urlscan.io logo urlscan.io
SecurityTrails logo

cliente.liveloresgatecashback.org Open in urlscan Pro
2a06:98c1:3120::3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.portallivelo.com/
Effective URL: https://cliente.liveloresgatecashback.org/login
Submission: On August 21 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 4 countries across 7 domains to perform 17 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is cliente.liveloresgatecashback.org.
TLS certificate: Issued by E1 on August 19th 2023. Valid for: 3 months.
This is the only time cliente.liveloresgatecashback.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Livelo (E-commerce)

Domain & IP information

IP Address AS Autonomous System
1 1 198.251.84.92 53667 (PONYNET)
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 7 2a06:98c1:312... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 52.222.149.81 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 18.164.52.73 16509 (AMAZON-02)
1 52.213.98.96 16509 (AMAZON-02)
1 99.81.175.145 16509 (AMAZON-02)
17 8
1    198.251.84.92 (Luxembourg, Luxembourg)

ASN53667 (PONYNET, US)
PTR: parking.namesilo.com
www.portallivelo.com
1    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
cliente.liveloresgatecashback.org
7    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
cliente.liveloresgatecashback.org
2    2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    52.222.149.81 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-149-81.cdg52.r.cloudfront.net
static.hotjar.com
1    2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    18.164.52.73 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-52-73.cdg50.r.cloudfront.net
script.hotjar.com
1    52.213.98.96 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-98-96.eu-west-1.compute.amazonaws.com
content.hotjar.io
1    99.81.175.145 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-175-145.eu-west-1.compute.amazonaws.com
metrics.hotjar.io
Apex Domain
Subdomains		 Transfer
8 liveloresgatecashback.org
cliente.liveloresgatecashback.org
114 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 991
script.hotjar.com — Cisco Umbrella Rank: 1166
62 KB
2 hotjar.io
content.hotjar.io — Cisco Umbrella Rank: 6929
metrics.hotjar.io — Cisco Umbrella Rank: 10747
231 B
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 73
1 KB
1 gstatic.com
fonts.gstatic.com
24 KB
1 portallivelo.com
www.portallivelo.com
209 B
0 rico-com-vc.com Failed
socketio.rico-com-vc.com Failed
17 7
Domain Requested by
8 cliente.liveloresgatecashback.org 2 redirects cliente.liveloresgatecashback.org
2 script.hotjar.com static.hotjar.com
script.hotjar.com
2 fonts.googleapis.com cliente.liveloresgatecashback.org
1 metrics.hotjar.io static.hotjar.com
1 content.hotjar.io script.hotjar.com
1 fonts.gstatic.com fonts.googleapis.com
1 static.hotjar.com cliente.liveloresgatecashback.org
1 www.portallivelo.com 1 redirects
0 socketio.rico-com-vc.com Failed cliente.liveloresgatecashback.org
17 9

This site contains no links.

Subject Issuer Validity Valid
liveloresgatecashback.org
E1		 2023-08-19 -
2023-11-17		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-07-31 -
2023-10-23		 3 months crt.sh
*.hotjar.com
Amazon ECDSA 256 M01		 2023-03-09 -
2024-04-06		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-07-31 -
2023-10-23		 3 months crt.sh
*.hotjar.io
Amazon ECDSA 256 M02		 2023-03-02 -
2024-03-30		 a year crt.sh

This page contains 1 frames:

Primary Page: https://cliente.liveloresgatecashback.org/login
Frame ID: 7FE86E7E34D068A61AB7D6A71887BA2E
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Banco do Brasil

Page URL History Show full URLs

  1. http://www.portallivelo.com/ HTTP 302
    http://cliente.liveloresgatecashback.org/ HTTP 301
    https://cliente.liveloresgatecashback.org/ HTTP 302
    https://cliente.liveloresgatecashback.org/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Page Statistics

