netbanco.info Open in urlscan Pro
104.21.20.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://netbanco.info/
Effective URL:
https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Submission: On September 13 via api (September 13th 2023, 9:38:14 pm UTC) from US — Scanned from PT

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 104.21.20.55, located in and belongs to CLOUDFLARENET, US. The main domain is netbanco.info.
TLS certificate: Issued by E1 on September 13th 2023. Valid for: 3 months.

This is the only time netbanco.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.67.191.204 172.67.191.204	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	104.21.20.55 104.21.20.55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	69.16.175.10 69.16.175.10	20446 (STACKPATH...) (STACKPATH-CDN)
1	172.67.70.233 172.67.70.233	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	3

1 172.67.191.204 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

netbanco.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 104.21.20.55 (None, )

ASN13335 (CLOUDFLARENET, US)

netbanco.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.16.175.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.70.233 (United States)

ASN13335 (CLOUDFLARENET, US)

get.geojs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	netbanco.info 1 redirects netbanco.info	301 KB
1	geojs.io get.geojs.io — Cisco Umbrella Rank: 17101	879 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 918	30 KB
16	3

	Domain	Requested by
15	netbanco.info	1 redirects code.jquery.com netbanco.info
1	get.geojs.io	netbanco.info
1	code.jquery.com	netbanco.info
16	3

This site contains no links.

Subject Issuer	Validity	Valid
netbanco.info E1	`2023-09-13` - `2023-12-12`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-11` - `2024-04-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Frame ID: 5BC0A8C7764201D38F993F02A5BFDA2F
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netlogo

Page URL History Show full URLs

http://netbanco.info/ HTTP 301
https://netbanco.info/ Page URL
https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

332 kB
Transfer

872 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://netbanco.info/ HTTP 301
https://netbanco.info/ Page URL
https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://netbanco.info/ HTTP 301
https://netbanco.info/

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
netbanco.info/
Redirect Chain

http://netbanco.info/
https://netbanco.info/

747 B
945 B

249ms
135ms

Document
text/html

104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e7634d95da2fbcbce16e51808e2fcba7b2ec4b4904ea754eb29583e4a02ccc7e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: pt-PT,pt;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 80638913bcdd2174-MAD
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 13 Sep 2023 21:38:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6CnPOp%2BjrOnphV3lAJAadfBiXoyvhtX9fQHKr6mrJTolPLSVJ81fKxGHyGZpfWJKaM20z7k4UWJF2QxFZl9rRG51X%2FBEqLQLOcse%2FeSo74I%2Bm5cKyE91Gg1fQWXnCf5C"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: Express

Redirect headers

CF-RAY: 806389128d87661d-MAD
Cache-Control: max-age=3600
Connection: keep-alive
Date: Wed, 13 Sep 2023 21:38:08 GMT
Expires: Wed, 13 Sep 2023 22:38:08 GMT
Location: https://netbanco.info/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eQ5uVONLBLHrUQ0dhwhqwxtWMeNWPuOmVtACpzirQom7hqh8iu9L4erX9embDAc%2FM5ybPvEi2jIXtq1AzXGQMndh8UkdA6jqC4%2F19EjIHf2MqXyQgiwKnaISjOJ8L3Ti"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 207ms
79ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: netbanco.info
URL: https://netbanco.info/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: hwcdn.net
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://netbanco.info/
Origin: https://netbanco.info
accept-language: pt-PT,pt;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:08 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-15d9d"
surrogate-control: max-age=315360000;hw-h2proxy
vary: Accept-Encoding
x-hw: 1694641088.cdn4-pxy202-mad02.ma1.evs,1694641088.cds208.ma1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000,public
accept-ranges: bytes
content-length: 30875

GET
H2 200 geo.js Show response
get.geojs.io/v1/ip/ 375 B
879 B 219ms
102ms Script
application/javascript 172.67.70.233
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.geojs.io/v1/ip/geo.js

Requested by

Host: netbanco.info
URL: https://netbanco.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.70.233 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c0434511c0d5c5a9e887f1f2bf65d13eceae60339e3bbad4b210f72f4101277

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://netbanco.info/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:08 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-request-id: 726ebd1dcd27e4f9c62b6f9d3d9cf8f9-AMS
x-geojs-location: AMS
pragma: no-cache
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=waqk%2FBjki%2BfLr91GWLklijG5duBzK8JH06lXB%2B74mb%2BlTH4F470U97xq6vCHVqJF1SECUg%2FogdBHaWj9rHv8UxAxzjtKdL0yHrV%2BjuHqb9PmG4F3ci2%2Bxm25ReB3%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
cf-ray: 806389154ad969df-MAD

