consulterpfatu24.com Open in urlscan Pro
2606:4700:3033::6815:3b7c  Malicious Activity! Public Scan

20 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

31 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.php Show response consulterpfatu24.com/login/	718 KB 87 KB	224ms 190ms	Document text/html	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.28 Resource Hash f16319e9e4b850f91c219968f9b0efc913c31789ce6f34cbb811a4f622696e71 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 728d9c687a33912b-FRA content-encoding br content-type text/html; charset=UTF-8 date Mon, 11 Jul 2022 01:01:58 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e4KEztnH2UwdLG6mKCPuosRTFJswhyxsF5oc5p6JaUKSeNoKJYQ5GrKCas8y2YkaZzET09mHkoswSxFD6rHpMszBPc50c3%2BlZWw9crCw585oBSGTUpCY%2FxxHL9BvbtKj%2BqqfltenwmI7pQNnfFvkNHw6UA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.4.28
GET H2	404	recaptcha__pt_br.js www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/	0 0	99ms 53ms	Script text/html	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://consulterpfatu24.com/ Origin https://consulterpfatu24.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:58 GMT x-content-type-options nosniff server sffe content-type text/html; charset=UTF-8 access-control-allow-origin * cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1624 x-xss-protection 0
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	73ms 23ms	Script text/javascript	2a00:1450:4001:80b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 13 Apr 2022 21:02:38 GMT server Golfe2 age 7027 date Sun, 10 Jul 2022 23:04:51 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Mon, 11 Jul 2022 01:04:51 GMT
GET H/1.1	200 OK	tag.js Show response cdn.pmweb.com.br/df/	22 KB 9 KB	827ms 203ms	Script application/javascript	18.228.98.140 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.228.98.140 São Paulo, Brazil, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-228-98-140.sa-east-1.compute.amazonaws.com Software nginx / Resource Hash 94c081e2ae2f0618d1661bb9267a2ae65addb921bef6464fb1dd7169bd5f55c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Mon, 11 Jul 2022 01:01:59 GMT Content-Encoding gzip Last-Modified Thu, 07 Jul 2022 22:01:30 GMT Server nginx ETag W/"62c757ba-587b" Vary Accept-Encoding Connection keep-alive Content-Type application/javascript Cache-Control max-age=300 Strict-Transport-Security max-age=31536000; includeSubdomains; preload Content-Length 9197 Expires Mon, 11 Jul 2022 01:06:59 GMT
GET H2	200	js Show response www.google-analytics.com/gtm/	101 KB 39 KB	50ms 27ms	Script application/javascript	2a00:1450:4001:80b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-W9SBWRL&cid=1003849302.1648069470 Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 258fff31d86bd910cb59e84760055946ad936a73cf3366289f9b1f9247cd242d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:58 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39693 x-xss-protection 0 last-modified Mon, 11 Jul 2022 00:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 11 Jul 2022 01:01:58 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	122 KB 46 KB	62ms 25ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-N2FTFQ Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d9f4ab86e1fd1ce51e9becf1a19e9c88ca095d079961a59f9e965f4032bed203 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:58 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46792 x-xss-protection 0 last-modified Mon, 11 Jul 2022 00:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 11 Jul 2022 01:01:58 GMT