17
Requests

82 %
HTTPS

44 %
IPv6

7
Domains

9
Subdomains

8
IPs

4
Countries

200 kB
Transfer

637 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.portallivelo.com/ HTTP 302
    http://cliente.liveloresgatecashback.org/ HTTP 301
    https://cliente.liveloresgatecashback.org/ HTTP 302
    https://cliente.liveloresgatecashback.org/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
cliente.liveloresgatecashback.org/
Redirect Chain
  • http://www.portallivelo.com/
  • http://cliente.liveloresgatecashback.org/
  • https://cliente.liveloresgatecashback.org/
  • https://cliente.liveloresgatecashback.org/login
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cliente.liveloresgatecashback.org/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7beafe985f12f9e5ffba68ae870cf307f35c1977fd0a7cd6b0d4cefb298f5bbe

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7fa5340f9fc91952-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 21 Aug 2023 19:15:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m4g%2BfT7mIVTRzJHTffkjSU1Gk1kihE0Q19f8YKFleNF0h8BUCKKUTeO8rorpm5ePK9uy7nlySbe8Cm5XeE0FvS30XmDCWiRw3RoM6sDOSOxqfDnEMmFWnHOxFQoJEjkMZCqDoQVtt3TxHSs2Ch1EucMeUNzUF%2BZcZs6ufPCNJNk%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7fa5340cdb0f1952-FRA
content-type
text/html; charset=utf-8
date
Mon, 21 Aug 2023 19:15:11 GMT
location
https://cliente.liveloresgatecashback.org/login
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rVhqvwVuacOU2kuZt%2FjA35b9mjqTBszd7th7XzTi%2FCOCiWPQdPCxK2%2F67hwqFmfee6SvcSwZQRHP8P2PPhT20y6iI541s%2FboO2C5bMH5wIDOIN4LMW%2BTEDrEXY7cNMHBdP2uFOk5lxnZYojLAYmhXPCILn8tMNvUSuvvBjtzQNU%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
main-v3.css
cliente.liveloresgatecashback.org/assets/ 		117 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cliente.liveloresgatecashback.org/assets/main-v3.css
Requested by
Host: cliente.liveloresgatecashback.org
URL: https://cliente.liveloresgatecashback.org/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ddbf71ea35869e31a10765b6aa3830af4955e3ebef675f41580fed1af0ec60a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.liveloresgatecashback.org/login
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 21 Aug 2023 19:15:12 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Sun, 16 Jul 2023 18:07:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=btO3ya5deOsHHqHPpTLrd%2Fp3KZh6oUJHuCRORRn3UO7zg4mpJ8EMnPKXRph5UhfBvgBMkDjNz6dHvW54i6DyYoH4o425eujntJZK3dGBhzEOY1UWqrSk9%2FKkyIFclgimCxvioKtUlTn1pQxf3aHpQVoFW0Y4%2Bk76q8kQX9leG00%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=main-v3.css
cf-ray
7fa5340ffa2d9176-FRA
alt-svc
h3=":443"; ma=86400
app2.js
cliente.liveloresgatecashback.org/assets/ 		207 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cliente.liveloresgatecashback.org/assets/app2.js
Requested by
Host: cliente.liveloresgatecashback.org
URL: https://cliente.liveloresgatecashback.org/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bd3a3357e1ae9e2a0e94f6c6aeee2fe7f6ea2937226647a30b0f1fd53b1f02b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.liveloresgatecashback.org/login
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 21 Aug 2023 19:15:12 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Wed, 16 Aug 2023 15:48:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ixh8dKSnu2A5min1iDIgolt5k2kO1LuHShIjKzKj4EQuUGqDLTSQn5RXKLukE3O4aVL5s73A%2BE0465sWSlmslcVJVxkLigFXhBv2r%2BnYwEnjJ0nVRyG1pcCGardDgQPu0xVYe0IvFa9ZeNhsLZs%2BjHUOP9hFJCeQDvkSCHZqj48%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=app2.js
cf-ray
7fa5340ffa2e9176-FRA
alt-svc
h3=":443"; ma=86400
logo-livelo.svg
cliente.liveloresgatecashback.org/assets/bblivelo/v3/ 		5 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cliente.liveloresgatecashback.org/assets/bblivelo/v3/logo-livelo.svg
Requested by
Host: cliente.liveloresgatecashback.org
URL: https://cliente.liveloresgatecashback.org/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a93839a2c1e9457a6a66474a128ae6221798e5fec089c172e8160b592584dd93

