{"report_id":"05b3ca2c-af84-4be2-a349-f85cc13d558b","version":0,"status":"done","tags":[],"date":"2026-07-21T00:22:18Z","url":{"schema":"http","addr":"acessarsafra.digital","fqdn":"acessarsafra.digital","domain":"acessarsafra.digital","tld":"digital"},"ip":{"addr":"153.75.90.204","port":0,"asn":14962,"as":"NCR-252","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"acessarsafra.digital/","fqdn":"acessarsafra.digital","domain":"acessarsafra.digital","tld":"digital"},"title":"Safra Empresas Login | Banco Safra Internet Banking PJ | Safra PJ Entrar | Safra PJ Login","dom":{"size":30637,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1016)","md5":"3e36170c1267c7edcd4b951312d2d080","sha1":"76f172301bc89165aafd56fe158bd1cf2737a998","sha256":"30504119377052c180adec28921cfa61059c7b1efaec685d7cf08d86a5926575","sha512":"b92035e85e4c2759206ccb2186e9a2ae6491fe377fb0b51261b125b2b71343f310f05e7d54e0f1199363537aa5378482193ec64375518566beb4d95719f935e2","ssdeep":"384:FuC9Lkd45lrwAhIDMfaHzlGqo5YoGYAjBK0ectN:/9L/WAhWMO2GoudK0tN","tlshash":"21d2613b4bd5856e8c63020022b9a37f0954609bf501cddb77ed8a3befc8a5695b6f04","dom_hash":"domhash8ea02384e812d3f7e040d2df6d728fe1","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"acessarsafra.digital","fqdn":"acessarsafra.digital","domain":"acessarsafra.digital","tld":"digital"},"ip":{"addr":"153.75.90.204","port":0,"asn":14962,"as":"NCR-252","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-25T00:22:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-21","alert":"Phishing Block","trigger":"acessarsafra.digital","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"acessarsafra.digital","ip":{"addr":"153.75.90.204","port":443,"asn":14962,"as":"NCR-252","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-21T00:22:18.810458Z","last_seen":"2026-07-21T00:22:18.810458Z","alert_count":12,"request_count":3,"received_data":42957,"sent_data":1544,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"acessarsafra.digital/assets/apple-touch-icon.png","fqdn":"acessarsafra.digital","domain":"acessarsafra.digital","tld":"digital"},"ip":{"addr":"153.75.90.204","port":443,"asn":14962,"as":"NCR-252","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://acessarsafra.digital/","date":"2026-07-21T00:21:45.807Z","timestamp":1784593305807,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"acessarsafra.digital","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 17:31:51 GMT","end":"Thu, 15 Oct 2026 17:31:50 GMT"},"fingerprint":{"sha1":"DE:8E:12:A8:BA:AF:C0:1B:7D:8B:48:27:A1:00:F6:7F:87:06:D5:D3","sha256":"EE:A1:4A:F3:41:FF:43:81:CD:2C:24:64:1F:E6:3E:D4:92:79:C4:4C:94:1C:5B:21:1A:F3:DE:5A:B7:56:30:EA"}}},"request":{"raw":"GET /assets/apple-touch-icon.png HTTP/1.1\r\nHost: acessarsafra.digital\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://acessarsafra.digital/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 21 Jul 2026 00:21:45 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 17 Jul 2026 18:33:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a5a7567-4c0\"\r\nexpires: Thu, 20 Aug 2026 00:21:45 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1216,"size_decoded":1735,"mime_type":"image/png","magic":"PNG image data, 57 x 57, 8-bit colormap, non-interlaced","md5":"12e4d05b618aa4287af45205b81accab","sha1":"7328976615f9cb84561abba8e69f857fd64f8980","sha256":"e84398c8622bd3b1ef97bc8809feb0f053a83d71f8b343c2623005be6db25ea0","sha512":"45de824b9e8693357619578209ff8220e3ae8cc99e505f5141d585340d55e207e0a0a65b21c4fa3cab395cf577fd933cf9f185a523c2234bc200d1e3fb78b73d","ssdeep":"","tlshash":"2921a7a783448e5ce81f42b80a750533a74e5c68455b7b0072d3e4f2dfd4e2569960da","first_seen":"2026-07-21T00:22:22.858643Z","last_seen":"2026-07-21T06:39:05.415323Z","times_seen":3,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":135,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-21","alert":"Phishing