itau-credito.com Open in urlscan Pro
2606:4700:3035::6815:2d23 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://itau-credito.com/home.php
Effective URL:
https://itau-credito.com/home.php
Submission: On May 17 via api (May 17th 2023, 4:04:21 am UTC) from JP — Scanned from JP

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3035::6815:2d23, located in United States and belongs to CLOUDFLARENET, US. The main domain is itau-credito.com.
TLS certificate: Issued by GTS CA 1P5 on May 12th 2023. Valid for: 3 months.

This is the only time itau-credito.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3033::ac43:d0c2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2606:4700:303... 2606:4700:3035::6815:2d23	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2404:6800:400... 2404:6800:4004:824::200a	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4004:823::2003	15169 (GOOGLE) (GOOGLE)
13	3

1 2606:4700:3033::ac43:d0c2 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

itau-credito.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:3035::6815:2d23 (United States)

ASN13335 (CLOUDFLARENET, US)

itau-credito.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:824::200a (Australia)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:823::2003 (Australia)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	itau-credito.com 1 redirects itau-credito.com	650 KB
1	gstatic.com fonts.gstatic.com	48 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 50	1 KB
13	3

	Domain	Requested by
12	itau-credito.com	1 redirects itau-credito.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	itau-credito.com
13	3

This site contains no links.

Subject Issuer	Validity	Valid
itau-credito.com GTS CA 1P5	`2023-05-12` - `2023-08-10`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://itau-credito.com/home.php
Frame ID: 747600F80353B4B4A5029A68D57DAA0D
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banco Itaú - Feito pra você

Page URL History Show full URLs

http://itau-credito.com/home.php HTTP 301
https://itau-credito.com/home.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

699 kB
Transfer

718 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://itau-credito.com/home.php HTTP 301
https://itau-credito.com/home.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request home.php Show response
itau-credito.com/
Redirect Chain

http://itau-credito.com/home.php
https://itau-credito.com/home.php

3 KB
1 KB

610ms
598ms

Document
text/html

2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://itau-credito.com/home.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f07881a51922b3e1d4a9cf0888ae9e3975bc24d070f89b9477099aa88584a6e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7c88f9a7fd55e0b0-NRT
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 17 May 2023 04:04:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h8rHMrc6HT3L0ixqurOHBYbTVPS2xySnOcsBIYPwtmvknkmg87393NVJf3a%2FwRIEIc1UAqToMorDbG0lm7Enoh%2BTV8oUlPa8b%2BfCtjCwCp3av7o4%2B5UkQA8NFUriicIWrsHDFD5yZ7FEdedGFEr%2F"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 7c88f9a4cff90b00-NRT
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Date: Wed, 17 May 2023 04:04:14 GMT
Location: https://itau-credito.com/home.php
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IeVWdk8hfsJpYsqiEBEZnKW%2BCOgbJ3XBTZbDLBsTxWYT%2FZkiYmO53REBASkZ1xxdDIN3Wt0jwR1bPwxwvo5%2B6psmWwf487JFjKx%2BsgQV4kLDGnXpiOSURCqoZXnrB8jM1DZQgLEUThEuLs44v2%2Fv"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 geral.css
itau-credito.com/estilos/ 9 KB
3 KB 526ms
525ms Stylesheet
text/css 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://itau-credito.com/estilos/geral.css
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/home.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: add6f086fd81490771e3f20ef5862e896904ebac7c7af72f90db8fc318a33da3

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/home.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:15 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 22:13:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tru2qN4kecEMKI7MG6LzTD%2Fyp7tiViE0OW3rC2TjoMUClaQYBqD%2Fuwsrpy%2Bf8mQnZ9sSIWzvTuR11k1znYCmSTkI37g0VaSQb9Ivea4Mb9f7HCgAbMCoYUbJpxyFrtZVRJ1PdXt%2BhlEmLfahZKuT"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7c88f9abc8e0e0b0-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 geral.js Show response
itau-credito.com/javascripts/ 5 KB
2 KB 595ms
595ms Script
application/javascript 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://itau-credito.com/javascripts/geral.js
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/home.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3d76b234f969d47c970c066cd5e3a9c9d2d07f08c5924486dbab16d005a920b

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/home.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:15 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 22:05:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KrDPymKeY2H0TKIFc30ClpgVOCyjMmBeMFgx67%2Fpyp6fx%2F04H8W6sQQXK99bUFW0dPtjNDNPfgFYSn0l4yM1uaOPmsjtDlFpuu1Ijgh%2F1LrbAOlZF38AnJ01aSzLriHqJ0BHYAAoRSqFL8GqQNzt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7c88f9abc8e1e0b0-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 13 KB
1 KB 132ms
41ms Stylesheet
text/css 2404:6800:4004:824::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800