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.liveloresgatecashback.org/login
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 21 Aug 2023 19:15:12 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Sun, 16 Jul 2023 18:07:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qz1WxwAiJGdnEogI8R%2Bccl%2BK3czkgTWOvK7cGqa3yQFwVBz8nd86IxpscDgietoycaS92Lg81z4rZ60o0evCbK58DRtzgJ0abfnqVFpYnjaM4IL6hBFvrkk0JXLzHhK2KeIMiNS6LZdiWem7xmJ88HGbBCMjCUQOvglxavHpVjM%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=logo-livelo.svg
cf-ray
7fa534106ae39176-FRA
alt-svc
h3=":443"; ma=86400
logo-bb.svg
cliente.liveloresgatecashback.org/assets/bblivelo/v3/ 		803 B
1012 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cliente.liveloresgatecashback.org/assets/bblivelo/v3/logo-bb.svg
Requested by
Host: cliente.liveloresgatecashback.org
URL: https://cliente.liveloresgatecashback.org/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3becca4e7dd1d0511eabf978dfb1bd8aa48a1b18a31e70fe376a3ccf8d20189a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.liveloresgatecashback.org/login
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 21 Aug 2023 19:15:12 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Sun, 16 Jul 2023 18:07:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SUP%2BGjASl36tRR5Hk6oopaS6DaVqvw%2FQtODHOYUa0tFa89RYWfS6jubuVPbvRBzYOULZiAPtfEQaZx80It7PhX3FQjwSOdzu88v49ZkT5yD4duq13TPBg7ZispYUwUtHoY5%2BVPdfXj2GjoFQ8w%2BKVrtNGtarGCLtENWy9E2LWnU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=logo-bb.svg
cf-ray
7fa53410fbb89176-FRA
alt-svc
h3=":443"; ma=86400
css2
fonts.googleapis.com/ 		2 KB
637 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto&display=swap
Requested by
Host: cliente.liveloresgatecashback.org
URL: https://cliente.liveloresgatecashback.org/assets/main-v3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d09238914760e8ca19a68cdebf15a4d7c39c68af1f94ad3325ef7c39e27c2d45
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.liveloresgatecashback.org/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security
max-age=31536000
date
Mon, 21 Aug 2023 19:15:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 21 Aug 2023 19:15:12 GMT
css2
fonts.googleapis.com/ 		1 KB
782 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Signika&display=swap
Requested by
Host: cliente.liveloresgatecashback.org
URL: https://cliente.liveloresgatecashback.org/assets/main-v3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2f29527072cf570bf1deb502c4388f9f26e655fcbe93d51d32095c92fbe511dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.liveloresgatecashback.org/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security
max-age=31536000
date
Mon, 21 Aug 2023 19:15:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 21 Aug 2023 19:15:12 GMT
/
socketio.rico-com-vc.com/socket.io/ 		0
0
hotjar-2680142.js
static.hotjar.com/c/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-2680142.js?sv=6
Requested by
Host: cliente.liveloresgatecashback.org
URL: https://cliente.liveloresgatecashback.org/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.149.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-149-81.cdg52.r.cloudfront.net
Software
/
Resource Hash
7d6ac42a7183aef897df8d719df819ad79a96eddac36eedfba4ee70b9278af8b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.liveloresgatecashback.org/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Mon, 21 Aug 2023 19:15:12 GMT
via
1.1 a6e02469f8cbbfee9635eadf6e97ee54.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG52-P1
etag
W/ec42542d7d295dda5309c0aa7b4d9094
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
cross-origin-resource-policy
cross-origin
x-amz-cf-id
M3EO2m22_KWUJCc1hEcs_vUU7UCWR_CgWYXsskj46Jv0x7fAmPMcCA==
vEF72_JTCgwQ5ejvMV0Ox_Kg1UwJ0tKfX4zNpD8E4ASzH1r9gTuoyjkmoN0hjg.woff2
fonts.gstatic.com/s/signika/v25/ 		23 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/signika/v25/vEF72_JTCgwQ5ejvMV0Ox_Kg1UwJ0tKfX4zNpD8E4ASzH1r9gTuoyjkmoN0hjg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Signika&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b82537792420596f2f384b01727d799c56a0064d55807810cb3b002d649822b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://cliente.liveloresgatecashback.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Sat, 19 Aug 2023 08:58:31 GMT
x-content-type-options
nosniff
age
209801
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23804
x-xss-protection
0
last-modified
Thu, 20 Jul 2023 20:47:19 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 18 Aug 2024 08:58:31 GMT
geomanist_medium.otf
cliente.liveloresgatecashback.org/assets/bbrasil/fonts/ 		38 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cliente.liveloresgatecashback.org/assets/bbrasil/fonts/geomanist_medium.otf
Requested by
Host: cliente.liveloresgatecashback.org
URL: https://cliente.liveloresgatecashback.org/assets/main-v3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
384760ed855d8a9f5c3e5f3e6e83dff6e50b69384d46001693f23bc32b57fd98