GET H2	404	ruxitagentjs_ICA2Vfghjqru_10235220309135426.js consulterpfatu24.com/	0 0	205ms 203ms	Script text/html	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://consulterpfatu24.com/ruxitagentjs_ICA2Vfghjqru_10235220309135426.js Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:58 GMT content-encoding br cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GJMfVhf1Zk6%2B4Wsj86lateOMo246N03CD7UEnaCMtCZnOjFhvUP%2FYQJr%2FiZsuhuFq8mxKpozCvLC5JiZ59ayXyZX95IfVHAIJnHUDnm4p0kawWuU1GpYVdqUKUnRzro4T6Le7RZqnrfjnTGNCQBnDoxlWg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 728d9c69cb53912b-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	189e25234ffe70ce_complete.js Show response js-cdn.dynatrace.com/jstag/157944990f8/bf73995led/	218 KB 84 KB	39ms 9ms	Script application/javascript	52.222.236.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js-cdn.dynatrace.com/jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.236.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-236-111.fra56.r.cloudfront.net Software / Resource Hash 46581720b69d3a36651f5a9a1c2a1fce215774888defb51451cf4068c2679f6e Request headers Referer https://consulterpfatu24.com/ Origin https://consulterpfatu24.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 00:49:36 GMT content-encoding gzip age 742 x-cache Hit from cloudfront x-oneagent-js-injection true traffic-source UNKNOWN access-control-allow-origin * dynatrace-response-id YIGTVYWR39CF dynatrace-response-source Cluster vary Accept-Encoding content-type application/javascript;charset=utf-8 via 1.1 934706f40ffde6f857deae8d024c1192.cloudfront.net (CloudFront) cache-control public, max-age=3600 x-amz-cf-pop FRA56-P4 timing-allow-origin * x-amz-cf-id tXhm7oeHxbygi1Nn8ipeNpL_svOkMc6A6NAKkAvzC03Yupe3EWLmlA== expires Mon, 11 Jul 2022 01:49:36 GMT
GET H2	200	3.bundle-d6a6baaa0dc3faae26db.js Show response consulterpfatu24.com/js/	37 KB 9 KB	195ms 193ms	Script application/javascript	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://consulterpfatu24.com/js/3.bundle-d6a6baaa0dc3faae26db.js Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4ab4958c63bd706e031161717896c8fbe22f133a4c9ff285cc053e75ceb13d06 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:58 GMT content-encoding br cf-cache-status REVALIDATED last-modified Wed, 23 Mar 2022 21:09:38 GMT server cloudflare etag W/"93a0-5dae925b10137" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FncXyO4fXc4J77CXNXIYs9DnU83pfoTzmq%2FAHjl3z0SY4LyTACX3EjulNwXKDUMiklAzZsgmzpoYKPscyXwOdFASqIzq6VkU3NHbJjjfEXHk%2F7WZtqqC7iZQxnsfMlnsIWOSvgOXS6qsxSIy%2BtJUg8uBOQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 728d9c69cb55912b-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	404	2.bundle-d410ea60e5b46c298cdd.js consulterpfatu24.com/cartoes-renner/js/	0 0	190ms 189ms	Script text/html	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://consulterpfatu24.com/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:58 GMT content-encoding br cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vgRq0GAQ3Ad0B7MFRifXn1rDVgLk4p6PLOVtxeD82u6SH%2BvFCjXNzO5lSau7D5CNNJvAoUdIvYTMzSSuAzzYccZ4Bn1XvxN22LtzyFEeCvWi9L%2FjIldHjaYP7lhiPvMnDwnx%2B%2BgLKQ0dSxOwpqfTz9%2F36w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 728d9c69cb56912b-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	47ms 13ms	Script text/javascript	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 00:59:17 GMT content-encoding gzip x-content-type-options nosniff age 162 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 11 Jul 2023 00:59:17 GMT