Block","trigger":"acessarsafra.digital","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"acessarsafra.digital/assets/favicon.ico","fqdn":"acessarsafra.digital","domain":"acessarsafra.digital","tld":"digital"},"ip":{"addr":"153.75.90.204","port":443,"asn":14962,"as":"NCR-252","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://acessarsafra.digital/","date":"2026-07-21T00:21:45.809Z","timestamp":1784593305809,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"acessarsafra.digital","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 17:31:51 GMT","end":"Thu, 15 Oct 2026 17:31:50 GMT"},"fingerprint":{"sha1":"DE:8E:12:A8:BA:AF:C0:1B:7D:8B:48:27:A1:00:F6:7F:87:06:D5:D3","sha256":"EE:A1:4A:F3:41:FF:43:81:CD:2C:24:64:1F:E6:3E:D4:92:79:C4:4C:94:1C:5B:21:1A:F3:DE:5A:B7:56:30:EA"}}},"request":{"raw":"GET /assets/favicon.ico HTTP/1.1\r\nHost: acessarsafra.digital\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://acessarsafra.digital/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 21 Jul 2026 00:21:45 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 9662\r\nlast-modified: Fri, 17 Jul 2026 18:33:11 GMT\r\netag: \"6a5a7567-25be\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9662,"size_decoded":10103,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel","md5":"24f47c2a7fa60919198a0aaee253fac6","sha1":"1d24436f2d7e501a3f5a9ec134ac6692183adae8","sha256":"69791114d7ba5488ee5a62ec77879d4c6a6905615096432dc3f599327917edec","sha512":"434d53c655d8cdc680d97c2c252c0c7f29545796f0d77cd1cfcb03e0e55f0cc1a31509dd9a9416c1a46730fe80a36a4cee72ae369c0caa64e54ae7ca450e193f","ssdeep":"24:96H3nInnI3n4H3YIoIn3X3Y3HnoIXHo3Yo4InnHIo4Io343YHIIoHHoI3onInYo9:9LaPKPnK8d4Jpa/","tlshash":"1212413be30401e8c94c54f96ae3e8b3d1de757b27b34065f6ad5fda59d37086800a12","first_seen":"2026-05-19T18:16:39.774794Z","last_seen":"2026-07-21T06:39:05.415956Z","times_seen":4,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-21","alert":"Phishing Block","trigger":"acessarsafra.digital","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"acessarsafra.digital/","fqdn":"acessarsafra.digital","domain":"acessarsafra.digital","tld":"digital"},"ip":{"addr":"153.75.90.204","port":443,"asn":14962,"as":"NCR-252","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-21T00:21:44.945Z","timestamp":1784593304945,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"acessarsafra.digital","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 17 Jul 2026 17:31:51 GMT","end":"Thu, 15 Oct 2026 17:31:50 GMT"},"fingerprint":{"sha1":"DE:8E:12:A8:BA:AF:C0:1B:7D:8B:48:27:A1:00:F6:7F:87:06:D5:D3","sha256":"EE:A1:4A:F3:41:FF:43:81:CD:2C:24:64:1F:E6:3E:D4:92:79:C4:4C:94:1C:5B:21:1A:F3:DE:5A:B7:56:30:EA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: acessarsafra.digital\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 21 Jul 2026 00:21:45 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 20 Jul 2026 15:02:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a5e38a3-77d9\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30681,"size_decoded":7844,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1017)","md5":"691faa589ad0da27a612cf9c03de6fdb","sha1":"bbc29c2152190a01b71581a21d27c1505633eb6c","sha256":"ac651d9564279d689f93e57c4c8394720e6a7cd5fcd56777b69278d5811a899a","sha512":"14a5c4c191d5658e90e5335ff3a3c1d12acab80aadccb7278c25e9e66044d8f251d284ea3e5a22f487f5a2e860fdf57737fd4dcb4702fdf15db1923d4f8e4602","ssdeep":"384:1KToLkd45lrwAhIDMfaHzlGqo5YoGYAjBK0ectd:moL/WAhWMO2GoudK0td","tlshash":"e4d2613f4bd5856e8863020022b9a37f0954609bf501cddb77ed863befc8a5695b6f04","first_seen":"2026-07-21T00:22:22.860736Z","last_seen":"2026-07-21T06:39:05.41457Z","times_seen":3,"resource_available":true,"data":null}},"time_used":625,"timings":{"blocked":-1,"dns":76,"connect":135,"send":0,"wait":134,"receive":0,"ssl":279},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-21","alert":"Phishing Block","trigger":"acessarsafra.digital","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"acessarsafra.digital","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}