Request headers

Referer
https://cliente.liveloresgatecashback.org/assets/main-v3.css
Origin
https://cliente.liveloresgatecashback.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 21 Aug 2023 19:15:12 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Sun, 16 Jul 2023 18:07:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vTG8%2FcCoVLMG8r3yc8UKwAKwXp33tljBHK7Skc2oUhzx7OZ0rzMFr3%2FBCYdXougiR16fcL1V5qy0QBb6n7do%2FmvRcvuSac33HsfgscPx5MYHxs8r18kQBtqZIb%2BxEwCZgBDi2fTdgeOE20xVsp3i8Kw70O%2FqS21M7LkKvjEOOMY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-sfnt
access-control-allow-origin
https://cliente.liveloresgatecashback.org
cache-control
no-cache
content-disposition
inline; filename=geomanist_medium.otf
cf-ray
7fa534113c159176-FRA
alt-svc
h3=":443"; ma=86400
modules.b2c67271bc39c80bf49b.js
script.hotjar.com/ 		223 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.b2c67271bc39c80bf49b.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2680142.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-73.cdg50.r.cloudfront.net
Software
/
Resource Hash
2b02e9de991d275184da0ca9bb8fa0a03e04f25a20d4c1145e55a590aed09fd2
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.liveloresgatecashback.org/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 21 Aug 2023 09:17:06 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 c1b64e986e19699994a84686a601b624.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG50-P4
age
35886
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
55645
last-modified
Mon, 21 Aug 2023 09:16:38 GMT
etag
"674ca8f715ef21c2b8845405fb296155"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
phjDjKZ1Necw-7uGQcCUPQlLDPBVbp3xiisxUuNmzjNvsXbXxtcazg==
browser-perf.1c7ecd2be12644b9e658.js
script.hotjar.com/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/browser-perf.1c7ecd2be12644b9e658.js
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.b2c67271bc39c80bf49b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-73.cdg50.r.cloudfront.net
Software
/
Resource Hash
37c5396a8f8c91466be1ab221bf6f86330013f0ce91cec575b8d9163b517da68
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cliente.liveloresgatecashback.org/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 18 Aug 2023 09:10:36 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 c1b64e986e19699994a84686a601b624.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG50-P4
age
295476
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2011
last-modified
Fri, 18 Aug 2023 09:05:29 GMT
etag
"45a46deaac94afc7df5a17fb8b1a8233"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
B94mLfZotn2mfa4Ej2lSCvGx_sA5ICWwndJvfroH0B_dCXSbQv1mVw==
/
content.hotjar.io/ 		56 B
161 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://content.hotjar.io/?gzip=1
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.b2c67271bc39c80bf49b.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.213.98.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-98-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a56f0b467dbef28d06719af5fcd58dff572e5de4cd3fe71c4e439727bbc53622

