login.inbe.digital Open in urlscan Pro
193.187.174.136 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://login.inbe.digital/novo/particulares/clients/login.php?verification#_
Effective URL:
https://login.inbe.digital/novo/particulares/clients/login.php?verification
Submission Tags: @phish_report
Submission: On July 15 via api (July 15th 2024, 12:38:16 pm UTC) from FI — Scanned from FR

Summary HTTP 9 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 193.187.174.136, located in Paris, France and belongs to AS56971 AS56971 Cloud, HK. The main domain is login.inbe.digital.
TLS certificate: Issued by E6 on July 12th 2024. Valid for: 3 months.

This is the only time login.inbe.digital was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Novobanco (Banking)

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
8	193.187.174.136 193.187.174.136	56971 (AS56971 A...) (AS56971 AS56971 Cloud)
1	172.67.72.144 172.67.72.144	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2

8 193.187.174.136 (Paris, France)

ASN56971 (AS56971 AS56971 Cloud, HK)

login.inbe.digital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.72.144 (United States)

ASN13335 (CLOUDFLARENET, US)

app.ardalio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	inbe.digital login.inbe.digital	641 KB
1	ardalio.com app.ardalio.com — Cisco Umbrella Rank: 136700	5 KB
9	2

	Domain	Requested by
8	login.inbe.digital	login.inbe.digital
1	app.ardalio.com	login.inbe.digital
9	2

This site contains links to these domains. Also see Links.

Domain
www.web-stat.com

Subject Issuer	Validity	Valid
inbe.digital E6	`2024-07-12` - `2024-10-10`	3 months	crt.sh
ardalio.com GTS CA 1P5	`2024-05-22` - `2024-08-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://login.inbe.digital/novo/particulares/clients/login.php?verification
Frame ID: 747D7EE8058E2BE3CE1B9DAA4A284301
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login novobanco Online | novobanco

Page URL History Show full URLs

http://login.inbe.digital/novo/particulares/clients/login.php?verification HTTP 307
https://login.inbe.digital/novo/particulares/clients/login.php?verification Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

646 kB
Transfer

1538 kB
Size

7
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.web-stat.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://login.inbe.digital/novo/particulares/clients/login.php?verification HTTP 307
https://login.inbe.digital/novo/particulares/clients/login.php?verification Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request login.php Show response
login.inbe.digital/novo/particulares/clients/
Redirect Chain

http://login.inbe.digital/novo/particulares/clients/login.php?verification
https://login.inbe.digital/novo/particulares/clients/login.php?verification

89 KB
17 KB

766ms
31ms

Document
text/html

193.187.174.136
AS56971 AS56971 C...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.inbe.digital/novo/particulares/clients/login.php?verification
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 193.187.174.136 Paris, France, ASN56971 (AS56971 AS56971 Cloud, HK),
Reverse DNS
Software: Apache/2.4.61 (Debian) /
Resource Hash: 02b6c461b4cdac4d9ed9185c4895a0314aafc70fb066e2313a4c969cee692094

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 16834
Content-Type: text/html; charset=UTF-8
Date: Mon, 15 Jul 2024 12:38:11 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.61 (Debian)
Vary: Accept-Encoding

Redirect headers

Location: https://login.inbe.digital/novo/particulares/clients/login.php?verification#_
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css
login.inbe.digital/novo/particulares/clients/css/ 905 KB
83 KB 41ms
40ms Stylesheet
text/css 193.187.174.136
AS56971 AS56971 C...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.inbe.digital/novo/particulares/clients/css/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css
Requested by: Host: login.inbe.digital
URL: https://login.inbe.digital/novo/particulares/clients/login.php?verification
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 193.187.174.136 Paris, France, ASN56971 (AS56971 AS56971 Cloud, HK),
Reverse DNS
Software: Apache/2.4.61 (Debian) /
Resource Hash: bd729072db6b7a92ef9d5813c81e434ec7f4ec48fcb3a7ac286f7ae4994cad68

Request headers

Referer: https://login.inbe.digital/novo/particulares/clients/login.php?verification
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Mon, 15 Jul 2024 12:38:11 GMT
Content-Encoding: gzip
Last-Modified: Mon, 27 Dec 2021 20:32:22 GMT
Server: Apache/2.4.61 (Debian)
ETag: "e2541-5d4269a0de180-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99

GET
H3 200 2149456.png
app.ardalio.com/7/1/ 4 KB
5 KB 209ms
161ms Image
image/png 172.67.72.144
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://app.ardalio.com/7/1/2149456.png

Requested by

Host: login.inbe.digital
URL: https://login.inbe.digital/novo/particulares/clients/login.php?verification

