atualizacao-app.sytes.net
Open in
urlscan Pro
200.100.21.190
Malicious Activity!
Public Scan
URL:
http://atualizacao-app.sytes.net:2019/Itau/token-app.tk/home3e6e.php
Submission: On April 06 via automatic, source phishtank
Submission: On April 06 via automatic, source phishtank
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 11 HTTP transactions.
The main IP is 200.100.21.190, located in
Sao Jose do Rio Preto, Brazil and
belongs to TELEFÃÂNICA BRASIL S.A, BR.
The main domain is atualizacao-app.sytes.net.
This is the only time atualizacao-app.sytes.net was scanned on urlscan.io!
This is the only time atualizacao-app.sytes.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 200.100.21.190 200.100.21.190 | 27699 (TELEFÃÂ...) (TELEFÃÂNICA BRASIL S.A) | |
| 11 | 1 |
11
200.100.21.190
(Sao Jose do Rio Preto, Brazil)
ASN27699 (TELEFÃÂNICA BRASIL S.A, BR)
PTR: 200-100-21-190.dial-up.telesp.net.br
ASN27699 (TELEFÃÂNICA BRASIL S.A, BR)
PTR: 200-100-21-190.dial-up.telesp.net.br
| atualizacao-app.sytes.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
sytes.net
atualizacao-app.sytes.net |
85 KB |
| 11 | 1 |
| Domain | Requested by | |
|---|---|---|
| 11 | atualizacao-app.sytes.net |
atualizacao-app.sytes.net
|
| 11 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://atualizacao-app.sytes.net:2019/Itau/token-app.tk/home3e6e.php
Frame ID: 86B30519A461CD06B34325B6B465AFF7
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
- headers server /php\/?([\d.]+)?/i
Windows Server
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Win32|Win64/i
OpenSSL
(Web Server Extensions)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
home3e6e.php
atualizacao-app.sytes.net/Itau/token-app.tk/ |
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.2.1.min.js
atualizacao-app.sytes.net/Itau/token-app.tk/js/ |
73 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.mask.min.js
atualizacao-app.sytes.net/Itau/token-app.tk/js/ |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
home_scripts.js
atualizacao-app.sytes.net/Itau/token-app.tk/js/ |
3 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
atualizacao-app.sytes.net/Itau/stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/ |
114 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
home_style.css
atualizacao-app.sytes.net/Itau/token-app.tk/assets/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
switcher.css
atualizacao-app.sytes.net/Itau/token-app.tk/assets/css/ |
21 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
img_home_logo.png
atualizacao-app.sytes.net/Itau/token-app.tk/assets/imagenss/ |
41 KB 41 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ic_contact_card.png
atualizacao-app.sytes.net/Itau/token-app.tk/assets/imagenss/ |
503 B 812 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ic_itokenapp.png
atualizacao-app.sytes.net/Itau/token-app.tk/assets/imagenss/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ic_ajuda.png
atualizacao-app.sytes.net/Itau/token-app.tk/assets/imagenss/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
atualizacao-app.sytes.net
200.100.21.190
29cc26c04dd9bc5fca3fdbc0e2944aedfc45d5c763bbeda104ca015d15430306
5dde2dfae502e0cbb41c58b8355ca5b713fe48b9bcdcc78bc40d7fd030d0ed88
7128b3163ef3d75f3f7f7e803b65a7bbfbf480c880c7a815c33ea82d549e630d
75851533db3fda044c3fe2bdfbb1dfdf808586387493fc5b3395ba8400391046
915e3aea1eda6df53467eb792f487578c127d19740a1eb669d6dba7d2435edb4
bad8117c7b23f326216e85e630e3915ea1c73387a7b7d2da61e800e96fc8b8c6
da7d2cc8bcd1d44f1a5a944872ac430f231aa02c1947b45def029999335b5f94
f830833b6661d5fb63e23d3d245e91edc7c52aa547ca19eca7c91c7570483975
fd4c7d8dd48f82580fc255c3d921db1f86362c6c1aea219196d72401524c93c1