01-10` - `2023-04-10`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-12-12` - `2023-03-06`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-12-12` - `2023-03-06`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-23` - `2024-01-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.auth-ib-vlacredapp.live/
Frame ID: 139F2F2C3183FBFAD2B55C99A0CCEB1E
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

VIACREDI | Conta Online

Detected technologies

Firebase (Databases) Expand

Overall confidence: 100%
Detected patterns

/firebasejs/([\d.]+)/firebase

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

SweetAlert2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/npm/sweetalert2@([\d.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

15
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

889 kB
Transfer

2143 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.auth-ib-vlacredapp.live/ 1 MB
464 KB 1280ms
698ms Document
text/html 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: ccb8346293571737d185616b0d949d7271532398169232138696810f96a7e56a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 78a70ee9dc649b64-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 16 Jan 2023 13:04:40 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w%2BLgHhZOmzNU2iPHqQWmxldXhxn0feag3oxnSA4edk42JmVmG%2FpKQfV3JtlUhnDmQsDICTGEjudqeUPrxwy71n2sRIHmXNorWglwvptaAexFBw18SKt1PJlWMeSAwsmkg8oaTlneUZYCwTUA1wHggwiQLih%2BTPHn0Cw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33

GET
H2 200 css2
fonts.googleapis.com/ 33 KB
2 KB 221ms
70ms Stylesheet
text/css 2a00:1450:400d:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap

Requested by

Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:803::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

66988964c9a8d6e5e907e3311e688958d3445e2f8496a56c5a7806e333cf237d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 16 Jan 2023 13:04:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 16 Jan 2023 11:32:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Jan 2023 13:04:40 GMT

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 667a7904015e8a7f8efad8c0af3106d275a261adde9de7e801416ecc2fc5a41f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edbd02f128e1b69fc350b2d2ff357992c3e00bf1fef2b3ae973318de36741cde

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 117 KB
117 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e9522727eadd961fb2b15008598abb99dd9216c38d1700eb37ebfc26b393d56e

Request headers

Referer
Origin: https://www.auth-ib-vlacredapp.live
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 201ms
47ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.auth-ib-vlacredapp.live
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 09 Jan 2023 18:50:55 GMT
x-content-type-options: nosniff
age: 584027
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Jan 2024 18:50:55 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v34/ 47 KB
47 KB 250ms
116ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.auth-ib-vlacredapp.live
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 09 Jan 2023 19:05:07 GMT
x-content-type-options: nosniff
age: 583175
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47952
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:22:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Jan 2024 19:05:07 GMT

