caixa.app-tem.com
Open in
urlscan Pro
84.32.34.39
Malicious Activity!
Public Scan
URL:
https://caixa.app-tem.com/
Submission: On August 30 via automatic, source certstream-suspicious — Scanned from DE
Submission: On August 30 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 15 HTTP transactions.
The main IP is 84.32.34.39, located in
Chicago, United States and
belongs to CHERRYSERVERS3-AS, LT.
The main domain is caixa.app-tem.com.
TLS certificate: Issued by E5 on August 30th 2024. Valid for: 3 months.
This is the only time caixa.app-tem.com was scanned on urlscan.io!
TLS certificate: Issued by E5 on August 30th 2024. Valid for: 3 months.
This is the only time caixa.app-tem.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Caixa (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 14 | 84.32.34.39 84.32.34.39 | 204770 (CHERRYSER...) (CHERRYSERVERS3-AS) | |
| 1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 15 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
app-tem.com
caixa.app-tem.com |
460 KB |
| 1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
25 KB |
| 15 | 2 |
| Domain | Requested by | |
|---|---|---|
| 14 | caixa.app-tem.com |
caixa.app-tem.com
|
| 1 | cdnjs.cloudflare.com |
caixa.app-tem.com
|
| 15 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| caixa.app-tem.com E5 |
2024-08-30 - 2024-11-28 |
3 months | crt.sh |
| cdnjs.cloudflare.com WE1 |
2024-07-31 - 2024-10-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://caixa.app-tem.com/
Frame ID: AEF915CF374364AB3F901EF44391823B
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
Entrar em Login CaixaDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
caixa.app-tem.com/ |
12 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
caixa.app-tem.com/ |
227 KB 227 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
all.min.css
caixa.app-tem.com/ |
100 KB 100 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.css
caixa.app-tem.com/ |
618 B 864 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
crypto-js.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/ |
187 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.css
caixa.app-tem.com/ |
22 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fsso.css
caixa.app-tem.com/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-caixa.png
caixa.app-tem.com/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
interrogacao.svg
caixa.app-tem.com/ |
1021 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.6.0.min.js
caixa.app-tem.com/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.mask.min.js
caixa.app-tem.com/ |
8 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon.png
caixa.app-tem.com/ |
629 B 876 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
futuraBook.woff
caixa.app-tem.com/fonts/futuraBook/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
futuraBook.ttf
caixa.app-tem.com/fonts/futuraBook/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
caixa_tem.png
caixa.app-tem.com/assets/img/ |
564 B 391 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Caixa (Government)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| CryptoJS function| handleNext function| isValidCPF function| $ function| jQuery object| $jscomp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
caixa.app-tem.com
cdnjs.cloudflare.com
104.17.25.14
84.32.34.39
16ee7f3d53462650bbd32e263c48c0ea759574fcf620c681ad719008912c461a
18dd58de93c12b47becc5f5c3b92b11faf1b8f7e894d68fb6f2d6c70327835bf
1edb1725a9ea8ca4dcf2f5508cee183218aa1685e47c1b23056717f754f58ebf
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
2cab2af14299ccc106684a845969351547bf25728549be8d188bafc646a6868c
a10b2226b24cb524fc090fc6b617601ddfa9c6bfc32b95c415b8057f0b32b340
b6d5e5272293d6212040ade68138e4a3eb698739603c6be040b940a3e4acbce2
c6826494432163d74fd27e78ad011a13d55e4670441cd49fc9f1e52a4afd28d9
e81e9ba5106aec8b1d94dcf7384ba44c04711b98243d363cb96dfb06fc732268
eb36e7473ecb490885c097151ae7b39578df4140aaf254db51b4082f83840dc1
ec3798f7abdb1db67c9a7b63868a69a70b0cae033c8799162b3e1ffe76c95d28
ed6f6f2144998175c846a99d2a0faab5bf7b6ace318f0fe2dc4bfeaf4700c1d8
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e