app-nb.top Open in urlscan Pro
2606:4700:3033::ac43:b43e Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://app-nb.top/cartao.php
Effective URL:
https://app-nb.top/cartao.php
Submission: On February 24 via automatic, source phishtank (February 24th 2024, 8:23:31 pm UTC) — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3033::ac43:b43e, located in United States and belongs to CLOUDFLARENET, US. The main domain is app-nb.top.
TLS certificate: Issued by GTS CA 1P5 on February 22nd 2024. Valid for: 3 months.

This is the only time app-nb.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Novobanco (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 9	2606:4700:303... 2606:4700:3033::ac43:b43e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:e2:... 2606:4700:e2::ac40:8007	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2

9 2606:4700:3033::ac43:b43e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

app-nb.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:e2::ac40:8007 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	app-nb.top 1 redirects app-nb.top	143 KB
4	fontawesome.com ka-f.fontawesome.com — Cisco Umbrella Rank: 3033	96 KB
12	2

	Domain	Requested by
9	app-nb.top	1 redirects app-nb.top
4	ka-f.fontawesome.com	app-nb.top
12	2

This site contains no links.

Subject Issuer	Validity	Valid
app-nb.top GTS CA 1P5	`2024-02-22` - `2024-05-22`	3 months	crt.sh
ka-f.fontawesome.com GTS CA 1P5	`2024-01-06` - `2024-04-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://app-nb.top/cartao.php
Frame ID: 20B2446804B564CE2E86D15555AAFA63
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Acesso online.

Page URL History Show full URLs

http://app-nb.top/cartao.php HTTP 301
https://app-nb.top/cartao.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