Request headers

Referer
https://cliente.liveloresgatecashback.org/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type
text/plain; charset=UTF-8

Response headers

access-control-allow-origin
*
date
Mon, 21 Aug 2023 19:15:12 GMT
content-length
56
vary
Origin
content-type
application/json
/
socketio.rico-com-vc.com/socket.io/ 		0
0
/
metrics.hotjar.io/ 		0
70 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://metrics.hotjar.io/?v=5
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2680142.js?sv=6
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
99.81.175.145 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-175-145.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://cliente.liveloresgatecashback.org/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Mon, 21 Aug 2023 19:15:15 GMT
vary
Origin
/
socketio.rico-com-vc.com/socket.io/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
socketio.rico-com-vc.com
URL
https://socketio.rico-com-vc.com/socket.io/?EIO=4&transport=polling&t=OePXSQm
Domain
socketio.rico-com-vc.com
URL
https://socketio.rico-com-vc.com/socket.io/?EIO=4&transport=polling&t=OePXSjW
Domain
socketio.rico-com-vc.com
URL
https://socketio.rico-com-vc.com/socket.io/?EIO=4&transport=polling&t=OePXTLV

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Livelo (E-commerce)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| jQuery function| $ object| alertify function| foneparse object| valid function| init function| calculaDigitoMod11 object| formData function| mostraDialogo function| proximoCampo function| resizeImages function| resizeInCanvas function| hj object| _hjSettings function| helpBlock function| validPhone function| loadPage function| showLoad function| hideLoad object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules

6 Cookies

Domain/Path Name / Value
cliente.liveloresgatecashback.org/ Name: session
Value: d326a52c-e006-4fe4-a4fa-9ffdfdbe5636
.liveloresgatecashback.org/ Name: _hjSessionUser_2680142
Value: eyJpZCI6IjBiY2IxNWMyLWE1YmItNWE2NS04Yjk4LTc1MDBmMDllZTE2YiIsImNyZWF0ZWQiOjE2OTI2NDUzMTI1NjUsImV4aXN0aW5nIjpmYWxzZX0=
.liveloresgatecashback.org/ Name: _hjFirstSeen
Value: 1
.liveloresgatecashback.org/ Name: _hjIncludedInSessionSample_2680142
Value: 1
.liveloresgatecashback.org/ Name: _hjSession_2680142
Value: eyJpZCI6IjI4YzE0OWEyLWNiYzYtNGRjZS05NzVjLThiYmViYzI0N2JlOSIsImNyZWF0ZWQiOjE2OTI2NDUzMTI1NzEsImluU2FtcGxlIjp0cnVlfQ==
.liveloresgatecashback.org/ Name: _hjAbsoluteSessionInProgress
Value: 0

6 Console Messages

Source Level URL
Text
javascript error URL: https://cliente.liveloresgatecashback.org/login
Message:
Access to XMLHttpRequest at 'https://socketio.rico-com-vc.com/socket.io/?EIO=4&transport=polling&t=OePXSQm' from origin 'https://cliente.liveloresgatecashback.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://socketio.rico-com-vc.com/socket.io/?EIO=4&transport=polling&t=OePXSQm
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://cliente.liveloresgatecashback.org/login
Message:
Access to XMLHttpRequest at 'https://socketio.rico-com-vc.com/socket.io/?EIO=4&transport=polling&t=OePXSjW' from origin 'https://cliente.liveloresgatecashback.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://socketio.rico-com-vc.com/socket.io/?EIO=4&transport=polling&t=OePXSjW
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://cliente.liveloresgatecashback.org/login
Message:
Access to XMLHttpRequest at 'https://socketio.rico-com-vc.com/socket.io/?EIO=4&transport=polling&t=OePXTLV' from origin 'https://cliente.liveloresgatecashback.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://socketio.rico-com-vc.com/socket.io/?EIO=4&transport=polling&t=OePXTLV
Message:
Failed to load resource: net::ERR_FAILED