petvillegoiania.com.br
Open in
urlscan Pro
108.179.193.118
Malicious Activity!
Public Scan
Effective URL: http://petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/verify?L09WNi8pUjNBJTNFRmdlM2s0QnVUVWFlZnJ6Q3IzJTNFJTYwR0s1QiU3RHN+Snp3O...
Submission: On August 24 via manual from US — Scanned from US
Summary
This is the only time petvillegoiania.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 185.175.47.112 185.175.47.112 | 50340 (SELECTEL-MSK) (SELECTEL-MSK) | |
1 8 | 108.179.193.118 108.179.193.118 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.86.247.97 104.86.247.97 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
9 | 3 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 108-179-193-118.unifiedlayer.com
petvillegoiania.com.br |
ASN16625 (AKAMAI-AS, US)
PTR: a104-86-247-97.deploy.static.akamaitechnologies.com
secure.aadcdn.microsoftonline-p.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
petvillegoiania.com.br
1 redirects
petvillegoiania.com.br |
332 KB |
1 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 13592 |
2 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 231 |
27 KB |
1 |
vtambove.ru
1 redirects
vtambove.ru |
1 KB |
9 | 4 |
Domain | Requested by | |
---|---|---|
8 | petvillegoiania.com.br |
1 redirects
petvillegoiania.com.br
|
1 | secure.aadcdn.microsoftonline-p.com |
petvillegoiania.com.br
|
1 | cdnjs.cloudflare.com |
petvillegoiania.com.br
|
1 | vtambove.ru | 1 redirects |
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
secure.aadcdn.microsoftonline-p.com Microsoft Azure TLS Issuing CA 06 |
2022-10-21 - 2023-10-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/verify?L09WNi8pUjNBJTNFRmdlM2s0QnVUVWFlZnJ6Q3IzJTNFJTYwR0s1QiU3RHN+Snp3OChabn5PaTM2SSU2ME8lNUVOKjkzNiYmei5GdmlWdihrVGF1UG9YeEV5YVZDaHNPJTNDJkNMMkxJJTdEOFolN0JaJE9Sd25lNCpTRFdoJTVFOGlHQ2I2SDFBYltDNHMlN0RoSC5nJTdCQjQ5aG1KcXpdfm1vJTNDSCxicCU3QnNOKWgxelVFVS5ZNndUcCpxXzJRLG5rViU1RUhnZEUlNUVXcX5SLjVaeDJbbkNrVi55UWlRb1JXbl05QnMzeWZqNCU1RXRWT1NbRylWLXhpX2V2MTUlM0UkJTVFVDNIZSo5KTMzWH41SnFHNm1ReTJVbCouQ0tJbm9fci9JU0RVRkhpdWRzaGZuaURVRml1L3ZlcmlmeT8pUjNBJTNFRmdlM2s0QnVUVWFlZnJ6Q3IzJTNFYEdLNUJ9c35Kenc4KFpufk9pMzZJYE9eTio5MzYmJnouRnZpVnYoa1RhdVBvWHhFeWFWQ2hzTyUzQyZDTDJMSX04WntaJE9Sd25lNCpTRFdoXjhpR0NiNkgxQWJbQzRzfWhILmd7QjQ5aG1KcXpdfm1vJTNDSCxicHtzTiloMXpVRVUuWTZ3VHAqcV8yUSxua1ZeSGdkRV5XcX5SLjVaeDJbbkNrVi55UWlRb1JXbl05QnMzeWZqNF50Vk9TW0cpVi14aV9ldjE1JTNFJF5UM0hlKjkpMzNYfjVKcUc2bVF5MlVsKi5DS0lub19yLg==WEQOq46Y-3G97-jdZ5-wv6G-WiSd0KwNADFs_pDP9LTeouys6VfIR4qSxmFn23MlthXcwZbi7zYQGW1dHgOENjazkRuePq2ZpavWJ9BX3slfgAjoG5wCV8hMm1UbFrOILDKcTxStntLpleaEXSm42g1MWv6FcUxGj5nrOwBRCkJTIsyNqY9hu3DKH07&status=putuser
Frame ID: B55681C1E811F114B3DCD0178374397A
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Confirm your informationPage URL History Show full URLs
-
https://vtambove.ru/go_links.php?https://petvillegoiania.com.br/OV6/
HTTP 302
http://petvillegoiania.com.br/OV6/ Page URL
-
http://petvillegoiania.com.br/OV6/)R3A%3EFge3k4BuTUaefrzCr3%3E%60GK5B%7Ds~Jzw8(Zn~Oi36I%60O%5EN*936&&z.Fvi...