GET
H2 200 WAM764IZLPNE4HN2TS01Y5RU4C.html
netbanco.info/ 80 B
515 B 111ms
110ms XHR
text/html 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C.html?ip=91.205.230.203&loc=PT&city=Lisbon&reg=Lisbon
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Referer: https://netbanco.info/
X-Requested-With: XMLHttpRequest
accept-language: pt-PT,pt;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JO9AOEQsZGQxDxxu1lRjhmyas8O%2Bm1tBbjc19FNruRxX8IEdpudAAZVAfPzDkIG94T1rzYL3mlJp8mJQ53baZqphI9Nz2CuvTmY6gw6ApS5v6sgp7axXO13DBn1an%2FPQ"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
cf-ray: 80638916fb082174-MAD
alt-svc: h3=":443"; ma=86400

GET
H3 200 Primary Request login Show response
netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/ 60 KB
9 KB 131ms
131ms Document
text/html 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Requested by: Host: netbanco.info
URL: https://netbanco.info/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d96648e7e0e4026d483e29414138fae6a4ace59975e70151610a98bf1acb29d0

Request headers

Referer: https://netbanco.info/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: pt-PT,pt;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 80638917bf053d13-CDG
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 13 Sep 2023 21:38:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RsitYsRQoqmA5TaBun9XzuuKiWywDqrAtHil6Onp60RtOCnw8M7ULQ0%2BRzi2vrGXSZcQEoUPwjQyaF8qYg61YPCvh5o6HetVGZZ3yL3Ab0ikQ8x62C0mXHHY4a1HmHqb"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: Express

GET
H3 200 login_and_register.css
netbanco.info/ficheros/modern/css/ 44 KB
9 KB 148ms
147ms Stylesheet
text/css 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/ficheros/modern/css/login_and_register.css?v=1655293257536
Requested by: Host: netbanco.info
URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 6e6fa84f10fb168b88343be650bc8c0a892154f189da86b72885916773c36342

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 20 Jun 2022 19:09:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"ae30-181828554a8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SKjVjGyO6haW%2FPNPMrG4Pu9QOu2CzwFkxWe2a20LTOGxVcjgzOsaBJHLso2qC9zJ%2BfX8CPYoBtrPLTMPWsik4RJ1bgRc7a%2FMgnAgHCc5HKRmsad5G5lNNI129mShImlN"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 806389189fbb3d13-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 fonts.css
netbanco.info/ficheros/modern/css/ 4 KB
916 B 129ms
128ms Stylesheet
text/css 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/ficheros/modern/css/fonts.css?v=1655293257536
Requested by: Host: netbanco.info
URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 2f0e67192e014a837002fff61326afa99204d4b19c1b7c3d3a0c95fe4eea32df

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 20 Jun 2022 19:09:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"118b-181828577d0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J42R9pVMuWzTZYerkgx%2FEBiIqTVU0trYqlUF2BfmuPOc8kfePmdJT9RpcZn1BQmY2nTm89l2%2B7MV2PNslIKZ4V8rwd4so3EfNqDTXpkmCrXCIXrZAkLjsJ1ulc%2FYbAxo"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 806389189fbd3d13-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 nbp_popin.css
netbanco.info/ficheros/ 4 KB
2 KB 146ms
145ms Stylesheet
text/css 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/ficheros/nbp_popin.css?v=1655293257536
Requested by: Host: netbanco.info
URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a19999a6c4c3ced7c5b10218a9c57b2dbc23284893ca44c9e3ff15cfa1379386

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 20 Jun 2022 19:10:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"ebc-18182858f40"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sm2hN8q%2Bd75FWdHbTd9CmEOo2O0n6F6W%2BKXqU9KtFY%2B9DANeGUP5VHpHVRhgIQCpC0kTp0xeKhbs7ztIhEJbjjkSYhb6VDpRt7c2c0Ydw2PwCTcGR8Az7GFLs6w51s8Z"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 806389189fbe3d13-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 santander-logo-red.svg
netbanco.info/ficheros/modern/images/icons/ 3 KB
2 KB 342ms
341ms Image
image/svg+xml 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://netbanco.info/ficheros/modern/images/icons/santander-logo-red.svg
Requested by: Host: netbanco.info
URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 5ba78ace4566a255ad507449ba7d10f5013f5e6ef6bc027dfcf762c3817aeac2