239 kB
Transfer

433 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://app-nb.top/cartao.php HTTP 301
https://app-nb.top/cartao.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cartao.php Show response app-nb.top/ Redirect Chain http://app-nb.top/cartao.php https://app-nb.top/cartao.php	142 KB 20 KB	2446ms 1959ms	Document text/html	2606:4700:3033::ac43:b43e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app-nb.top/cartao.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:b43e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4f3d1b91a42a4da63c9d5976618022809d9ba1f0ed32da83cda8401fc111f009` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 85aa6d1c6e28b914-AMS content-encoding br content-type text/html; charset=UTF-8 date Sat, 24 Feb 2024 20:23:26 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=77FJd3cPI6bwJz81AmyTfh5UsREyONz%2Bzmk3MGuJj%2ByuLX%2B9QHo7JFt%2FJsklWps3Y0T1Jfw91ZsM1nDMflk2%2F9cP0HkB5zqcLVU6H3vbRSXBgPyPYZlT6xaqzc6KWlDdGGFzvxBjxLjd"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers CF-RAY 85aa6d192a2066f7-AMS Cache-Control max-age=3600 Connection keep-alive Date Sat, 24 Feb 2024 20:23:24 GMT Expires Sat, 24 Feb 2024 21:23:24 GMT Location https://app-nb.top/cartao.php NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TZFv4%2F%2BArmeNMoDHNZYi%2BE2i1CPnx31R%2F0bO6TNBlBZlHYeh2o0YNXsn%2FlZaLaUfJa5hOEuO%2FjBabTtzXgXqQFjfXSYGpFHLh9GDsqm55AFm1TAPSUg0R8QfBgSg4vv8ae5DaAwiV0BU"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400
GET H2	200	new-mobile.css app-nb.top/cartao_files/	8 KB 2 KB	43ms 41ms	Stylesheet text/css	2606:4700:3033::ac43:b43e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app-nb.top/cartao_files/new-mobile.css Requested by Host: app-nb.top URL: https://app-nb.top/cartao.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:b43e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f843d15a311f014b06df14fe18ceb070b262383047548c4927c9874b5e50b555` Request headers accept-language de-DE,de;q=0.9 Referer https://app-nb.top/cartao.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:26 GMT content-encoding br cf-cache-status HIT last-modified Mon, 21 Feb 2022 20:04:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 14088 etag W/"6213f030-21be" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q2mZLYiZzXvtwzcQTdVIbCY%2BC7NSPudJ7PUurFsIfABxuqbhqoGdxVczSMtTV6CntwmqamTcKV6JtCiuVP9WfNAuCSxiBNhTF0u%2BvHjgRe4EECbnWW2pNh985ajPeyuunB%2BLBjNFHNhb"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=43200 cf-ray 85aa6d28bf66b914-AMS alt-svc h3=":443"; ma=86400 expires Sun, 25 Feb 2024 04:28:38 GMT
GET H2	200	css app-nb.top/cartao_files/	8 KB 9 KB	411ms 410ms	Stylesheet application/octet-stream	2606:4700:3033::ac43:b43e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app-nb.top/cartao_files/css Requested by Host: app-nb.top URL: https://app-nb.top/cartao.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:b43e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `233b4cb4b3602596802981a909427295118dc1ae0b7a5e7df3f74784a90b22a9` Request headers accept-language de-DE,de;q=0.9 Referer https://app-nb.top/cartao.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT cf-cache-status DYNAMIC last-modified Mon, 21 Feb 2022 20:04:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "6213f030-20f4" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0iBIuIq43hSwX8EHI1%2FaMV%2F4i0AwktxBzaURiLlhlqxkIh7tDKQmK1ZftWT0VJVgLYIlfHayrhegIt6jG0l587Pa%2FFx6LzLLMPdaklUeECwq1hgBsvkngiJgl%2FHaDuv0u1SLWjhewWHY"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream accept-ranges bytes cf-ray 85aa6d28bf69b914-AMS alt-svc h3=":443"; ma=86400 content-length 8436
GET H2	200	jquery.min.js.download Show response app-nb.top/cartao_files/	85 KB 85 KB	410ms 410ms	Script application/octet-stream	2606:4700:3033::ac43:b43e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app-nb.top/cartao_files/jquery.min.js.download Requested by Host: app-nb.top URL: https://app-nb.top/cartao.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:b43e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de` Request headers accept-language de-DE,de;q=0.9 Referer https://app-nb.top/cartao.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT cf-cache-status DYNAMIC last-modified Mon, 21 Feb 2022 20:04:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "6213f030-15391" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9R5NGVMkrrC7rfQJnEGO8CAf9zh3WVWR5kIMJ5%2Bsq0btfuj7tzRXRfuhqK54NPDnyQWeqeM4QMd7wusVFBcnvOyRV489xreXptfXkcFXqoZsRqURAirbpZy1h4Bu8qsrdtrFOMgZJX%2BE"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream accept-ranges bytes cf-ray 85aa6d28bf6bb914-AMS alt-svc h3=":443"; ma=86400 content-length 86929