GET
H2 200 jquery.min.js Show response
www.auth-ib-vlacredapp.live/ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
32 KB 882ms
878ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"15d9d-5bd2f79da1040"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y1dINXRWGOqdR0hZWrG50wfgN3RrTBnp0adb1oLrk1KNrTDfExS1RwlTEZGzSnoRaJX1MisFTWTEyhjs%2FXaMoyjdxHNfIh5Khx6rCirb1LWPSqmhMrhemyLbyr1hmQW58VmQjt6ryLdxQPvziVwrntiGjH6bA5FHQyk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78a70ef7cc469b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery.cookie.min.js Show response
www.auth-ib-vlacredapp.live/cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/ 1 KB
1018 B 423ms
416ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 04 May 2020 16:11:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"514-5a4d4c98c7240"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bwzNR3mEB0LboXJFElTmIX4GfGdFSabd%2B1qMqCXLSwH%2Bzxhe0amE6JZ3fWrY9Fj%2BaFVK7Go%2BhPN6%2F16VAwy%2B9lbg7wEOJEdtncC24Bctbo7BPtzs8ifF%2BodmfUfyJ90NOprRAIVyai%2BF%2FehRecfFWK5QRkFV4RC9szc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78a70ef7ec6b9b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 pusher.min.js Show response
www.auth-ib-vlacredapp.live/js.pusher.com/7.0.3/ 64 KB
18 KB 871ms
863ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/js.pusher.com/7.0.3/pusher.min.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db894e1e33530a0d48f7f2b94a5190994457c3037e2e2218fe8869a568d65d36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Jan 2021 13:57:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"10195-5b9b9ebff03c0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RNyXT7WZRtKVz415ec8%2FXpf2i1M89yZbLr5FgVUkC9s%2FXzPfcw%2FBoH0TKLHKpd1jNNXiGdnWTRpN8xNKxY2628H9nWnMa5dYisSqUwF8zG3tEMNjPv%2F0NBtoC8C6PVxrOIpwIxOn7qwULE3mPhRCMbjm6jQVO4D%2B2VA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78a70ef7ec6c9b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 functions.js Show response
www.auth-ib-vlacredapp.live/ib/js/ 86 B
421 B 418ms
410ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/ib/js/functions.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb3c98907281b4c26c890bde49852b19c4bd9628ef10889e77f572c3dc1e8a4a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 04 Jun 2022 18:59:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"56-5e0a3d75937cc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LH7aRoZWU3CH8fajNAICfpx5aG%2BX5%2BD5p7kvMJZThe567j204gX%2Boy9cD31U%2BA4VQU%2BnthjUhPgn2%2BZpzZfYRs1OUxWvafeqw%2BsMTJnCKeEj%2FjfKaqAwEl2Lf3fLMOHhhr2J1eKudlSZZHRqQRU3DkBnwq8V%2Fn5s73Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78a70ef7ec6d9b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery.mask.min.js Show response
www.auth-ib-vlacredapp.live/cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.11.2/ 6 KB
3 KB 421ms
414ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.11.2/jquery.mask.min.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a17f2e9528214109ad7194958c1c3ba5367166dc7163f630d5c02c04a7623ef6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 04 May 2020 16:11:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"16bb-5a4d4c9aaf6c0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zMzVOWJfZZkL7cmz55b7EGamarcRbUnaofyRK5u8MogOvRjiB7aljcZGtMnZS43Xmk8kWLmILUOUU%2FSmTu%2BspRT1gj6PpUOGkMsOgiFF0L2%2F%2FROfQu757bj54KYu12xkVtrcywkF%2B7uF9c0wOWt4KZzJFbx40X8dVBc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78a70ef7ec709b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 main.js Show response
www.auth-ib-vlacredapp.live/ib/js/ 3 KB
1 KB 410ms
404ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/ib/js/main.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1cabcb9fc86a0c99a85c542c616b8e03955997bb59aa3c2364d398e9a39df55d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 04 Jun 2022 23:21:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"aea-5e0a77e05c130"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kp%2BN4hn9WODS1T1no8cvXYNOt6fpjijmCa8oj82bo3hSb0EM7fK5Ig87XFNbzaj4IBYgIEcaRxL9YtHMAgwBdMyjJbLqhabUGamV9iPg9PV7Lhv1eyoxsrvZesZI9CbvfKfbRoiooiVs07vAZNEHaQ2rjDyRZQ76iO0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78a70ef7ec719b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 sweetalert2@11 Show response
cdn.jsdelivr.net/npm/ 63 KB
18 KB 39ms
10ms Script
application/javascript 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/sweetalert2@11

Requested by

Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

dc0ed06b27904f269631d72e5a29843334c86ae216b1c9e1abf03719f282c620

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 16 Jan 2023 13:04:42 GMT
x-content-type-options: nosniff
content-encoding: gzip
age: 41906
x-jsd-version: 11.7.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 18049
x-served-by: cache-fra-eddf8230057-FRA, cache-hhn-etou8220071-HHN
x-jsd-version-type: version
etag: W/"fb64-34eqtuU2wFHLf+AFCtoJcVba3Uo"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 firebase-app.js Show response
www.auth-ib-vlacredapp.live/www.gstatic.com/firebasejs/8.10.0/ 22 KB
7 KB 674ms
668ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/www.gstatic.com/firebasejs/8.10.0/firebase-app.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a78d872dee0b66e1fd7cfdab14645678b8f9596cf42b212029825029acda4dfc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 19 Aug 2021 20:25:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5669-5c9ef5af62200"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7MwU8EaJ6BfZrxVFe76NZ6OmDA%2Fior0c9Tq2%2FEjBaFT%2BB6mEosm5YL3dZQaVtEcBaeaqDzMSPK6rKz%2Bk77IjxS5Eht8lyyZDiQ2koWH54xlEEZDffSEt1KUgSrjT7nxXPfJTy7MgsclNXD%2FtLyKYpQzMEYtxT0vDx9s%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78a70ef7ec729b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 firebase-firestore.js Show response
www.auth-ib-vlacredapp.live/www.gstatic.com/firebasejs/8.10.0/ 329 KB
92 KB 1715ms
1713ms Script
application/javascript 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/www.gstatic.com/firebasejs/8.10.0/firebase-firestore.js
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 985c4e83789779028a994e33db07cc9e3e5a1ae783df634a78e9db0b44d81573

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 19 Aug 2021 20:25:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"52416-5c9ef5af62200"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ku0YbxYZSjeRkhUe%2F3eG4SdFE7G0SPBFdPpyxsXTsz64txe5%2BcjInUElZZH13Tc30Zl%2FfcECe2ym6SNyeOJKOkNxaUlAaNnqgSJgbbKG%2BusWw6uOlBurGSQ73%2F%2Fu6AeSvTtMjjsoftuZlY%2FJmdppq2GzSwPlW9br%2FDk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78a70ef7ec749b64-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
DATA 200
OK truncated
/ 13 KB
13 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8701b2ed392e823f8a35712a45a94e733685cf8a5b7afb6906f7cbdddec950a5