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.72.144 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e10b56b2442006f3a22ba1d20113f3f3d5882542f2e0dc677cc3c89efbdf5ad4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Referer: https://login.inbe.digital/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 15 Jul 2024 12:38:11 GMT
content-encoding: gzip
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9OiAqc2FKFsozmaZM%2F3q%2BS0jo3kuVSBFcQBFT4RVOCP3kEqebIQG4RsBXrTB4i9GikhwVZKXslNZ7f6dwVRsQK%2F5QgBoHM5pCz9E7emirZJ2s%2B3qT56xc0wVJOUIxDClng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: no-store
cf-ray: 8a39cedffcf86ee1-CDG
alt-svc: h3=":443"; ma=86400
content-length: 4359

GET
H/1.1 200
OK novobanco-icons.svg
login.inbe.digital/novo/particulares/clients/css/ 61 KB
62 KB 66ms
21ms Other
image/svg+xml 193.187.174.136
AS56971 AS56971 C...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.inbe.digital/novo/particulares/clients/css/novobanco-icons.svg
Requested by: Host: login.inbe.digital
URL: https://login.inbe.digital/novo/particulares/clients/login.php?verification
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 193.187.174.136 Paris, France, ASN56971 (AS56971 AS56971 Cloud, HK),
Reverse DNS
Software: Apache/2.4.61 (Debian) /
Resource Hash: 7a7c300249d7ebe0d8419609fdae3953325a9b51548c88be622665a1bdd6ce6d

Request headers

Referer: https://login.inbe.digital/novo/particulares/clients/login.php?verification
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Mon, 15 Jul 2024 12:38:11 GMT
Last-Modified: Mon, 27 Dec 2021 20:33:38 GMT
Server: Apache/2.4.61 (Debian)
ETag: "f585-5d4269e958c80"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 62853

GET
H/1.1 200
OK cq5dam.web.1280.1280.jpeg
login.inbe.digital/novo/particulares/clients/css/ 463 KB
463 KB 65ms
25ms Image
image/jpeg 193.187.174.136
AS56971 AS56971 C...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.inbe.digital/novo/particulares/clients/css/cq5dam.web.1280.1280.jpeg
Requested by: Host: login.inbe.digital
URL: https://login.inbe.digital/novo/particulares/clients/login.php?verification
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 193.187.174.136 Paris, France, ASN56971 (AS56971 AS56971 Cloud, HK),
Reverse DNS
Software: Apache/2.4.61 (Debian) /
Resource Hash: 50b1758f17eca066d3c2e147a55c41368d67697adaee7c97f3c3d7706ac00393

Request headers

Referer: https://login.inbe.digital/novo/particulares/clients/login.php?verification
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Mon, 15 Jul 2024 12:38:11 GMT
Last-Modified: Mon, 27 Dec 2021 20:32:38 GMT
Server: Apache/2.4.61 (Debian)
ETag: "73be7-5d4269b020580"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 474087

GET
H/1.1 404
Not Found NovobancoText-Book.woff
login.inbe.digital/novo/particulares/clients/css/clientlib-resources/resources/fonts/ 0
0 22ms
21ms Font
text/html 193.187.174.136
AS56971 AS56971 C...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.inbe.digital/novo/particulares/clients/css/clientlib-resources/resources/fonts/NovobancoText-Book.woff
Requested by: Host: login.inbe.digital
URL: https://login.inbe.digital/novo/particulares/clients/css/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 193.187.174.136 Paris, France, ASN56971 (AS56971 AS56971 Cloud, HK),
Reverse DNS
Software: Apache/2.4.61 (Debian) /
Resource Hash

Request headers

Referer: https://login.inbe.digital/novo/particulares/clients/css/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css
Origin: https://login.inbe.digital
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Mon, 15 Jul 2024 12:38:11 GMT
Server: Apache/2.4.61 (Debian)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 281
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found NovobancoText-Medium.woff
login.inbe.digital/novo/particulares/clients/css/clientlib-resources/resources/fonts/ 0
0 44ms
21ms Font
text/html 193.187.174.136
AS56971 AS56971 C...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.inbe.digital/novo/particulares/clients/css/clientlib-resources/resources/fonts/NovobancoText-Medium.woff
Requested by: Host: login.inbe.digital
URL: https://login.inbe.digital/novo/particulares/clients/css/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 193.187.174.136 Paris, France, ASN56971 (AS56971 AS56971 Cloud, HK),
Reverse DNS
Software: Apache/2.4.61 (Debian) /
Resource Hash