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 20 Jun 2022 19:14:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"bc3-18182897f10"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EkVHqCeTGF7IgWqog9BldLVIp7btsLfplyRb8O7QgOu4uvhbha33L6ZlN%2BgyC4gZJJh8Zc7%2B1jwe0Y7q763fyWEeGDWhcXahtGBUtE%2Fga9GgSGzvFM1WRDFhu%2Bw2OzMV"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 80638918afcf3d13-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 login-image-0.svg
netbanco.info/ficheros/modern/images/icons/ 14 KB
5 KB 343ms
342ms Image
image/svg+xml 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://netbanco.info/ficheros/modern/images/icons/login-image-0.svg
Requested by: Host: netbanco.info
URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 768a38021128a2657d6267b5681dc037f9cd59f7b3b2c42a9c39879811089b16

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 20 Jun 2022 19:20:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"368e-181828f6e98"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r8usyz1W233Nzhbre823JMvhZrytI72b4xsHonjeVtf77m7Vu1WDB8rOY7vI65Hs%2BPRuOmvw5m5wluJWOkqCDy7hxLCfpYiJi7knbt0%2F7BM8Ug2jz5tkhIj7wDsVRHnk"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 80638918afd03d13-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 error-icon.svg
netbanco.info/ficheros/modern/images/icons/ 517 B
806 B 128ms
128ms Image
image/svg+xml 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://netbanco.info/ficheros/modern/images/icons/error-icon.svg
Requested by: Host: netbanco.info
URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 8e205ca689077232aa4e68ece422b47e83fcfb8da115d53fef7f71545786abdb

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 20 Jun 2022 19:29:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"205-181829707e8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JMjv%2FZARZX0iZkuxOumEUKtpBqAQJJ7xgFuk04zVRli%2F%2FeWLcbhGa868b%2BWjszJ8ZmtkoSU6SdiXVRVvRUInWXFlJ7dn8LYjM80eUQ7cxa9jyHcxpxNIDCH%2BS2UAE9Fn"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 80638918afd13d13-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery.min.js Show response
netbanco.info/plugins/jquery/ 87 KB
32 KB 199ms
198ms Script
application/javascript 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/plugins/jquery/jquery.min.js
Requested by: Host: netbanco.info
URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 07 Feb 2022 20:33:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"15d9d-17ed5e3e388"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JAYilMM7Ux0qZuGiwMXn8EF3zCfA1VkYdgIYQifuLpn7IYEIckbH54Uh15CdLwmNNM0VYWtEukWfN3%2BmijVoneVWP8bkoUmoQHkEHZn8oOk0RvmJkCB2lAOUKApalbTj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 80638918afcc3d13-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 BEYAM5g3ZYkBxnx9bhxi.js Show response
netbanco.info/ 427 KB
98 KB 270ms
269ms Script
application/javascript 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/BEYAM5g3ZYkBxnx9bhxi.js
Requested by: Host: netbanco.info
URL: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0afbafc1a47a0abcf601975e9f95019633769f405ae83219f0b4218346d68ab7

Request headers

accept-language: pt-PT,pt;q=0.9
Referer: https://netbanco.info/WAM764IZLPNE4HN2TS01Y5RU4C/login
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 10 Aug 2022 17:25:11 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"6aa12-18288c9ecd8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xNYYH7Dm5T1fA3iqwQNYRWbWGLp251ycKmJseqIU2qaQZFm61BPL1MNO6QedXOESogPnM16YJ4CdcdyOgqMBviEE47WZ%2BVv5cKH8mJUNc0c2e9weBQo6hMKIF9CLeNw7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 80638918afce3d13-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 SantanderTextW05-Regular.woff2
netbanco.info/ficheros/modern/fonts/ 46 KB
46 KB 140ms
140ms Font
font/woff2 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/ficheros/modern/fonts/SantanderTextW05-Regular.woff2
Requested by: Host: netbanco.info
URL: https://netbanco.info/ficheros/modern/css/fonts.css?v=1655293257536
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: df7abc314cf6e0380973cea5ad3cd7a4536b820d974162c9d94f534f539eef0b

Request headers

Referer: https://netbanco.info/ficheros/modern/css/fonts.css?v=1655293257536
Origin: https://netbanco.info
accept-language: pt-PT,pt;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
cf-cache-status: MISS
last-modified: Mon, 20 Jun 2022 19:14:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"b630-181828a1380"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fFmNk2ekix1lZIlWPZUfM3v98MGONkxxdvZ6Jwb4xq4jr%2Bn0HpHotxaCj7gcSrIl9fvyQIf4RZEshgddB9CQVK%2By87A%2Fi5sBF5C3k79i1FAL%2FqRTm8QtKQjHoPMSeiCI"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 80638919f8a13d13-CDG
alt-svc: h3=":443"; ma=86400
content-length: 46640

