pmrresistencias.com.br Open in urlscan Pro
108.179.192.228 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pmrresistencias.com.br/first/Citizens/otp2.html
Submission: On May 23 via api (May 23rd 2023, 3:20:16 pm UTC) from US — Scanned from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 13 HTTP transactions. The main IP is 108.179.192.228, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is pmrresistencias.com.br.
TLS certificate: Issued by R3 on May 17th 2023. Valid for: 3 months.

This is the only time pmrresistencias.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: First Citizens Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
14 26	108.179.192.228 108.179.192.228	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	192.0.54.4 192.0.54.4	62659 (Q2HOLDINGS) (Q2HOLDINGS)
13	2

26 108.179.192.228 (United States) 14 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: srv180-ip04.prodns.com.br

pmrresistencias.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.54.4 (United States)

ASN62659 (Q2HOLDINGS, US)

cdn1.onlineaccess1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	pmrresistencias.com.br 14 redirects pmrresistencias.com.br	1 MB
1	onlineaccess1.com cdn1.onlineaccess1.com — Cisco Umbrella Rank: 18867	7 KB
13	2

	Domain	Requested by
26	pmrresistencias.com.br	14 redirects pmrresistencias.com.br
1	cdn1.onlineaccess1.com	pmrresistencias.com.br
13	2

This site contains no links.

Subject Issuer	Validity	Valid
pmrresistencias.com.br R3	`2023-05-17` - `2023-08-15`	3 months	crt.sh
onlineaccess1.com GTS CA 1P5	`2023-05-20` - `2023-08-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pmrresistencias.com.br/first/Citizens/otp2.html
Frame ID: CB52F2DD4BADA284FB4B5D3236E9A0D5
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

First Citizens Bank | Login

Page Statistics

13
Requests

46 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1142 kB
Transfer

4062 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://pmrresistencias.com.br/first/Citizens/img/desktop-background-31261c4b72eb487c279e9a1b57d9f095.jpg HTTP 301
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/img/desktop-background-31261c4b72eb487c279e9a1b57d9f095.jpg HTTP 302
https://pmrresistencias.com.br/

Request Chain 6

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.woff HTTP 301
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Regular.woff HTTP 302
https://pmrresistencias.com.br/

Request Chain 7

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.woff HTTP 301
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Bold.woff HTTP 302
https://pmrresistencias.com.br/

Request Chain 8

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.woff HTTP 301
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.woff HTTP 302
https://pmrresistencias.com.br/

Request Chain 9

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.ttf HTTP 301
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.ttf HTTP 302
https://pmrresistencias.com.br/

Request Chain 10

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.ttf HTTP 301
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Bold.ttf HTTP 302
https://pmrresistencias.com.br/

Request Chain 11

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.ttf HTTP 301
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Regular.ttf HTTP 302
https://pmrresistencias.com.br/

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request otp2.html Show response
pmrresistencias.com.br/first/Citizens/ 4 KB
2 KB 236ms
55ms Document
text/html 108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/first/Citizens/otp2.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: f5682dce3ff292f17a93b2be02783e9ebf58d3465b71f7ca6f31a7e821d92f86

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=3600
content-encoding: gzip
content-length: 1727
content-type: text/html
date: Tue, 23 May 2023 15:20:01 GMT
expires: Tue, 23 May 2023 16:20:01 GMT
last-modified: Fri, 19 May 2023 07:47:38 GMT
server: Apache
vary: Accept-Encoding

GET
H2 200 app.css
pmrresistencias.com.br/first/Citizens/css/ 94 KB
25 KB 125ms
124ms Stylesheet
text/css 108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/first/Citizens/css/app.css
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/otp2.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: 722e0f8219375018d795921485032e970952ab5ab3c5d534b024e1693d7f982f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/otp2.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 23 May 2023 15:20:02 GMT
content-encoding: gzip
last-modified: Thu, 02 Feb 2023 21:53:48 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
expires: Thu, 22 Jun 2023 15:20:02 GMT

GET
H2 200 highcontrast-23d6f5c394031f2b7a197598ef562da5.css
pmrresistencias.com.br/first/Citizens/css/ 969 KB
190 KB 62ms
61ms Stylesheet
text/css 108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/otp2.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: 5fe9be1ee622cde0915ad2e0fd99a1aec935c971201dcbe8ddc63427fc8d103e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/otp2.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 23 May 2023 15:20:02 GMT
content-encoding: gzip
last-modified: Mon, 23 May 2022 18:00:44 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
expires: Thu, 22 Jun 2023 15:20:02 GMT

