![](/screenshots/0da6b55b-1522-44a1-8c98-66afeb09a220.png)
www.cartoriojk.com.br
Open in
urlscan Pro
2804:10:8001::208:139
Malicious Activity!
Public Scan
Effective URL: https://www.cartoriojk.com.br/mail/aeea/inters/parcels/home.php?ip=2a01:4f8:192:5414::2&countryCode=&OS=Windows%2010
Submission: On April 25 via manual from IL
Summary
TLS certificate: Issued by R3 on March 5th 2021. Valid for: 3 months.
This is the only time www.cartoriojk.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 12 | 2804:10:8001:... 2804:10:8001::208:139 | 28299 (IPV6 Inte...) (IPV6 Internet Ltda) | |
1 | 185.199.109.153 185.199.109.153 | 54113 (FASTLY) (FASTLY) | |
1 | 2606:4700::68... 2606:4700::6810:125e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 4 |
ASN54113 (FASTLY, US)
PTR: cdn-185-199-109-153.github.com
nosir.github.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
cartoriojk.com.br
3 redirects
www.cartoriojk.com.br |
537 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
11 KB |
1 |
github.io
nosir.github.io |
7 KB |
11 | 3 |
Domain | Requested by | |
---|---|---|
12 | www.cartoriojk.com.br |
3 redirects
www.cartoriojk.com.br
|
1 | cdnjs.cloudflare.com |
www.cartoriojk.com.br
|
1 | nosir.github.io |
www.cartoriojk.com.br
|
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cartoriojk.com.br R3 |
2021-03-05 - 2021-06-03 |
3 months | crt.sh |
www.github.com DigiCert SHA2 High Assurance Server CA |
2020-05-06 - 2022-04-14 |
2 years | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-10-21 - 2021-10-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.cartoriojk.com.br/mail/aeea/inters/parcels/home.php?ip=2a01:4f8:192:5414::2&countryCode=&OS=Windows%2010
Frame ID: 41F8F856BBA84724A7DE26A2F52A7BDD
Requests: 12 HTTP requests in this frame
Screenshot
![](/screenshots/0da6b55b-1522-44a1-8c98-66afeb09a220.png)
Page URL History Show full URLs
-
http://www.cartoriojk.com.br/mail/aeea/inters/parcels
HTTP 302
https://www.cartoriojk.com.br/mail/aeea/inters/parcels HTTP 301
https://www.cartoriojk.com.br/mail/aeea/inters/parcels/ HTTP 302
https://www.cartoriojk.com.br/mail/aeea/inters/parcels/home.php?ip=2a01:4f8:192:5414::2&countryCode=&OS=Wi... Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.cartoriojk.com.br/mail/aeea/inters/parcels
HTTP 302
https://www.cartoriojk.com.br/mail/aeea/inters/parcels HTTP 301
https://www.cartoriojk.com.br/mail/aeea/inters/parcels/ HTTP 302
https://www.cartoriojk.com.br/mail/aeea/inters/parcels/home.php?ip=2a01:4f8:192:5414::2&countryCode=&OS=Windows%2010 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.php
www.cartoriojk.com.br/mail/aeea/inters/parcels/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.cartoriojk.com.br/mail/aeea/inters/parcels/ |
244 KB 245 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cc.css
www.cartoriojk.com.br/mail/aeea/inters/parcels/ |
5 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lg.svg
www.cartoriojk.com.br/mail/aeea/inters/parcels/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cleave.min.js
nosir.github.io/cleave.js/dist/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
date.js
www.cartoriojk.com.br/mail/aeea/inters/parcels/ |
125 B 173 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pub.jpg
www.cartoriojk.com.br/mail/aeea/inters/parcels/ |
80 KB 81 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pubr.gif
www.cartoriojk.com.br/mail/aeea/inters/parcels/ |
8 KB 8 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
imask.min.js
cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/ |
45 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
www.cartoriojk.com.br/mail/aeea/inters/parcels/ |
96 KB 96 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.js
www.cartoriojk.com.br/mail/aeea/inters/parcels/ |
95 KB 96 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 17 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| Cleave object| cleave object| __core-js_shared__ object| core function| IMask function| preventBack object| Modernizr function| $ function| jQuery function| onReady function| setVisible0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
nosir.github.io
www.cartoriojk.com.br
185.199.109.153
2606:4700::6810:125e
2804:10:8001::208:139
24f3e5ffeacabdddb258ab390d49bde1a17bdf7ac112a6f96a57447160163a5e
38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6
4b29570ccd4eb182097a77750e4594c53b889aa7c606ffa0da191ea0bcc82fea
79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171
7eb194c2648de022cb8f29399b9f4409d5ec0cc5314d6e4eea175c78d1d5089a
8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
c1bf237574102e2f75a34a4ab790747a8cc47b8da4f3ca7ae18e4a520ec76e2f
c3b69b4ee8ef3e469b69b3b648adbb41675f3c0ee010ba846e4d7b7433c4085e
d79ec35dc8277aff48adaf9df3ddd5b3e18ac7013e8c374510624ae37cdfba31
df13f3e6498304f37c107740c0229aedfc0cd1ba227d9e86eb9e049d9453254a
fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5