GET H3	200	google-play-badge-reverse.svg consulterpfatu24.com/vectors/	11 KB 4 KB	189ms 188ms	Image image/svg+xml	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://consulterpfatu24.com/vectors/google-play-badge-reverse.svg Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e946d863a136a09089fd275d574ff3346bad8327d4ef378c06af35872d9fe56d Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:59 GMT content-encoding br cf-cache-status REVALIDATED last-modified Wed, 23 Mar 2022 21:19:26 GMT server cloudflare etag W/"2a25-5dae948c4dbd2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lgrEX1%2FFj8QOUrMuMpYqzTMfGdiZquEVmvmKKvaFZi%2FD5qeJ7N2gjLy9fZj64DOjoaSp6eqUN5ZAlJZOJDgUwR6mwsQpChvsCZhNwMfhagCaPqna49whEC%2FgTRMi8dUFI7nD4Z5TFX8Lroq7Qe8n5Qv3OA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 728d9c6d690e6946-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	celular-login.png consulterpfatu24.com/images/	152 KB 152 KB	210ms 209ms	Image image/png	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://consulterpfatu24.com/images/celular-login.png Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7db4ada57262fbacd47bef4e96e3cedda276b9267e6ca4d20adeeb1c24d870b6 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:59 GMT cf-cache-status REVALIDATED last-modified Wed, 23 Mar 2022 21:20:16 GMT server cloudflare etag "25e28-5dae94bbad437" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sM6fK9%2Bne6xHBAm8Xu56xfH4cFsqYKdvSi2myhcxW2AZLD6vQfKRZBJmLvjB4c3%2B18B1dX8PFEuzrIw9lgB94tQI4qd1el%2B5lYy2p4jlQuqtR7bGK74rVrELaVZNoCChowVfk%2Bk95cEVejypVusdWE5K%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 728d9c6d69116946-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 155176
GET H3	200	google-play-badge.svg consulterpfatu24.com/vectors/	11 KB 4 KB	193ms 192ms	Image image/svg+xml	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://consulterpfatu24.com/vectors/google-play-badge.svg Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8827f96ace2afe4aeff4c33db4ac86193f38a62cb30d9fbba949e0b72c2a55ff Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:59 GMT content-encoding br cf-cache-status REVALIDATED last-modified Wed, 23 Mar 2022 21:21:29 GMT server cloudflare etag W/"2a22-5dae9501c4b83" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A5oi2H0hHkfLBqVLJu%2BIRllGfpBEUc5fuRDr%2BqADby84Ff%2FR%2Fa3YsInMZIC2Lt9YMra%2Bo3Ce2qnGlOAn1H6b3E870XV8tHQR0HL4t1tGz%2F%2BYaievrbl5%2FTfKro02NsbOXiz0sRvV48%2FhNQHTzcsCLZ6IjA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 728d9c6d69126946-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	app-store-badge.svg consulterpfatu24.com/vectors/	14 KB 4 KB	195ms 194ms	Image image/svg+xml	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://consulterpfatu24.com/vectors/app-store-badge.svg Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3dd08d21a5c010294a50355af3565a50d08ea4aef83e822114be29171209f109 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:59 GMT content-encoding br cf-cache-status REVALIDATED last-modified Wed, 23 Mar 2022 21:21:50 GMT server cloudflare etag W/"37b6-5dae951579e0e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dHbMJTtdh51AAROFHVJMjTzpJP4Tcqa7YzTE4oyga1sjoXqOSj1CYDEY6nmSjDoTVv%2FjHlgyhWDf8QeMuLdwiIxoqIk7Ct2o5CNDcPYKppy0Rhfi2vwk6nMxFlT8auk07gSgFoXdqBEFNoaQQTUk1teVjQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 728d9c6d69156946-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	vendors.bundle-859d26788acf215a201a.js Show response consulterpfatu24.com/js/	670 KB 219 KB	235ms 234ms	Script application/javascript	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://consulterpfatu24.com/js/vendors.bundle-859d26788acf215a201a.js Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 40d596025119e99448ba247d9ad58248525a484a971dabdd366e0724453e3e36 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:59 GMT content-encoding br cf-cache-status REVALIDATED last-modified Wed, 23 Mar 2022 21:22:58 GMT server cloudflare etag W/"a7986-5dae955635fe5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cCNYMSyQvQQqtwyxalph2q%2FPtNVk0wAXJz4bexsxPyeE%2F30GIRUBKVi48gxouL22yJ5Hz3lEXRNqcqPw8wOYLAymQBT8ba7ZYr6ONaGysB0Uw7dwggm5O5TMXgC%2Foh9ZultjefnxEYEdnplXc19BobI7EA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 728d9c6d69166946-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	