{"report_id":"9946b655-8139-460b-8bd7-a2d50c13ab8b","version":6,"status":"done","tags":[],"date":"2026-05-19T12:18:16Z","url":{"schema":"https","addr":"iperplano.pt/l/mysavings-php//card.php","fqdn":"iperplano.pt","domain":"iperplano.pt","tld":"pt"},"ip":{"addr":"130.185.87.66","port":0,"asn":24768,"as":"Almouroltec Servicos De Informatica E Internet Lda","country":"Portugal","country_code":"PT"},"final":{"url":{"schema":"https","addr":"iperplano.pt/l/mysavings-php//card.php","fqdn":"iperplano.pt","domain":"iperplano.pt","tld":"pt"},"title":"Cembra mySavings","dom":{"size":14224,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2143)","md5":"353434f8a43676cb91413765110ec956","sha1":"2ed88b54bff750b592980c041c6b76e6d3b589a1","sha256":"8367eb5d25ecc10c5b34596e0de05f2679043eb7d8fcb71f37b89b934669bcba","sha512":"547e6689b57b1baab3eff558b800d44243c0ebfb315e1f893448f13807759142cdcf1a5e9308f804e87b44420c629cf1a9edea8f68da850f5ff0716c6de76d6e","ssdeep":"192:VIGf6yZOkwtIQ3jho1LtFa6gM3tZGo7EzgKqKi+J96ECYK1BI0HCYY34XgVX9cAV:VIAPEClf5OI2dwY/WptIO2","tlshash":"2b52e82373ba2124a29395dc6bdb82193578c007f906c66cbaad4551df8fce095f35bc","dom_hash":"domhash1ee015dbb75408147e40c1dc59961ea9","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"iperplano.pt/l/mysavings-php//card.php","fqdn":"iperplano.pt","domain":"iperplano.pt","tld":"pt"},"ip":{"addr":"130.185.87.66","port":0,"asn":24768,"as":"Almouroltec Servicos De Informatica E Internet Lda","country":"Portugal","country_code":"PT"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-23T12:18:16Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-19","alert":"Phishing Block","trigger":"iperplano.pt","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-19","alert":"Sinkholed","trigger":"iperplano.pt","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-19","alert":"Sinkholed","trigger":"iperplano.pt","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"iperplano.pt","ip":{"addr":"130.185.87.66","port":443,"asn":24768,"as":"Almouroltec Servicos De Informatica E Internet Lda","country":"Portugal","country_code":"PT"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-18T12:00:35.371288Z","last_seen":"2026-05-18T12:00:35.371288Z","alert_count":9,"request_count":3,"received_data":567136,"sent_data":1436,"comment":"","tags":null,"fingerprints":[{"name":"PHP:8.5.5","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"iperplano.pt/l/mysavings-php//card.php","fqdn":"iperplano.pt","domain":"iperplano.pt","tld":"pt"},"ip":{"addr":"130.185.87.66","port":443,"asn":24768,"as":"Almouroltec Servicos De Informatica E Internet Lda","country":"Portugal","country_code":"PT"},"introduction_type":"scriptElement","is_inline":true,"md5":"663bf45ab7bc6efbae3a401b04f6248d","sha1":"ba21700f84d9a5748e12f67600986c435203bd37","sha256":"8d87b1c777f8d7e0dd180612c70c527be308835bfed0e7d3306cdb048b3b2515","sha512":"bcad3917405e7cd393e88b354d52c5bab855f410d1165ff3da0ff1a24dc4240f457c32acd4a6a69f9c4c1a021460104d314488676d04f7c09f2ae8125879273b","ssdeep":"48:5jpjlNGFQ7TKY+7Ni0YN1QDJf12E1yzG4VGJ1GzZxnahKpBa0zTwZ9UFQQgfpNyu:5n37TgiTcAEUdWGXnwIxo4I7mBKptIOR","tlshash":"59a111ea35a7251486a734ff5bdfc1087139c0073805ca5cba5c81616fa7da0a3b2abc","size":4670,"data":"","first_seen":"2026-05-01T03:10:02.261633Z","last_seen":"2026-05-19T12:18:18.216641Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"iperplano.pt/l/mysavings-php//card.php","fqdn":"iperplano.pt","domain":"iperplano.pt","tld":"pt"},"ip":{"addr":"130.185.87.66","port":443,"asn":24768,"as":"Almouroltec Servicos De Informatica E Internet Lda","country":"Portugal","country_code":"PT"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-19T12:17:50.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.iperplano.pt","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Apr 2026 21:55:37 GMT","end":"Sat, 04 Jul 2026 21:55:36 GMT"},"fingerprint":{"sha1":"8F:C4:22:A9:6F:0D:6C:A8:5E:A1:D8:32:83:5E:8B:89:F5:2E:F5:90","sha256":"A2:46:35:79:06:8B:58:26:BC:FB:14:B0:15:92:9D:C0:61:57:4A:7C:CA:9B:28:68:8C:97:C9:D6:DE:C6:2D:75"}}},"request":{"raw":"GET /l/mysavings-php//card.php HTTP/1.1\r\nHost: iperplano.pt\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 19 May 2026 12:17:51 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-powered-by: PHP/8.5.5\r\nx-scale: YXBvY2FzQGdpdGh1Yg==\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.5.5","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13980,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2137)","md5":"4dba49df65509095458ea84157766269","sha1":"93a34e7c5f1659b7a4bfe22e9f42c90ebf9cc787","sha256":"b6349a3971d47de498e3855bda478ed83b4d065d7d323b27de838f2de915f5b1","sha512":"03d2d43ce87afd21b4a4216e86946fde612a2ebe052c99bbe34400ec2e549b24fc7375ce5b9387e06730f4af61e3b24423207f729fa23e10fa8965ee6b530cb1","ssdeep":"192:LIGf6yZOkwtIQ3jho1LtFa6gM3tZGo7EzgKqKi+JM6ECYK1BI0R0D7YX9cAEUdWQ:LIAAEClpdwY/WptIOO","tlshash":"d252e82332fa2124a28355dc6bdb52193578c003f506d56cbaae4551df8fce095f3abc","first_seen":"2026-05-01T03:10:02.25761Z","last_seen":"2026-05-19T12:18:18.212364Z","times_seen":6,"resource_available":false,"data":null}},"time_used":2147,"timings":{"blocked":362,"dns":91,"connect":89,"send":0,"wait":1417,"receive":0,"ssl":185},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-19","alert":"Phishing Block","trigger":"iperplano.pt","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-19","alert":"Sinkholed","trigger":"iperplano.pt","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-19","alert":"Sinkholed","trigger":"iperplano.pt","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"iperplano.pt/l/mysavings-php//mountain.png","fqdn":"iperplano.pt","domain":"iperplano.pt","tld":"pt"},"ip":{"addr":"130.185.87.66","port":443,"asn":24768,"as":"Almouroltec Servicos De Informatica E Internet Lda","country":"Portugal","country_code":"PT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://iperplano.pt/l/mysavings-php//card.php","date":"2026-05-19T12:17:52.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.iperplano.pt","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Apr 2026 21:55:37 GMT","end":"Sat, 04 Jul 2026 21:55:36 GMT"},"fingerprint":{"sha1":"8F:C4:22:A9:6F:0D:6C:A8:5E:A1:D8:32:83:5E:8B:89:F5:2E:F5:90","sha256":"A2:46:35:79:06:8B:58:26:BC:FB:14:B0:15:92:9D:C0:61:57:4A:7C:CA:9B:28:68:8C:97:C9:D6:DE:C6:2D:75"}}},"request":{"raw":"GET /l/mysavings-php//mountain.png HTTP/1.1\r\nHost: iperplano.pt\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://iperplano.pt/l/mysavings-php//card.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 19 May 2026 12:17:52 GMT\r\ncontent-type: image/png\r\ncontent-length: 552144\r\nlast-modified: Wed, 21 Jan 2026 14:34:56 GMT\r\nx-cache: MISS\r\nx-type: static\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":552144,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1366 x 253, 8-bit/color RGBA, non-interlaced","md5":"6216030a5b9823ba985bc175e4c92ee7","sha1":"3d17e68a892fd789dcf9650b4bc0e091610b458a","sha256":"ffbe4f1acfd4f2cc88bf7787f58fc6c7333812b0bf563bfd1fc876fbf4b040d0","sha512":"1c60b74b50713f1b402da1493c865b3bbd0712d96a13babe1e266532932704694955963eef28619f2d9a6e5916f1ef8a4a2cb83f6e14fdaa1fdbee7e6d50cba3","ssdeep":"12288:28H+BoN8LRjqjdSziUxo4OVg05z33a2pL:28HEoNYMMOUxozVdBFL","tlshash":"d4c43334f50f47733c432ca0b6a6ad9f26d95351b242ed25472f68f8971ad3328ca9d1","first_seen":"2026-05-01T03:10:02.258865Z","last_seen":"2026-05-19T12:18:18.214163Z","times_seen":5,"resource_available":false,"data":null}},"time_used":18313,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":545,"receive":17768,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-19","alert":"Sinkholed","trigger":"iperplano.pt","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-19","alert":"Phishing Block","trigger":"iperplano.pt","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-19","alert":"Sinkholed","trigger":"iperplano.pt","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"iperplano.pt/favicon.ico","fqdn":"iperplano.pt","domain":"iperplano.pt","tld":"pt"},"ip":{"addr":"130.185.87.66","port":443,"asn":24768,"as":"Almouroltec Servicos De Informatica E Internet Lda","country":"Portugal","country_code":"PT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://iperplano.pt/l/mysavings-php//card.php","date":"2026-05-19T12:17:52.422Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"www.iperplano.pt","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Apr 2026 21:55:37 GMT","end":"Sat, 04 Jul 2026 21:55:36 GMT"},"fingerprint":{"sha1":"8F:C4:22:A9:6F:0D:6C:A8:5E:A1:D8:32:83:5E:8B:89:F5:2E:F5:90","sha256":"A2:46:35:79:06:8B:58:26:BC:FB:14:B0:15:92:9D:C0:61:57:4A:7C:CA:9B:28:68:8C:97:C9:D6:DE:C6:2D:75"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: iperplano.pt\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://iperplano.pt/l/mysavings-php//card.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Tue, 19 May 2026 12:17:52 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":355,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-07-23T17:50:44.287573Z","times_seen":46819,"resource_available":true,"data":null}},"time_used":6211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-05-19","alert":"Sinkholed","trigger":"iperplano.pt","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-19","alert":"Sinkholed","trigger":"iperplano.pt","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-19","alert":"Phishing Block","trigger":"iperplano.pt","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}