GET H2	200	jquery.mask.js.download Show response app-nb.top/cartao_files/	6 KB 6 KB	412ms 411ms	Script application/octet-stream	2606:4700:3033::ac43:b43e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app-nb.top/cartao_files/jquery.mask.js.download Requested by Host: app-nb.top URL: https://app-nb.top/cartao.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:b43e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e28402acf82dc0bbd4cb1cbd1bca97cbee7d8862d828a31d256a8821eca5b299` Request headers accept-language de-DE,de;q=0.9 Referer https://app-nb.top/cartao.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT cf-cache-status DYNAMIC last-modified Mon, 21 Feb 2022 20:04:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "6213f030-18bd" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ktzbr3jsw3gJuU5B%2Bqzk4rxjoUfogPqjTeTxhkbQyOn4XEozuoxP3GnRQ679hQcraHFDxV5WyQpE2ywTVv0GfeCXgN3%2FE6CyiKgwQUjvLpIznMCXcEB9RtP%2F1%2FqRCRtwCWGqrTLEblBt"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream accept-ranges bytes cf-ray 85aa6d28bf6db914-AMS alt-svc h3=":443"; ma=86400 content-length 6333
GET H2	200	eb32f84b17.js.download Show response app-nb.top/cartao_files/	11 KB 11 KB	416ms 416ms	Script application/octet-stream	2606:4700:3033::ac43:b43e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app-nb.top/cartao_files/eb32f84b17.js.download Requested by Host: app-nb.top URL: https://app-nb.top/cartao.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:b43e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `14342dd2b960f5005eb7976420e312661a7ab1bc080350eebd06b227000bc483` Request headers Referer https://app-nb.top/cartao.php Origin https://app-nb.top accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT cf-cache-status DYNAMIC last-modified Mon, 21 Feb 2022 20:04:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "6213f030-2b11" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3zwpM1T7K6MzEN8ECBlSAyhwc6X32FesQhux8jLDeqo%2BS0A6Q6IStQMcVXOibtc4Na746I%2Bdlzvr2F19hsyJxemcmMeUUCtOAcCSiN0uiZ7KaMPYdAsFsyzAVdg3WSlSiOi5BpM3bJqq"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream accept-ranges bytes cf-ray 85aa6d28bf6fb914-AMS alt-svc h3=":443"; ma=86400 content-length 11025
GET H2	200	geral.js.download Show response app-nb.top/cartao_files/	2 KB 3 KB	225ms 224ms	Script application/octet-stream	2606:4700:3033::ac43:b43e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app-nb.top/cartao_files/geral.js.download Requested by Host: app-nb.top URL: https://app-nb.top/cartao.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:b43e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3aedc2533e559e8b093cdb8d6d457926d551ac0297317fbfdaed09f92726e795` Request headers accept-language de-DE,de;q=0.9 Referer https://app-nb.top/cartao.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT cf-cache-status DYNAMIC last-modified Mon, 21 Feb 2022 20:04:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "6213f030-953" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c%2FYXne%2FDGscg2HdSCDTR6TRA8%2BMELHcG0VBF77tv%2BZcu3IzMu1a1xJq72E76E0GymqSbXOAab3mue4meVppDyPEp8DXXVuRsesEz3yCWVBdYIWqgqNfM1l0gvlXBwMTV8R9t%2BYQc1zbK"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream accept-ranges bytes cf-ray 85aa6d29d94cb914-AMS alt-svc h3=":443"; ma=86400 content-length 2387
GET H2	200	logo-web.png app-nb.top/cartao_files/	6 KB 6 KB	38ms 38ms	Image image/png	2606:4700:3033::ac43:b43e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://app-nb.top/cartao_files/logo-web.png Requested by Host: app-nb.top URL: https://app-nb.top/cartao.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:b43e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `db578265e59fc9144ec8c0886037f1fd2fa9a8b19ec73e19609ebfcf5ebfa3cf` Request headers accept-language de-DE,de;q=0.9 Referer https://app-nb.top/cartao.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 12308 alt-svc h3=":443"; ma=86400 content-length 6275 last-modified Mon, 21 Feb 2022 20:04:00 GMT server cloudflare etag "6213f030-1883" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pikYSJXjhXFnWWq2QX5ZBZVYnY72wF8dBPpB2cvYqyZlQyqpUf1PJzc4KigKavUaoAGADPxD2JFXRRj2Jm1Wz85dOGpyUuinwR1PiiLdMPC9OI6HFiw8%2BcPWVS2M0kMlA2D%2FK12RhaM0"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 85aa6d29d950b914-AMS expires Mon, 25 Mar 2024 16:58:19 GMT
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	59 KB 13 KB	212ms 97ms	Fetch text/css	2606:4700:e2::ac40:8007 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=eb32f84b17 Requested by Host: app-nb.top URL: https://app-nb.top/cartao_files/eb32f84b17.js.download Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8007 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda` Request headers accept-language de-DE,de;q=0.9 Referer https://app-nb.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT via 1.1 8b20ff9a1799265d378bf510ac3db6de.