Requested by

Host: itau-credito.com
URL: https://itau-credito.com/home.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:824::200a , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7556c220859e509cf18297cacd5f9348ea5a55b13392e59be1086064f7f0f7a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 17 May 2023 04:04:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 17 May 2023 03:37:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 17 May 2023 04:04:15 GMT

GET
H3 200 logo.png
itau-credito.com/imagens/ 2 KB
3 KB 535ms
535ms Image
image/png 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itau-credito.com/imagens/logo.png
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/home.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6da034f63fc7905eef461a3db2fcd4328c8fa53d7676df7686e9d310f40f6d4d

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/home.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:16 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 15:03:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AF3Fu%2FuxnRh5VTHiz%2BOifQt7NgAVlcjYAOaJ6LnUZ%2BnA%2FUWzkTIskgoaGT0fZEVPnQ7BeXM%2FShCf0EF6AlY0GGiQYdx5fv5snAKH1uLa0E%2Fq0Q8bh8J3bWadId0XJR85vw1I6Ov0qkQLxOM8PnoX"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7c88f9af0df925e4-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2408

GET
H3 200 setas_menu.png
itau-credito.com/imagens/ 977 B
1 KB 546ms
545ms Image
image/png 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itau-credito.com/imagens/setas_menu.png
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/home.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41f324f60a6ef6623f2a5c3612c571aa37b89a044836d983e6b80a067d785cde

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/home.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:16 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 15:03:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GS5TzQS1A7cigJaMmc1WjZgRSpjeRWCc1IkhJM2x4TwscN5SWF19aNaindUlWcECPqDNrjBaPqb3EVsMjB%2FM8L9aKwWTufXj%2FLPQCe%2Bl82ugpeo2Xb7RkSliAwO7QuQ9XX%2BPI3UKvdGkEU5mIg6C"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7c88f9af7e4c25e4-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 977

GET
H3 200 cadeado_button_home.png
itau-credito.com/imagens/ 3 KB
3 KB 496ms
496ms Image
image/png 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itau-credito.com/imagens/cadeado_button_home.png
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/home.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7245dbd1481a7c3bc402a3c83c366fdf74d9f203134e4396ab7fa66ee95b6cd3

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/home.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:16 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 15:09:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZyDEgqulBOi%2FmEcAS0Mc2rLe%2BEin5jX1gVckPKiKU%2BGa3l%2FdS2fY3eABT2Rezg0gxA1UliWKt2TCGlUwsdLf96n9j4AzRr2uRShChrQaBprd%2F8633qRosubVVbpFVneldok6oYlWHnsluH5DYRlk"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7c88f9af9e6425e4-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2960

GET
H3 200 horas.gif
itau-credito.com/imagens/ 2 KB
2 KB 586ms
586ms Image
image/gif 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itau-credito.com/imagens/horas.gif
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/home.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d99563e9563eb69ad189118b0c2ae042e82e7d71d5de9d6f00b7f4bbaf9678d

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/home.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:16 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 15:04:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UmAwjLFgfMUeLvZ7errOr6aqceQbp82N6paS7ydVaVmb5SleqghOy1t0yeEnoGW45ap4kzhyM%2BiQQnX6KFPjTRhTWo0I3bouODErjMd7uHDyOyJ4sBbKICU2I105VYHMQ7Sd8gW5Kx%2Fcu0kwt6Wq"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7c88f9af9e6525e4-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1908

GET
H3 200 bg_all.jpg
itau-credito.com/imagens/ 629 KB
629 KB 565ms
565ms Image
image/jpeg 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itau-credito.com/imagens/bg_all.jpg
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/estilos/geral.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6dadb48e134dfaffa09bbc4cd92ef1288e7eab40760b5c5a83152e854215c4f2

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/estilos/geral.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:16 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 15:04:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hIKQpFVh8xTQG84d8%2BUlU1Ksc7gYD7c1CCIwlIRj0VF1MSU%2F%2FHCYi0EZh5Ff9n9gdUVuxn8iKLgEkBiBFXIi1XHr7n8RW74aH8enfgedBSSsg3p8GidR%2FJywAjzUQjcfYDlyKJakayD2Nx0%2Bsav5"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7c88f9af9e6625e4-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 643736

