portaldacaixa.com Open in urlscan Pro
2606:4700:3034::6818:7a10 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://portaldacaixa.com/login.php
Submission: On February 09 via manual (February 9th 2020, 7:44:03 pm UTC) from BR

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3034::6818:7a10, located in United States and belongs to CLOUDFLARENET, US. The main domain is portaldacaixa.com.

This is the only time portaldacaixa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Caixa (Government)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3034::6818:7a10	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:4de0:ac1... 2001:4de0:ac19::1:b:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
5	2606:4700:303... 2606:4700:3033::6818:7b10	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
12	5

2 2606:4700:3034::6818:7a10 (United States)

ASN13335 (CLOUDFLARENET, US)

portaldacaixa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3033::6818:7b10 (United States)

ASN13335 (CLOUDFLARENET, US)

portaldacaixa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	portaldacaixa.com portaldacaixa.com	51 KB
2	gstatic.com fonts.gstatic.com	22 KB
1	googleapis.com fonts.googleapis.com	964 B
1	jquery.com code.jquery.com	30 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	17 KB
12	5

	Domain	Requested by
7	portaldacaixa.com	portaldacaixa.com
2	fonts.gstatic.com	portaldacaixa.com
1	fonts.googleapis.com	portaldacaixa.com
1	code.jquery.com	portaldacaixa.com
1	maxcdn.bootstrapcdn.com	portaldacaixa.com
12	5

This site contains no links.

Subject Issuer	Validity	Valid
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-01-21` - `2020-04-14`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-01-21` - `2020-04-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://portaldacaixa.com/login.php
Frame ID: E70D966AD5133468B7B7A0601C95B053
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Bulma (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bulma(?:\.min)?\.css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

12
Requests

42 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

121 kB
Transfer

463 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set login.php Show response
portaldacaixa.com/ 23 KB
13 KB 334ms
334ms Document
text/html 2606:4700:3034::6818:7a10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://portaldacaixa.com/login.php
Protocol: HTTP/1.1
Server: 2606:4700:3034::6818:7a10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.5.9-1ubuntu4.29
Resource Hash: 422045885ec874c46c0f0f1f728b5281b7b5a5dd1dcb61a7133ce8f84f1fa744

Request headers

Host: portaldacaixa.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Feb 2020 19:43:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d368e3188588af91d7054b33045360fd71581277425; expires=Tue, 10-Mar-20 19:43:45 GMT; path=/; domain=.portaldacaixa.com; HttpOnly; SameSite=Lax
X-Powered-By: PHP/5.5.9-1ubuntu4.29
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 56285585cced97d8-FRA
Content-Encoding: gzip

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.2/css/ 93 KB
17 KB 28ms
7ms Stylesheet
text/css 2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.2/css/bootstrap.min.css
Requested by: Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: c567912a3cf283a6dea7d0f502c1f350f1161db58cce545cf38674686fadca6b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://portaldacaixa.com/login.php
Origin: http://portaldacaixa.com

Response headers

date: Sun, 09 Feb 2020 19:43:45 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:34:08 GMT
access-control-allow-origin: *
etag: "1544639648"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 17650

GET
H/1.1 200
OK pwr.css
portaldacaixa.com/css/ 818 B
712 B 330ms
328ms Stylesheet
text/css 2606:4700:3034::6818:7a10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://portaldacaixa.com/css/pwr.css
Requested by: Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php
Protocol: HTTP/1.1
Server: 2606:4700:3034::6818:7a10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4189c125a6ae568b883dc5f3f0e4202e3f6e67de2228e8e61632eac943377f66

Request headers

Referer: http://portaldacaixa.com/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Feb 2020 19:43:46 GMT
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
Last-Modified: Sat, 08 Feb 2020 03:09:11 GMT
Server: cloudflare
ETag: "332-59e07d4873fe5-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 56285588387f97d8-FRA
Content-Length: 334

GET
H/1.1 200
OK bulma.min.css
portaldacaixa.com/css/ 213 KB
23 KB 504ms
484ms Stylesheet
text/css 2606:4700:3033::6818:7b10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://portaldacaixa.com/css/bulma.min.css
Requested by: Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php
Protocol: HTTP/1.1
Server: 2606:4700:3033::6818:7b10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: efa553e95cc35520302abe3ddfecb54b90cf28b265dd843abd0be49376524498

Request headers

Referer: http://portaldacaixa.com/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Feb 2020 19:43:46 GMT
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
Last-Modified: Sat, 08 Feb 2020 03:09:11 GMT
Server: cloudflare
ETag: "35236-59e07d48c50c5-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 562855885a5797c0-FRA
Content-Length: 23668

GET
H/1.1 200
OK cefpwr_03.png
portaldacaixa.com/imagens/ 4 KB
4 KB 352ms
332ms Image
image/png 2606:4700:3033::6818:7b10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://portaldacaixa.com/imagens/cefpwr_03.png
Requested by: Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php
Protocol: HTTP/1.1
Server: 2606:4700:3033::6818:7b10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2bc0839136d4b1ff521844d6598f317951557e1b476dfef5654e0f701d85397a

Request headers

Referer: http://portaldacaixa.com/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Feb 2020 19:43:46 GMT
CF-Cache-Status: MISS
Last-Modified: Sat, 08 Feb 2020 03:09:14 GMT
Server: cloudflare
ETag: "e75-59e07d4ba5605"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 562855885ec9c26d-FRA
Content-Length: 3701