Request headers

Referer: https://login.inbe.digital/novo/particulares/clients/css/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css
Origin: https://login.inbe.digital
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Mon, 15 Jul 2024 12:38:11 GMT
Server: Apache/2.4.61 (Debian)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 281
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK novobanco_negativo.svg
login.inbe.digital/novo/particulares/clients/css/ 4 KB
4 KB 22ms
21ms Image
image/svg+xml 193.187.174.136
AS56971 AS56971 C...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.inbe.digital/novo/particulares/clients/css/novobanco_negativo.svg
Requested by: Host: login.inbe.digital
URL: https://login.inbe.digital/novo/particulares/clients/login.php?verification
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 193.187.174.136 Paris, France, ASN56971 (AS56971 AS56971 Cloud, HK),
Reverse DNS
Software: Apache/2.4.61 (Debian) /
Resource Hash: e6c646ee2dd1deee0befd3a421422abd8cb605fd7c69c4b0efc646472a1ed737

Request headers

Referer: https://login.inbe.digital/novo/particulares/clients/login.php?verification
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Mon, 15 Jul 2024 12:38:11 GMT
Last-Modified: Mon, 27 Dec 2021 20:34:47 GMT
Server: Apache/2.4.61 (Debian)
ETag: "f38-5d426a2b267c0"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 3896

GET
H/1.1 200
OK icon-192x192.png
login.inbe.digital/novo/particulares/clients/css/ 12 KB
12 KB 24ms
24ms Other
image/png 193.187.174.136
AS56971 AS56971 C...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.inbe.digital/novo/particulares/clients/css/icon-192x192.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 193.187.174.136 Paris, France, ASN56971 (AS56971 AS56971 Cloud, HK),
Reverse DNS
Software: Apache/2.4.61 (Debian) /
Resource Hash: 8763f27366674b56ced96afd1ad01d724b8ff77c32bb690768c8e744cc07e621

Request headers

Referer: https://login.inbe.digital/novo/particulares/clients/login.php?verification
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date: Mon, 15 Jul 2024 12:38:11 GMT
Last-Modified: Mon, 27 Dec 2021 20:51:41 GMT
Server: Apache/2.4.61 (Debian)
ETag: "2ff9-5d426df22d140"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 12281

Verdicts & Comments Add Verdict or Comment

Malicious page.url
Submitted on July 15th 2024, 12:39:16 pm UTC — From Portugal

Threats: Phishing
Brands: Novobanco PT
Comment: phishing website for novobanco.pt clients

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Novobanco (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.ardalio.com/	1970-01-21 07:40:07	Name: tll_2149456 Value: 1721047091
app.ardalio.com/	1969-12-31 23:59:59	Name: cln_2149456 Value: 1
app.ardalio.com/	1970-01-20 22:04:08	Name: sta_2149456 Value: premium
app.ardalio.com/	1970-01-20 22:04:08	Name: sid_2149456 Value: ZpUYMzBhUov0-H85wUL8LAAAAAw
app.ardalio.com/	1970-01-21 07:40:07	Name: vid_2149456 Value: ZpUYMzBhUov0-H85wUL8LAAAAAw
app.ardalio.com/	1970-01-21 07:40:07	Name: nv_2149456 Value: 1
app.ardalio.com/	1970-01-21 07:40:07	Name: or_2149456 Value: nojavascript

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://login.inbe.digital/novo/particulares/clients/css/clientlib-resources/resources/fonts/NovobancoText-Book.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://login.inbe.digital/novo/particulares/clients/css/clientlib-resources/resources/fonts/NovobancoText-Medium.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.ardalio.com
login.inbe.digital
172.67.72.144
193.187.174.136
02b6c461b4cdac4d9ed9185c4895a0314aafc70fb066e2313a4c969cee692094
50b1758f17eca066d3c2e147a55c41368d67697adaee7c97f3c3d7706ac00393
7a7c300249d7ebe0d8419609fdae3953325a9b51548c88be622665a1bdd6ce6d
8763f27366674b56ced96afd1ad01d724b8ff77c32bb690768c8e744cc07e621
bd729072db6b7a92ef9d5813c81e434ec7f4ec48fcb3a7ac286f7ae4994cad68
e10b56b2442006f3a22ba1d20113f3f3d5882542f2e0dc677cc3c89efbdf5ad4
e6c646ee2dd1deee0befd3a421422abd8cb605fd7c69c4b0efc646472a1ed737

login.inbe.digital Open in urlscan Pro 193.187.174.136 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

646 kBTransfer

1538 kBSize

7 Cookies

1 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Malicious page.url Submitted on July 15th 2024, 12:39:16 pm UTC — From Portugal

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

7 Cookies

2 Console Messages

Indicators

login.inbe.digital Open in urlscan Pro
193.187.174.136 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

646 kB
Transfer

1538 kB
Size

7
Cookies

9 HTTP transactions
0 data transactions

Malicious page.url
Submitted on July 15th 2024, 12:39:16 pm UTC — From Portugal

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!