api.js Show response www.google.com/recaptcha/	913 B 989 B	69ms 23ms	Script text/javascript	2a00:1450:4001:813::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js?onload=onLoadRecaptcha&render=explicit&hl=pt-BR Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 3d65be0de33181dc54e020a06ac87d39d0b71f13ad4dcc400d557ae57664b8ed Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:59 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin content-security-policy frame-ancestors 'self' alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 576 x-xss-protection 1; mode=block expires Mon, 11 Jul 2022 01:01:59 GMT
GET H3	200	anchor Show response www.google.com/recaptcha/api2/ Frame 8702	42 KB 22 KB	69ms 39ms	Document text/html	2a00:1450:4001:813::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV&co=aHR0cHM6Ly93d3cucmVhbGl6ZXNvbHVjb2VzZmluYW5jZWlyYXMuY29tLmJyOjQ0Mw..&hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&size=invisible&badge=inline&cb=uii3yowxuayz Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 13a49295aaac38c30ab81480197e0f4eabd5ca5d43c6e7765c9340418b753750 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-RqmT8EH8aGs8dDQG1RFUGA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://consulterpfatu24.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-length 22620 content-security-policy script-src 'report-sample' 'nonce-RqmT8EH8aGs8dDQG1RFUGA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Mon, 11 Jul 2022 01:01:59 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} server GSE x-content-type-options nosniff x-xss-protection 1; mode=block
GET H3	200	bg-login.svg consulterpfatu24.com/vectors/	664 B 977 B	204ms 204ms	Image image/svg+xml	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://consulterpfatu24.com/vectors/bg-login.svg Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3bb71cec41dd0b3c5782f72d32b1b028fdc9558f0acace778d1a2c312d50f382 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:59 GMT content-encoding br cf-cache-status REVALIDATED last-modified Wed, 23 Mar 2022 21:25:11 GMT server cloudflare etag W/"298-5dae95d56eb6a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9UhBmb2Ryy0YRBQRgXKCIGwJ8GJvN%2BmFRbavULlaGLmqsrIv9tbc2ip46jDYEGe%2BpF%2FgK5zvBc5H5iBs5f7bYNIRUMpRQCVYi1mwr0YvmNkcdVvyM33yQhp9PXvQu6eIXQzRCOEsZzCZ9ZxXFod5IkKslw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 728d9c6e39956946-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	404	whatsapp.svg consulterpfatu24.com/cartoes-renner/vectors/	0 0	192ms 192ms	Other text/html	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://consulterpfatu24.com/cartoes-renner/vectors/whatsapp.svg Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:01:59 GMT content-encoding br cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fKNUYZJ3BK03hlEwg9F9Zm5P9E3kLwG2RWbuSLdo8CqhF8FdI3yEkQv4RLfdHDvLnnEsSaNRhmyVTDO4kVCvu0ll7gwv30VWhzRitIH4ekvpRRWJk2JA2rdcN0cZ2OPOoGm9blfWQhF9UhqhJxL1sVrqlA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 728d9c6e59a86946-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H/1.1	200 OK	bg.png s3-sa-east-1.amazonaws.com/frame-image-br/	0 516 B	834ms 220ms	Image image/png	52.95.163.80 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s3-sa-east-1.amazonaws.com/frame-image-br/bg.png?x-id=real&x-r= Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.95.163.80 São Paulo, Brazil, ASN16509 (AMAZON-02, US), Reverse DNS s3-sa-east-1.amazonaws.com Software AmazonS3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Mon, 11 Jul 2022 01:02:01 GMT Last-Modified Thu, 04 May 2017 08:21:21 GMT Server AmazonS3 x-amz-meta-s3cmd-attrs uid:502/gname:staff/uname:user/gid:20/mode:33188/mtime:1493416832/atime:1493796970/md5:d41d8cd98f00b204e9800998ecf8427e/ctime:1493416832 x-amz-request-id 1M9BM9ZVD5H6N47W ETag "d41d8cd98f00b204e9800998ecf8427e" Content-Type image/png Accept-Ranges bytes Content-Length 0 x-amz-id-2 ojauURLzg4ZecQX0NHxEliso6wSgMNK0wdxiw98Pikh8wqhgsVvuJrpC9mAdNLjvGr+HSAIbHqc=
