desconto-na-fatura.com Open in urlscan Pro
2606:4700:3034::681f:4536  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request parabens.htm Show response desconto-na-fatura.com/	1 KB 1 KB	480ms 456ms	Document text/html	2606:4700:3034::681f:4536 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://desconto-na-fatura.com/parabens.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::681f:4536 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0d21977dd0576eb386d6d33c2201d82d0d247818a37b2e9a2bd0b734206a9953 Request headers :method GET :authority desconto-na-fatura.com :scheme https :path /parabens.htm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Dec 2020 15:01:57 GMT content-type text/html set-cookie __cfduid=d18a3b06c06e9eaad841ebaf8b4ecdd261608130917; expires=Fri, 15-Jan-21 15:01:57 GMT; path=/; domain=.desconto-na-fatura.com; HttpOnly; SameSite=Lax; Secure last-modified Mon, 29 Oct 2018 20:04:52 GMT cf-cache-status DYNAMIC cf-request-id 070dab8b5800000eaf51256000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=whrJrUN2RSNfypAXy%2FkTLpMBY8%2B9IrVQhM3f7x3udq3rpAXf1xCZDhMSFjWACSR3I7Vq%2FDnTnu79DPCuzySCyNDCZAJO%2FEPxzHJW%2BYNPneR87RZjGlszQKEH%2FPQX1GQpb9%2BX"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 602948588fdb0eaf-FRA content-encoding br
GET H2	200	benef_compras_style.css desconto-na-fatura.com/parabens_arquivos/	2 KB 964 B	432ms 431ms	Stylesheet text/css	2606:4700:3034::681f:4536 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://desconto-na-fatura.com/parabens_arquivos/benef_compras_style.css Requested by Host: desconto-na-fatura.com URL: https://desconto-na-fatura.com/parabens.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::681f:4536 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash daba27c255f366b9c98e11bebae140afc1a52b68cbecaf1bd7342021acf81be2 Request headers Referer https://desconto-na-fatura.com/parabens.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Dec 2020 15:01:58 GMT content-encoding br cf-cache-status MISS last-modified Sun, 28 Oct 2018 05:27:22 GMT server cloudflare etag W/"874-5794334f82280" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=xrrgDj5q0NaX%2BEXUvOLWFWI0YuR7h%2FhV1f%2F9MWG641D9hH9xDtTph1A67MUj3PjgFHoVnMTKmzy9wh4ppnoucVyNNo65ogwztI%2B15OBMOdFFAteK47TCuhdePkH3YLowk4vi"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 6029485b7fb80eaf-FRA cf-request-id 070dab8d2700000eaf96326000000001
GET H2	200	img_logo.png desconto-na-fatura.com/parabens_arquivos/	3 KB 4 KB	27ms 26ms	Image image/png	2606:4700:3034::681f:4536 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://desconto-na-fatura.com/parabens_arquivos/img_logo.png Requested by Host: desconto-na-fatura.com URL: https://desconto-na-fatura.com/parabens.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::681f:4536 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 47dcffe92172b4e92928fe5660d916143f21c85e59fe22e8fd81bc2490d60cba Request headers Referer https://desconto-na-fatura.com/parabens.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Dec 2020 15:01:57 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 2474 content-length 3411 cf-request-id 070dab8d2800000eaf13aec000000001 last-modified Sun, 28 Oct 2018 05:27:22 GMT server cloudflare etag "d53-5794334f82280" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XiUZxwOBrJym2xN%2B%2FHm5NsRHh1%2B6NUAenspS9kF9PjPKrKlx2nCpqoM3OBwPEBRuVCZXE4C2mKWelEBeVQJy1W06lJUsk7P7RmWqEEB4lUE20WY6MesszuZ93%2BvQ5nE7hXNF"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 6029485b7fbc0eaf-FRA
GET H2	200	ic_checked2.png desconto-na-fatura.com/parabens_arquivos/	1 KB 1 KB	436ms 435ms	Image image/png	2606:4700:3034::681f:4536 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://desconto-na-fatura.com/parabens_arquivos/ic_checked2.png Requested by Host: desconto-na-fatura.com URL: https://desconto-na-fatura.com/parabens.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::681f:4536 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4557a840c07ba85b1c3b8833cc09d433297023bb0368eb4193365b5a3974d8f5 Request headers Referer https://desconto-na-fatura.com/parabens.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Dec 2020 15:01:58 GMT cf-cache-status MISS last-modified Sun, 28 Oct 2018 05:27:22 GMT server cloudflare etag "4b0-5794334f82280" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6IFc%2FUaBUIt%2BRkQrTjYIZy0Xhm0%2BQhNuTkVi3cwtrCKO%2FaEty%2F%2BbA0XVA0AYR8qMeqqfKeC598xasRUhDfwX5HJlo%2BgTfrSFcCUGLKbSAfUADT80NJ5ZXVSTr8%2B92%2B%2BVZZZm"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 6029485b7fbf0eaf-FRA content-length 1200 cf-request-id 070dab8d2800000eaf452a8000000001

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.desconto-na-fatura.com/	1970-01-19 15:25:22	Name: __cfduid Value: d18a3b06c06e9eaad841ebaf8b4ecdd261608130917

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

desconto-na-fatura.com
2606:4700:3034::681f:4536
0d21977dd0576eb386d6d33c2201d82d0d247818a37b2e9a2bd0b734206a9953
4557a840c07ba85b1c3b8833cc09d433297023bb0368eb4193365b5a3974d8f5
47dcffe92172b4e92928fe5660d916143f21c85e59fe22e8fd81bc2490d60cba
daba27c255f366b9c98e11bebae140afc1a52b68cbecaf1bd7342021acf81be2