GET
H2 200 theme-q2-c78f9a6334979dc02a4414cf3a8779e5.css
pmrresistencias.com.br/first/Citizens/css/ 934 KB
189 KB 178ms
177ms Stylesheet
text/css 108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/first/Citizens/css/theme-q2-c78f9a6334979dc02a4414cf3a8779e5.css
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/otp2.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: 44b62296dd491bc6b05441bd4dfc79d12d979d033f5103a176c223c6e87b6823

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/otp2.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 23 May 2023 15:20:02 GMT
content-encoding: gzip
last-modified: Thu, 02 Feb 2023 21:53:36 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
expires: Thu, 22 Jun 2023 15:20:02 GMT

GET
H2 200 tecton-590048df214033d1c1591d552a32c9af.css
pmrresistencias.com.br/first/Citizens/css/ 8 KB
2 KB 119ms
119ms Stylesheet
text/css 108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/first/Citizens/css/tecton-590048df214033d1c1591d552a32c9af.css
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/otp2.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: fbb5d60b0e8fbf3ce2eeb2479ad9ef6744585303f9ee0bf27c62b35a0a2dc30a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/otp2.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 23 May 2023 15:20:02 GMT
content-encoding: gzip
last-modified: Thu, 02 Feb 2023 21:53:42 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1792
expires: Thu, 22 Jun 2023 15:20:02 GMT

GET
H2

200

/
pmrresistencias.com.br/
Redirect Chain

https://pmrresistencias.com.br/first/Citizens/img/desktop-background-31261c4b72eb487c279e9a1b57d9f095.jpg
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/img/desktop-background-31261c4b72eb487c279e9a1b57d9f095.jpg
https://pmrresistencias.com.br/

49 KB
49 KB

79ms
79ms

Image
text/html

108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pmrresistencias.com.br/
Protocol: H2
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/otp2.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:02 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:02 GMT
server: Apache
content-type: text/html; charset=UTF-8
location: /
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 logo_large-5741abb9675d37b6178ac83becc79b17.png
cdn1.onlineaccess1.com/cdn/depot/3397/1069/d156970adc960ccc43e0f0d4d553bb92/assets/images/logos/ 7 KB
7 KB 170ms
45ms Image
image/png 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn1.onlineaccess1.com/cdn/depot/3397/1069/d156970adc960ccc43e0f0d4d553bb92/assets/images/logos/logo_large-5741abb9675d37b6178ac83becc79b17.png

Requested by

Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/css/theme-q2-c78f9a6334979dc02a4414cf3a8779e5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3133f88ff2d288957e9708cab68a2dd2f25f46177603d9accb70b22bc7601888

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 23 May 2023 15:20:02 GMT
content-encoding: gzip
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 57096
last-modified: Fri, 24 Mar 2023 16:13:06 GMT
server: cloudflare
etag: W/"641dcc12-1a27"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
timing-allow-origin: *
access-control-allow-headers: *
cf-ray: 7cbe47d85e5d633c-ORD
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

/
pmrresistencias.com.br/
Redirect Chain

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.woff
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Regular.woff
https://pmrresistencias.com.br/

333 KB
113 KB

129ms
128ms

Font
text/html

108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
Protocol: H2
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: 8eb843124995602a054e664b35ec6e254f5516551355900b262fbe309cc6b74b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:02 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:02 GMT
server: Apache
content-type: text/html; charset=UTF-8
location: /
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2

200

/
pmrresistencias.com.br/
Redirect Chain

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.woff
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Bold.woff
https://pmrresistencias.com.br/

333 KB
113 KB

116ms
116ms

Font
text/html

108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
Protocol: H2
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: 8eb843124995602a054e664b35ec6e254f5516551355900b262fbe309cc6b74b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:02 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:02 GMT
server: Apache
content-type: text/html; charset=UTF-8
location: /
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2

200

/
pmrresistencias.com.br/
Redirect Chain

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.woff
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.woff
https://pmrresistencias.com.br/