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop CDG52-P2 age 12307 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qu0S8p0l8C4rNXlQRmMvxMvgNG5Zr7ug%2BXknss8%2FczUPPsA6gMWjaNc0JbSkDO4Mzaa7Dd2czvpXtPwdOSiS0LCTacoAK4bjQErvRGnsybBllSIIPNXJUUwvfPZJLrnKPFhs19K8I%2BDK7Wla63ihPv2YGg%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 85aa6d2e68606979-CDG access-control-allow-headers fa-kit-token x-amz-cf-id X3EYGBlAiK78T2tHgTg_HowiUrU1l1kon6eEG42H6sEbvsIX5b3yqw==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	26 KB 5 KB	211ms 97ms	Fetch text/css	2606:4700:e2::ac40:8007 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=eb32f84b17 Requested by Host: app-nb.top URL: https://app-nb.top/cartao_files/eb32f84b17.js.download Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8007 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8` Request headers accept-language de-DE,de;q=0.9 Referer https://app-nb.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT via 1.1 aaa5fbd869d655f42986dd16509f667e.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop CDG52-P2 age 12307 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"76f34b71fc9fb641507ff6a822cc07f5" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FPAa3B88HJ1lkWeWL95YkPCuLBAeigScbglvLWmfqUefRD%2BXpLqISUA5vR2xTqf7tpPvOJdXeUUs3R0nTdTrHaOhbkDlviqHVnSSnltDNOyTxqpk4P4guWAVRFtL%2BveK6I%2Bco%2B5%2Bb0xABSXlUPTyzdce9g%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 85aa6d2e68616979-CDG access-control-allow-headers fa-kit-token x-amz-cf-id hH0Ya_fvpNBqaSAo20eFM5BkiBXWEuB7q-0ogOyD-Ve6mGgaOU9n3g==
GET H2	200	free-v4-font-face.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	3 KB 1 KB	211ms 97ms	Fetch text/css	2606:4700:e2::ac40:8007 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-font-face.min.css?token=eb32f84b17 Requested by Host: app-nb.top URL: https://app-nb.top/cartao_files/eb32f84b17.js.download Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8007 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6` Request headers accept-language de-DE,de;q=0.9 Referer https://app-nb.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT via 1.1 aaa5fbd869d655f42986dd16509f667e.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop CDG52-P2 age 12307 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"f2e0b2680d9b0bcb6e0039c4424e5a59" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6nNrwhRfHbP4uhDElbkD3HE0e11XPG6mlSoYzfpOyTnuteHlI9FIxTw7bX9Ua%2BcOdgz7Gsd8XF1XK6kT0IKVsz3R7sd4PPJ9Xsl9p8J2T6m10u7L%2F3JuVHN5PNzQchstYjupg0z%2B01%2B4fI0rsRHZmW%2F%2Beg%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 85aa6d2e68626979-CDG access-control-allow-headers fa-kit-token x-amz-cf-id d_t_YrA_lYzTbjqiGyDqOsDqtge8J9hiT5uUOqqccyFBskQFbvpLPA==
GET H2	200	free-fa-solid-900.woff2 ka-f.fontawesome.com/releases/v5.15.4/webfonts/	76 KB 77 KB	160ms 55ms	Font font/woff2	2606:4700:e2::ac40:8007 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2 Requested by Host: app-nb.top URL: https://app-nb.top/cartao.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8007 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7` Request headers Referer https://app-nb.top/ Origin https://app-nb.top accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:23:27 GMT via 1.1 e5b75c92aeb08b72d17d5fe9dd0647e0.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop CDG52-P2 age 12307 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 content-length 78168 last-modified Wed, 04 Aug 2021 18:58:24 GMT server cloudflare etag "a9fd1225fb2cd32320e2b931dca01089" access-control-max-age 3000 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EF8N7lDQw80WF2mIkzCw5yAP%2Fxkn3FAT4hDtaKNe7Gc%2BNXXsO1%2BGS%2B9ZhRcY7BpnoKEMn3UWwzd12YSsXSR2%2Fky61CDkkahYVOM3lub8WjkkY%2FjuyFL9eQz5GwnIms27JtTC0dUr1bnRV3JItAXfaeosXQ%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding accept-ranges bytes cf-ray 85aa6d2e685f6979-CDG access-control-allow-headers fa-kit-token x-amz-cf-id kujzROXCYue-OjeYc0ZPOquPWtRXLZmVbhxxrTGxIGNUDAIK4iRTZg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Novobanco (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			app-nb.top/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2a0ffa0ah6r34ih0hbavq0jioh

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app-nb.top
ka-f.fontawesome.com
2606:4700:3033::ac43:b43e
2606:4700:e2::ac40:8007
14342dd2b960f5005eb7976420e312661a7ab1bc080350eebd06b227000bc483
233b4cb4b3602596802981a909427295118dc1ae0b7a5e7df3f74784a90b22a9
3aedc2533e559e8b093cdb8d6d457926d551ac0297317fbfdaed09f92726e795
4f3d1b91a42a4da63c9d5976618022809d9ba1f0ed32da83cda8401fc111f009
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7
db578265e59fc9144ec8c0886037f1fd2fa9a8b19ec73e19609ebfcf5ebfa3cf
e28402acf82dc0bbd4cb1cbd1bca97cbee7d8862d828a31d256a8821eca5b299
f843d15a311f014b06df14fe18ceb070b262383047548c4927c9874b5e50b555
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

app-nb.top Open in urlscan Pro 2606:4700:3033::ac43:b43e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

239 kBTransfer

433 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

app-nb.top Open in urlscan Pro
2606:4700:3033::ac43:b43e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

239 kB
Transfer

433 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!