Request headers

Referer
Origin: https://www.auth-ib-vlacredapp.live
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H3 200 all.css
www.auth-ib-vlacredapp.live/pro.fontawesome.com/releases/v5.10.0/css/ 154 KB
29 KB 1997ms
1996ms Stylesheet
text/css 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/pro.fontawesome.com/releases/v5.10.0/css/all.css
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 657acd7d31812fbfcfac85fdfb24c488528f7a00e67054a7e3eb56de540fb33e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.auth-ib-vlacredapp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:45 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 28 Jun 2021 16:54:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"26730-5c5d657e74200"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K6g6f3VLZ2jHmJTuKh6Q8Vaodus9z%2BkDgi96rYQT%2FUTZlWNEYCvA25Oy%2BAEwTJuQLd%2BBV%2B9foGhLrd2ZZY4SVfrHpgH8vmbx%2FpIa9awl8QIZ7Uj7IypY8WSP1eFiVNt9DWzPI5Th94LLRrlH1z9TydfkUesIYdz4C88%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78a70f02dda890ee-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 404 start_request_all_index Show response
www.auth-ib-vlacredapp.live/api/ 314 B
731 B 848ms
848ms XHR
text/html 2606:4700:3034::6815:31d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.auth-ib-vlacredapp.live/api/start_request_all_index
Requested by: Host: www.auth-ib-vlacredapp.live
URL: https://www.auth-ib-vlacredapp.live/ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:31d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb6660f124dbb5085e7ad3cc095c3e91199edf25a9090d733a0b4fe36877ac2a

Request headers

Accept: */*
Referer: https://www.auth-ib-vlacredapp.live/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 13:04:44 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bBVZFk1bbXafQdILYQh%2Bde2FC4dqO8TPCS9ivKf4oGY6eI1OSuS2m3BHdybaSLp%2FS4gosZA4oIszz1ikbL8Xj2Ahw%2BWRGjRbVFpmoPtA2unqZYVY8GoN6QapAxrtkEP4NNS%2FbBSKG4%2B38%2FvrIWmGbTR9cCDJEE7xCSY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cf-ray: 78a70f02edc390ee-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sistema de Cooperativas de Crédito – Ailos (Financial)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery function| Pusher function| validateEmail function| DataPushCommand function| Update function| Update2 function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal object| firebase object| url string| nome function| iniciar_presensa_online object| link function| ManterOnline object| semana object| dataAtual object| aMes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.auth-ib-vlacredapp.live/	1969-12-31 23:59:59	Name: PHPSESSID Value: rbla2ss27cjjqsofjsok40hb1g

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.auth-ib-vlacredapp.live/api/start_request_all_index Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
www.auth-ib-vlacredapp.live
2606:4700:3034::6815:31d8
2a00:1450:400d:803::200a
2a00:1450:400d:80a::2003
2a04:4e42:400::485
1cabcb9fc86a0c99a85c542c616b8e03955997bb59aa3c2364d398e9a39df55d
657acd7d31812fbfcfac85fdfb24c488528f7a00e67054a7e3eb56de540fb33e
667a7904015e8a7f8efad8c0af3106d275a261adde9de7e801416ecc2fc5a41f
66988964c9a8d6e5e907e3311e688958d3445e2f8496a56c5a7806e333cf237d
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
8701b2ed392e823f8a35712a45a94e733685cf8a5b7afb6906f7cbdddec950a5
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
985c4e83789779028a994e33db07cc9e3e5a1ae783df634a78e9db0b44d81573
a17f2e9528214109ad7194958c1c3ba5367166dc7163f630d5c02c04a7623ef6
a78d872dee0b66e1fd7cfdab14645678b8f9596cf42b212029825029acda4dfc
cb6660f124dbb5085e7ad3cc095c3e91199edf25a9090d733a0b4fe36877ac2a
ccb8346293571737d185616b0d949d7271532398169232138696810f96a7e56a
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
db894e1e33530a0d48f7f2b94a5190994457c3037e2e2218fe8869a568d65d36
dc0ed06b27904f269631d72e5a29843334c86ae216b1c9e1abf03719f282c620
e9522727eadd961fb2b15008598abb99dd9216c38d1700eb37ebfc26b393d56e
edbd02f128e1b69fc350b2d2ff357992c3e00bf1fef2b3ae973318de36741cde
fb3c98907281b4c26c890bde49852b19c4bd9628ef10889e77f572c3dc1e8a4a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e