GET H3	404	styles__ltr.css www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/ Frame 8702	0 0	153ms 124ms	Stylesheet text/html	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV&co=aHR0cHM6Ly93d3cucmVhbGl6ZXNvbHVjb2VzZmluYW5jZWlyYXMuY29tLmJyOjQ0Mw..&hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&size=invisible&badge=inline&cb=uii3yowxuayz Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers
GET H3	404	recaptcha__pt_br.js www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/ Frame 8702	0 0	459ms 431ms	Script text/html	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV&co=aHR0cHM6Ly93d3cucmVhbGl6ZXNvbHVjb2VzZmluYW5jZWlyYXMuY29tLmJyOjQ0Mw..&hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&size=invisible&badge=inline&cb=uii3yowxuayz Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers
GET H3	200	bframe Show response www.google.com/recaptcha/api2/ Frame EEEA	7 KB 1 KB	26ms 26ms	Document text/html	2a00:1450:4001:813::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/bframe?hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV Requested by Host: consulterpfatu24.com URL: https://consulterpfatu24.com/login/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash ed3fca857283b91f77ce8a81aa8e931c64acb1df09e673a412cde1aca07de584 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-jzDaXPUyrANZucWeRUMfQA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://consulterpfatu24.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-length 1118 content-security-policy script-src 'report-sample' 'nonce-jzDaXPUyrANZucWeRUMfQA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Mon, 11 Jul 2022 01:01:59 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} server GSE x-content-type-options nosniff x-xss-protection 1; mode=block
GET H3	200	recaptcha__pt_br.js Show response www.gstatic.com/recaptcha/releases/4rwLQsl5N_ccppoTAwwwMrEN/	365 KB 144 KB	42ms 15ms	Script text/javascript	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/4rwLQsl5N_ccppoTAwwwMrEN/recaptcha__pt_br.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js?onload=onLoadRecaptcha&render=explicit&hl=pt-BR Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash dd73b979627ce8cce182cb41b5b4aba88ce2e9c972726b9f1f259763829028eb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://consulterpfatu24.com/ Origin https://consulterpfatu24.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 04 Jul 2022 16:30:02 GMT content-encoding gzip x-content-type-options nosniff age 549117 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 147656 x-xss-protection 0 last-modified Mon, 13 Jun 2022 04:02:51 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 04 Jul 2023 16:30:02 GMT
GET H3	404	styles__ltr.css www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/ Frame EEEA	0 0	54ms 54ms	Stylesheet text/html	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/bframe?hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers
GET H3	404	recaptcha__pt_br.js www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/ Frame EEEA	0 0	352ms 351ms	Script text/html	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/bframe?hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers
GET H/1.1	200 OK	/ Show response df.pmweb.com.br/push/	2 B 512 B	1047ms 200ms	XHR text/plain	52.67.205.162 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://df.pmweb.com.br/push/?aid=PM-N2FTFQ&cid=671301657501319550&sid=400381657501319551&pvw=eac7017d-1385-41d0-a258-e70ff05f2c18&v=1.19.0&rs=1600x1200&tt=Cart%C3%B5es%20Renner&ws=1600x1200&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F103.0.5060.53%20Safari%2F537.36&url=https%3A%2F%2Fconsulterpfatu24.com%2Flogin%2Findex.php Requested by Host: cdn.pmweb.com.br URL: https://cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.67.205.162 São Paulo, Brazil, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-67-205-162.sa-east-1.compute.amazonaws.com Software nginx / Resource Hash 54d626e08c1c802b305dad30b7e54a82f102390cc92c7d4db112048935236e9c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Pragma no-cache Date Mon, 11 Jul 2022 01:02:00 GMT Server nginx Strict-Transport-Security max-age=31536000; includeSubdomains; preload Content-Type text/plain Access-Control-Allow-Origin https://consulterpfatu24.com Cache-Control no-cache, no-store, must-revalidate Access-Control-Allow-Credentials true Connection keep-alive Content-Length 2 Expires 0
GET H3	200	bg-login.svg consulterpfatu24.com/vectors/	664 B 975 B	13ms 12ms	Image image/svg+xml	2606:4700:3033::6815:3b7c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://consulterpfatu24.com/vectors/bg-login.svg Requested by Host: js-cdn.dynatrace.com URL: https://js-cdn.dynatrace.com/jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:3b7c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3bb71cec41dd0b3c5782f72d32b1b028fdc9558f0acace778d1a2c312d50f382 Request headers accept-language de-DE,de;q=0.9 Referer https://consulterpfatu24.com/login/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Mon, 11 Jul 2022 01:02:01 GMT content-encoding br cf-cache-status HIT last-modified Wed, 23 Mar 2022 21:25:11 GMT server cloudflare age 2 etag W/"298-5dae95d56eb6a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VH0GRfjHptdtzXRhhnvg%2Fa%2FQk0%2FqIFy4mD7qRnWeSzE2o29LDb3a%2FOQIUWifaEhJ5CvFky28VMEgGOuUy1eYrgSmqs7klItb0l6Km0x9JzaP%2FFzjl6BbvEbWcnjEc7T8969rYpjE%2B5hZBnBt1fzLNp4BCg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 728d9c7a5a476946-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST H2	200	bf Show response bf73995led.bf.dynatrace.com/	698 B 966 B	295ms 95ms	XHR text/plain	54.205.116.70 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bf73995led.bf.dynatrace.com/bf?type=js3&sn=v_4_srv_-2D73_sn_833ACGSU0J29DJ6VH3KR6QJH6LA5ATN5&svrid=-73&flavor=cors&vi=JOGUMGHLPFEJCURBUJMQMEHJIRKWCEMK-0&modifiedSince=1647975459642&rf=https%3A%2F%2Fconsulterpfatu24.com%2Flogin%2Findex.php&bp=3&app=189e25234ffe70ce&crc=838663316&en=ovxxhecl&end=1 Requested by Host: js-cdn.dynatrace.com URL: https://js-cdn.dynatrace.com/jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.205.116.70 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-205-116-70.compute-1.amazonaws.com Software / Resource Hash 0821de376b09802567fee8fb03b7f218cfd81898149806ab0a1382d11f1ce879 Request headers Referer https://consulterpfatu24.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin https://consulterpfatu24.com x-oneagent-js-injection true date Mon, 11 Jul 2022 01:02:01 GMT cache-control no-cache content-length 698 content-type text/plain;charset=utf-8
POST H2	200	bf Show response bf73995led.bf.dynatrace.com/	207 B 472 B	95ms 95ms	XHR text/plain	54.205.116.70 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bf73995led.bf.dynatrace.com/bf?type=js3&sn=v_4_srv_1_sn_833ACGSU0J29DJ6VH3KR6QJH6LA5ATN5_app-3A189e25234ffe70ce_1_ol_0_perc_100000_mul_1&svrid=1&flavor=cors&vi=JOGUMGHLPFEJCURBUJMQMEHJIRKWCEMK-0&modifiedSince=1657481373702&rf=https%3A%2F%2Fconsulterpfatu24.com%2Flogin%2Findex.php&bp=3&app=189e25234ffe70ce&crc=1933547603&en=ovxxhecl&end=1 Requested by Host: js-cdn.dynatrace.com URL: https://js-cdn.dynatrace.com/jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.205.116.70 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-205-116-70.compute-1.amazonaws.com Software / Resource Hash a24f000a05ba97e226e555e3a7ab1559f534f9ab5d84e0f401645bfd8d8cdc1f Request headers Referer https://consulterpfatu24.