333 KB
113 KB

83ms
83ms

Font
text/html

108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
Protocol: H2
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: 8eb843124995602a054e664b35ec6e254f5516551355900b262fbe309cc6b74b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:02 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:02 GMT
server: Apache
content-type: text/html; charset=UTF-8
location: /
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2

200

/
pmrresistencias.com.br/
Redirect Chain

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.ttf
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.ttf
https://pmrresistencias.com.br/

333 KB
113 KB

120ms
119ms

Font
text/html

108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
Protocol: H2
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: 8eb843124995602a054e664b35ec6e254f5516551355900b262fbe309cc6b74b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:03 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:02 GMT
server: Apache
content-type: text/html; charset=UTF-8
location: /
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2

200

/
pmrresistencias.com.br/
Redirect Chain

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.ttf
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Bold.ttf
https://pmrresistencias.com.br/

333 KB
113 KB

153ms
152ms

Font
text/html

108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
Protocol: H2
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: 8eb843124995602a054e664b35ec6e254f5516551355900b262fbe309cc6b74b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:03 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:03 GMT
server: Apache
content-type: text/html; charset=UTF-8
location: /
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2

200

/
pmrresistencias.com.br/
Redirect Chain

https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.ttf
https://pmrresistencias.com.br/erro.php?pagina_erro=first/Citizens/css/fonts/OpenSans/OpenSans-Regular.ttf
https://pmrresistencias.com.br/

333 KB
113 KB

90ms
90ms

Font
text/html

108.179.192.228
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://pmrresistencias.com.br/
Requested by: Host: pmrresistencias.com.br
URL: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
Protocol: H2
Server: 108.179.192.228 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv180-ip04.prodns.com.br
Software: Apache /
Resource Hash: 8eb843124995602a054e664b35ec6e254f5516551355900b262fbe309cc6b74b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pmrresistencias.com.br/first/Citizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:03 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 23 May 2023 15:20:03 GMT
server: Apache
content-type: text/html; charset=UTF-8
location: /
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: First Citizens Bank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.onlineaccess1.com/	1969-12-31 23:59:59	Name: __cfruid Value: d976abdeb8a271ff3508dde29b893366232e07fc-1684855202
pmrresistencias.com.br/	1969-12-31 23:59:59	Name: PHPSESSID Value: uqjcshmcbrdfme4sht1epq3m37
pmrresistencias.com.br/	1970-01-20 12:00:58	Name: ultima_pagina Value: https%3A%2F%2Fpmrresistencias.com.br%2F

36 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.woff
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.woff
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.woff
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.woff
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.woff
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.woff
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.woff
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.woff
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.woff
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.ttf
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.ttf
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Semibold.ttf
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.ttf
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.ttf
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Regular.ttf
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.ttf
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.ttf
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: Failed to decode downloaded font: https://pmrresistencias.com.br/first/Citizens/css/fonts/OpenSans/OpenSans-Bold.ttf
other	warning	URL: https://pmrresistencias.com.br/first/Citizens/otp2.html Message: OTS parsing error: invalid sfntVersion: 1008813135

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn1.onlineaccess1.com
pmrresistencias.com.br
108.179.192.228
192.0.54.4
3133f88ff2d288957e9708cab68a2dd2f25f46177603d9accb70b22bc7601888
44b62296dd491bc6b05441bd4dfc79d12d979d033f5103a176c223c6e87b6823
5fe9be1ee622cde0915ad2e0fd99a1aec935c971201dcbe8ddc63427fc8d103e
722e0f8219375018d795921485032e970952ab5ab3c5d534b024e1693d7f982f
8eb843124995602a054e664b35ec6e254f5516551355900b262fbe309cc6b74b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5682dce3ff292f17a93b2be02783e9ebf58d3465b71f7ca6f31a7e821d92f86
fbb5d60b0e8fbf3ce2eeb2479ad9ef6744585303f9ee0bf27c62b35a0a2dc30a

pmrresistencias.com.br Open in urlscan Pro 108.179.192.228 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

13 Requests

46 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

1142 kBTransfer

4062 kBSize

3 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

3 Cookies

36 Console Messages

Indicators

pmrresistencias.com.br Open in urlscan Pro
108.179.192.228 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

46 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1142 kB
Transfer

4062 kB
Size

3
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!