GET
H3 200 SantanderHeadlineW05-Bold.woff2
netbanco.info/ficheros/modern/fonts/ 48 KB
48 KB 205ms
204ms Font
font/woff2 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/ficheros/modern/fonts/SantanderHeadlineW05-Bold.woff2
Requested by: Host: netbanco.info
URL: https://netbanco.info/ficheros/modern/css/fonts.css?v=1655293257536
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d9292f5aeb67c87cd795b51fcd918e5d2b5a5adb7fa66659e82ad4b67471e6d3

Request headers

Referer: https://netbanco.info/ficheros/modern/css/fonts.css?v=1655293257536
Origin: https://netbanco.info
accept-language: pt-PT,pt;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
cf-cache-status: MISS
last-modified: Mon, 20 Jun 2022 19:31:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"bef4-18182994a08"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5e6ca7KrZ7KHjs3kQoGSVH9sdRDBKSIRqWmGCJYC4Y7rHW%2BFMnM8tTWNTvNFp0K5xzcjgBNC%2Bsml1U2%2FlfQziw9ECFpPVl4ERzXAv%2Fx8f5gJtsBGKQN9K4jnLBM%2Fw2QR"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 80638919f8a53d13-CDG
alt-svc: h3=":443"; ma=86400
content-length: 48884

GET
H3 200 SantanderTextW05-Bold.woff2
netbanco.info/ficheros/modern/fonts/ 48 KB
48 KB 206ms
205ms Font
font/woff2 104.21.20.55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netbanco.info/ficheros/modern/fonts/SantanderTextW05-Bold.woff2
Requested by: Host: netbanco.info
URL: https://netbanco.info/ficheros/modern/css/fonts.css?v=1655293257536
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.55 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ec6c6c35a35bb74b562f10541e42adcb73c8bf54fbbd2a2999078bde1a279e29

Request headers

Referer: https://netbanco.info/ficheros/modern/css/fonts.css?v=1655293257536
Origin: https://netbanco.info
accept-language: pt-PT,pt;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Sep 2023 21:38:09 GMT
cf-cache-status: MISS
last-modified: Mon, 20 Jun 2022 19:31:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"bfb0-181829922f8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gmbFl98nBTGqk2dlDoQoNo2a%2FtFbpZKX66XC4C38nki9ZYOXc001WxwjSUBOhfihJmzqeIQh%2Bmw%2BDayZtxFi67Ox5K5bnEXJDVSmlJzDChdzA3Y%2Fhcxm1LEbkf%2Fai9rh"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 80638919f8a63d13-CDG
alt-svc: h3=":443"; ma=86400
content-length: 49072

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
netbanco.info/	1970-01-20 14:59:02	Name: csrf-token Value: C4UR5Y10ST2NH4ENPLZI467MAW
netbanco.info/	1970-01-20 14:59:02	Name: visitor Value: 65022bc147506f6ca5dbc7d0
netbanco.info/	1970-01-20 14:59:02	Name: userId Value: 2WYFG2MFUTV71

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
get.geojs.io
netbanco.info
104.21.20.55
172.67.191.204
172.67.70.233
69.16.175.10
0afbafc1a47a0abcf601975e9f95019633769f405ae83219f0b4218346d68ab7
2f0e67192e014a837002fff61326afa99204d4b19c1b7c3d3a0c95fe4eea32df
5ba78ace4566a255ad507449ba7d10f5013f5e6ef6bc027dfcf762c3817aeac2
6e6fa84f10fb168b88343be650bc8c0a892154f189da86b72885916773c36342
768a38021128a2657d6267b5681dc037f9cd59f7b3b2c42a9c39879811089b16
8e205ca689077232aa4e68ece422b47e83fcfb8da115d53fef7f71545786abdb
9c0434511c0d5c5a9e887f1f2bf65d13eceae60339e3bbad4b210f72f4101277
a19999a6c4c3ced7c5b10218a9c57b2dbc23284893ca44c9e3ff15cfa1379386
d9292f5aeb67c87cd795b51fcd918e5d2b5a5adb7fa66659e82ad4b67471e6d3
d96648e7e0e4026d483e29414138fae6a4ace59975e70151610a98bf1acb29d0
df7abc314cf6e0380973cea5ad3cd7a4536b820d974162c9d94f534f539eef0b
e7634d95da2fbcbce16e51808e2fcba7b2ec4b4904ea754eb29583e4a02ccc7e
ec6c6c35a35bb74b562f10541e42adcb73c8bf54fbbd2a2999078bde1a279e29
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

netbanco.info Open in urlscan Pro 104.21.20.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

332 kBTransfer

872 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

3 Cookies

Indicators

netbanco.info Open in urlscan Pro
104.21.20.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

332 kB
Transfer

872 kB
Size

3
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!