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin https://consulterpfatu24.com x-oneagent-js-injection true date Mon, 11 Jul 2022 01:02:03 GMT cache-control no-cache content-length 207 content-type text/plain;charset=utf-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Realize (Financial)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| google_tag_data function| ga object| gaplugins object| google_tag_manager object| dataLayer object| constants object| dT_ object| dtrum object| container object| google_optimize string| PMTagObject function| pm object| e function| $ string| u object| gaGlobal object| gaData function| runTag object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.consulterpfatu24.com/	1969-12-31 23:59:59	Name: rxVisitor Value: 1657501318885UKFV0D31NP39RVKOV1L9JKUH4CQLI72T
			.consulterpfatu24.com/	1969-12-31 23:59:59	Name: dtLatC Value: 18
			.consulterpfatu24.com/	1969-12-31 23:59:59	Name: dtSa Value: -
			.consulterpfatu24.com/	1970-01-20 21:56:13	Name: _ga Value: GA1.2.1456333151.1657501319
			.consulterpfatu24.com/	1970-01-20 04:26:27	Name: _gid Value: GA1.2.833491879.1657501319
			.consulterpfatu24.com/	1970-01-20 21:56:13	Name: _pm_id Value: 671301657501319550
			.consulterpfatu24.com/	1970-01-20 04:25:03	Name: _pm_sid Value: 400381657501319551
			.consulterpfatu24.com/	1969-12-31 23:59:59	Name: rxvt Value: 1657503120245|1657501318886
			.consulterpfatu24.com/	1969-12-31 23:59:59	Name: dtPC Value: -73$301318883_748h-vJOGUMGHLPFEJCURBUJMQMEHJIRKWCEMK-0e0
			.consulterpfatu24.com/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_1_sn_833ACGSU0J29DJ6VH3KR6QJH6LA5ATN5_app-3A189e25234ffe70ce_1_ol_0_perc_100000_mul_1

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consulterpfatu24.com/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consulterpfatu24.com/ruxitagentjs_ICA2Vfghjqru_10235220309135426.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://consulterpfatu24.com/cartoes-renner/vectors/whatsapp.svg#whatsapp Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bf73995led.bf.dynatrace.com
cdn.pmweb.com.br
consulterpfatu24.com
df.pmweb.com.br
js-cdn.dynatrace.com
s3-sa-east-1.amazonaws.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
18.228.98.140
2606:4700:3033::6815:3b7c
2a00:1450:4001:80b::200e
2a00:1450:4001:80e::2008
2a00:1450:4001:813::2004
2a00:1450:4001:828::200a
2a00:1450:4001:82b::2003
52.222.236.111
52.67.205.162
52.95.163.80
54.205.116.70
0821de376b09802567fee8fb03b7f218cfd81898149806ab0a1382d11f1ce879
13a49295aaac38c30ab81480197e0f4eabd5ca5d43c6e7765c9340418b753750
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
258fff31d86bd910cb59e84760055946ad936a73cf3366289f9b1f9247cd242d
3bb71cec41dd0b3c5782f72d32b1b028fdc9558f0acace778d1a2c312d50f382
3d65be0de33181dc54e020a06ac87d39d0b71f13ad4dcc400d557ae57664b8ed
3dd08d21a5c010294a50355af3565a50d08ea4aef83e822114be29171209f109
40d596025119e99448ba247d9ad58248525a484a971dabdd366e0724453e3e36
46581720b69d3a36651f5a9a1c2a1fce215774888defb51451cf4068c2679f6e
4ab4958c63bd706e031161717896c8fbe22f133a4c9ff285cc053e75ceb13d06
54d626e08c1c802b305dad30b7e54a82f102390cc92c7d4db112048935236e9c
7db4ada57262fbacd47bef4e96e3cedda276b9267e6ca4d20adeeb1c24d870b6
8827f96ace2afe4aeff4c33db4ac86193f38a62cb30d9fbba949e0b72c2a55ff
94c081e2ae2f0618d1661bb9267a2ae65addb921bef6464fb1dd7169bd5f55c6
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a24f000a05ba97e226e555e3a7ab1559f534f9ab5d84e0f401645bfd8d8cdc1f
d9f4ab86e1fd1ce51e9becf1a19e9c88ca095d079961a59f9e965f4032bed203
dd73b979627ce8cce182cb41b5b4aba88ce2e9c972726b9f1f259763829028eb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e946d863a136a09089fd275d574ff3346bad8327d4ef378c06af35872d9fe56d
ed3fca857283b91f77ce8a81aa8e931c64acb1df09e673a412cde1aca07de584
f16319e9e4b850f91c219968f9b0efc913c31789ce6f34cbb811a4f622696e71