GET
H/1.1 200
OK cefpwr_06.png
portaldacaixa.com/imagens/ 5 KB
5 KB 351ms
331ms Image
image/png 2606:4700:3033::6818:7b10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://portaldacaixa.com/imagens/cefpwr_06.png
Requested by: Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php
Protocol: HTTP/1.1
Server: 2606:4700:3033::6818:7b10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 341de105a6015345739319fe0a210010ea54009b5aeb7f2c961e22e2639cb7dd

Request headers

Referer: http://portaldacaixa.com/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Feb 2020 19:43:46 GMT
CF-Cache-Status: MISS
Last-Modified: Sat, 08 Feb 2020 03:09:14 GMT
Server: cloudflare
ETag: "1464-59e07d4bdb165"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 562855885fc6177a-FRA
Content-Length: 5220

GET
H/1.1 200
OK jquery-3.0.0.min.js Show response
code.jquery.com/ 84 KB
30 KB 23ms
7ms Script
application/javascript 2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.0.0.min.js
Requested by: Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d

Request headers

Referer: http://portaldacaixa.com/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Feb 2020 19:43:46 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2016 18:32:50 GMT
Server: nginx
ETag: W/"5759b652-15145"
Vary: Accept-Encoding
X-HW: 1581277426.dop167.fr8.shc,1581277426.dop167.fr8.t,1581277426.cds129.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 29995

GET
H/1.1 200
OK phanimate.jquery.js Show response
portaldacaixa.com/js/ 1 KB
987 B 324ms
323ms Script
application/javascript 2606:4700:3033::6818:7b10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://portaldacaixa.com/js/phanimate.jquery.js
Requested by: Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php
Protocol: HTTP/1.1
Server: 2606:4700:3033::6818:7b10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7fbcd2e4d1629b13ef250cc7553eb6ab43add6179ac9d71d4b405bc6384db62c

Request headers

Referer: http://portaldacaixa.com/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Feb 2020 19:43:46 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Sat, 08 Feb 2020 03:09:18 GMT
Server: cloudflare
ETag: "5c0-59e07d4f9a125-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5628558abd0ac26d-FRA
Content-Length: 598

GET
H2 200 css
fonts.googleapis.com/ 14 KB
964 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,400i,500,500i,700

Requested by

Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3ae2e9c1e3ba9f95cd10132c8cdfd4ec59eefd1f2d83f81535b9060bc6fbe8cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://portaldacaixa.com/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sun, 09 Feb 2020 19:43:46 GMT
server: ESF
access-control-allow-origin: *
date: Sun, 09 Feb 2020 19:43:46 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Sun, 09 Feb 2020 19:43:46 GMT

GET
H/1.1 200
OK cefpwr_10.png
portaldacaixa.com/imagens/ 3 KB
3 KB 349ms
348ms Image
image/png 2606:4700:3033::6818:7b10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://portaldacaixa.com/imagens/cefpwr_10.png
Requested by: Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php
Protocol: HTTP/1.1
Server: 2606:4700:3033::6818:7b10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fa862ea415b76fa363be343a9c6f28ebfdabdc99cb3dc8f2648400eea1fcd14

Request headers

Referer: http://portaldacaixa.com/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Feb 2020 19:43:46 GMT
CF-Cache-Status: REVALIDATED
Last-Modified: Sat, 08 Feb 2020 03:09:15 GMT
Server: cloudflare
ETag: "c03-59e07d4c2d1e5"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 5628558b9e3a97c0-FRA
Content-Length: 3075

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto:300,400,400i,500,500i,700
Origin: http://portaldacaixa.com

Response headers

date: Sat, 01 Feb 2020 11:35:32 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 720494
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 11016
x-xss-protection: 0
expires: Sun, 31 Jan 2021 11:35:32 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Host: portaldacaixa.com
URL: http://portaldacaixa.com/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto:300,400,400i,500,500i,700
Origin: http://portaldacaixa.com

Response headers

date: Fri, 31 Jan 2020 00:50:19 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 845607
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 11020
x-xss-protection: 0
expires: Sat, 30 Jan 2021 00:50:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Caixa (Government)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.portaldacaixa.com/	1970-01-19 07:57:49	Name: __cfduid Value: d368e3188588af91d7054b33045360fd71581277425

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
portaldacaixa.com
2001:4de0:ac19::1:b:2a
2606:4700:3033::6818:7b10
2606:4700:3034::6818:7a10
2a00:1450:4001:808::2003
2a00:1450:4001:809::200a
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d
2bc0839136d4b1ff521844d6598f317951557e1b476dfef5654e0f701d85397a
341de105a6015345739319fe0a210010ea54009b5aeb7f2c961e22e2639cb7dd
3ae2e9c1e3ba9f95cd10132c8cdfd4ec59eefd1f2d83f81535b9060bc6fbe8cc
4189c125a6ae568b883dc5f3f0e4202e3f6e67de2228e8e61632eac943377f66
422045885ec874c46c0f0f1f728b5281b7b5a5dd1dcb61a7133ce8f84f1fa744
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
7fbcd2e4d1629b13ef250cc7553eb6ab43add6179ac9d71d4b405bc6384db62c
9fa862ea415b76fa363be343a9c6f28ebfdabdc99cb3dc8f2648400eea1fcd14
c567912a3cf283a6dea7d0f502c1f350f1161db58cce545cf38674686fadca6b
efa553e95cc35520302abe3ddfecb54b90cf28b265dd843abd0be49376524498

portaldacaixa.com Open in urlscan Pro 2606:4700:3034::6818:7a10 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

12 Requests

42 %HTTPS

100 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

121 kBTransfer

463 kBSize

1 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

Indicators

portaldacaixa.com Open in urlscan Pro
2606:4700:3034::6818:7a10 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

42 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

121 kB
Transfer

463 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!