HTTP 302
http://petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/verify?L09WNi8pUjNBJTNFRmdlM2s0QnVUVWFlZnJ6Q3IzJTNFJ... Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://vtambove.ru/go_links.php?https://petvillegoiania.com.br/OV6/
HTTP 302
http://petvillegoiania.com.br/OV6/ Page URL
-
http://petvillegoiania.com.br/OV6/)R3A%3EFge3k4BuTUaefrzCr3%3E%60GK5B%7Ds~Jzw8(Zn~Oi36I%60O%5EN*936&&z.FviVv(kTauPoXxEyaVChsO%3C&CL2LI%7D8Z%7BZ$ORwne4*SDWh%5E8iGCb6H1Ab[C4s%7DhH.g%7BB49hmJqz]~mo%3CH,bp%7BsN)h1zUEU.Y6wTp*q_2Q,nkV%5EHgdE%5EWq~R.5Zx2[nCkV.yQiQoRWn]9Bs3yfj4%5EtVOS[G)V-xi_ev15%3E$%5ET3He*9)33X~5JqG6mQy2Ul*.CKIno_r/ISDUFHiudshfniDUFiu/verify?)R3A%3EFge3k4BuTUaefrzCr3%3E`GK5B}s~Jzw8(Zn~Oi36I`O^N*936&&z.FviVv(kTauPoXxEyaVChsO%3C&CL2LI}8Z{Z$ORwne4*SDWh^8iGCb6H1Ab[C4s}hH.g{B49hmJqz]~mo%3CH,bp{sN)h1zUEU.Y6wTp*q_2Q,nkV^HgdE^Wq~R.5Zx2[nCkV.yQiQoRWn]9Bs3yfj4^tVOS[G)V-xi_ev15%3E$^T3He*9)33X~5JqG6mQy2Ul*.CKIno_r.
HTTP 302
http://petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/verify?L09WNi8pUjNBJTNFRmdlM2s0QnVUVWFlZnJ6Q3IzJTNFJTYwR0s1QiU3RHN+Snp3OChabn5PaTM2SSU2ME8lNUVOKjkzNiYmei5GdmlWdihrVGF1UG9YeEV5YVZDaHNPJTNDJkNMMkxJJTdEOFolN0JaJE9Sd25lNCpTRFdoJTVFOGlHQ2I2SDFBYltDNHMlN0RoSC5nJTdCQjQ5aG1KcXpdfm1vJTNDSCxicCU3QnNOKWgxelVFVS5ZNndUcCpxXzJRLG5rViU1RUhnZEUlNUVXcX5SLjVaeDJbbkNrVi55UWlRb1JXbl05QnMzeWZqNCU1RXRWT1NbRylWLXhpX2V2MTUlM0UkJTVFVDNIZSo5KTMzWH41SnFHNm1ReTJVbCouQ0tJbm9fci9JU0RVRkhpdWRzaGZuaURVRml1L3ZlcmlmeT8pUjNBJTNFRmdlM2s0QnVUVWFlZnJ6Q3IzJTNFYEdLNUJ9c35Kenc4KFpufk9pMzZJYE9eTio5MzYmJnouRnZpVnYoa1RhdVBvWHhFeWFWQ2hzTyUzQyZDTDJMSX04WntaJE9Sd25lNCpTRFdoXjhpR0NiNkgxQWJbQzRzfWhILmd7QjQ5aG1KcXpdfm1vJTNDSCxicHtzTiloMXpVRVUuWTZ3VHAqcV8yUSxua1ZeSGdkRV5XcX5SLjVaeDJbbkNrVi55UWlRb1JXbl05QnMzeWZqNF50Vk9TW0cpVi14aV9ldjE1JTNFJF5UM0hlKjkpMzNYfjVKcUc2bVF5MlVsKi5DS0lub19yLg==WEQOq46Y-3G97-jdZ5-wv6G-WiSd0KwNADFs_pDP9LTeouys6VfIR4qSxmFn23MlthXcwZbi7zYQGW1dHgOENjazkRuePq2ZpavWJ9BX3slfgAjoG5wCV8hMm1UbFrOILDKcTxStntLpleaEXSm42g1MWv6FcUxGj5nrOwBRCkJTIsyNqY9hu3DKH07&status=putuser Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://vtambove.ru/go_links.php?https://petvillegoiania.com.br/OV6/ HTTP 302
- http://petvillegoiania.com.br/OV6/
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
petvillegoiania.com.br/OV6/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
verify
petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/ Redirect Chain
|
25 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/ |
84 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/css/ |
95 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ellipsis_grey.svg
petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/images/ |
915 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ellipsis_grey.svg
petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/images/ |
915 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
excelm.png
petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/images/ |
292 KB 292 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
putmailphonskyp.png
petvillegoiania.com.br/OV6/ISDUFHiudshfniDUFiu/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _0x2030 function| isBot function| _0x322d function| $ function| jQuery function| generateRandomString string| statos string| actnn string| actnn2 string| rndstr1 string| rndstr2 string| haserr string| plchol string| plchol2 string| arrl object| style function| checkdom object| xTag string| locathref function| makeInputHere function| validateForm function| submitForm function| onkeypressFunction object| r string| randpart object| xmlhttp string| htmlinp string| htmlinp23 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
vtambove.ru/ | Name: 66ru Value: 64e7b0c766d6e |
|
.vtambove.ru/ | Name: PHPSESSID Value: cbm96elrcgncu15jcbjfsq0f82 |
|
petvillegoiania.com.br/ | Name: PHPSESSID Value: 51fff146add382dbc2c037c49e684c3a |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
petvillegoiania.com.br
secure.aadcdn.microsoftonline-p.com
vtambove.ru
104.17.24.14
104.86.247.97
108.179.193.118
185.175.47.112
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
4c5baf8e9718c7850e35feee47052a6ba5c52856ff89a48442d530b41037c741
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
a922dba831d2d9cb2d3716f28b801f7e26a95fa1da223f4d951dc5f97ea9d45b
f360565d5eb99983582c07bc506f372db00ffa3e4187779bd520214fe0fce646
f900559d873136ec596438b7de435380961b70d80fb79666342875968921be2f