GET
H3 200 bg_header.gif
itau-credito.com/imagens/ 1 KB
2 KB 560ms
560ms Image
image/gif 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itau-credito.com/imagens/bg_header.gif
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/estilos/geral.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2cb325f998ad135de2e7e879713fe7256fb50f66af870ea9f5bc1d3e63bc854d

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/estilos/geral.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:16 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 15:45:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FjY8G1uXnuYlw0Kr2yKxPvCk41rUMHHEdxS%2BdAdNZzDTeX2D4apoQ7wqTnYFXroV7KErZd7ctPgoggAn55j5aMcPb3LsAwRKAXwkjc0PEwb7FIEOQUo%2BoVHT3KxJHTniWPAvJ24g7dza%2BdIm0iXc"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7c88f9af9e6725e4-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1411

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 47 KB
48 KB 46ms
4ms Font
font/woff2 2404:6800:4004:823::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://itau-credito.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 11:46:07 GMT
x-content-type-options: nosniff
age: 490688
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48412
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:08:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 May 2024 11:46:07 GMT

GET
H3 200 bg_select_item.png
itau-credito.com/imagens/ 959 B
1 KB 589ms
589ms Image
image/png 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itau-credito.com/imagens/bg_select_item.png
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/estilos/geral.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f91d7bcfea1bcd314005371d7a0929f8e22f3bde3d305adc489cdd2df13ede77

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/estilos/geral.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:16 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 16:00:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f0sWJVx0f2wmZ3p4NP5iSW%2BjY%2BU4tiUhBIeU6tKjV2SfWx5UvV2GxVKxMDt7tR%2FBV8VYQguZLF2VfPWeapzcr%2B6DLNUgD9xuyRlJ3owGMQpLTe4DPa7T%2FQnXJvJegHOaW8Rlr8md2OcB98QYsiXZ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7c88f9af9e6b25e4-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 959

GET
H3 200 bg_button_home.png
itau-credito.com/imagens/ 982 B
1 KB 523ms
523ms Image
image/png 2606:4700:3035::6815:2d23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itau-credito.com/imagens/bg_button_home.png
Requested by: Host: itau-credito.com
URL: https://itau-credito.com/estilos/geral.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:2d23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65eea5b0a27bfdf46700003c824a2340e76c21896bb3b9fa6c4f8135fd2d720f

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://itau-credito.com/estilos/geral.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 04:04:16 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 14 Jul 2018 15:04:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ef1InzO7aXHiVpUZXHNl51m0gN5kL99UDw3kcoBFFPXoQWC2z04P7e5J8%2B2D%2F04LOhKZl7ZFQb0t%2BiM4EKkwifcVfUb%2Fs5z5ObDWII4SfG8vi1FhSTsD4DgQZeQH0lfMqDVYYOxEjCUFbjr3IJ0r"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7c88f9af9e6f25e4-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 982

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
itau-credito.com
2404:6800:4004:823::2003
2404:6800:4004:824::200a
2606:4700:3033::ac43:d0c2
2606:4700:3035::6815:2d23
2cb325f998ad135de2e7e879713fe7256fb50f66af870ea9f5bc1d3e63bc854d
2f07881a51922b3e1d4a9cf0888ae9e3975bc24d070f89b9477099aa88584a6e
41f324f60a6ef6623f2a5c3612c571aa37b89a044836d983e6b80a067d785cde
65eea5b0a27bfdf46700003c824a2340e76c21896bb3b9fa6c4f8135fd2d720f
6d99563e9563eb69ad189118b0c2ae042e82e7d71d5de9d6f00b7f4bbaf9678d
6da034f63fc7905eef461a3db2fcd4328c8fa53d7676df7686e9d310f40f6d4d
6dadb48e134dfaffa09bbc4cd92ef1288e7eab40760b5c5a83152e854215c4f2
7245dbd1481a7c3bc402a3c83c366fdf74d9f203134e4396ab7fa66ee95b6cd3
7556c220859e509cf18297cacd5f9348ea5a55b13392e59be1086064f7f0f7a4
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
add6f086fd81490771e3f20ef5862e896904ebac7c7af72f90db8fc318a33da3
d3d76b234f969d47c970c066cd5e3a9c9d2d07f08c5924486dbab16d005a920b
f91d7bcfea1bcd314005371d7a0929f8e22f3bde3d305adc489cdd2df13ede77

itau-credito.com Open in urlscan Pro 2606:4700:3035::6815:2d23 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

699 kBTransfer

718 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Indicators

itau-credito.com Open in urlscan Pro
2606:4700:3035::6815:2d23 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

699 kB
Transfer

718 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!