158.197.95.34.bc.googleusercontent.com
Open in
urlscan Pro
34.95.197.158
Malicious Activity!
Public Scan
URL:
https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_pass_error.php?secury=21,03,54,PM,48,2,02,000000,18,9,2020,Tuesda...
Submission Tags: @ipnigh
Submission: On February 20 via api from GB
Submission Tags: @ipnigh
Submission: On February 20 via api from GB
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 12 HTTP transactions.
The main IP is 34.95.197.158, located in
United States and
belongs to GOOGLE, US.
The main domain is 158.197.95.34.bc.googleusercontent.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 30th 2020. Valid for: 3 months.
This is the only time 158.197.95.34.bc.googleusercontent.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on January 30th 2020. Valid for: 3 months.
This is the only time 158.197.95.34.bc.googleusercontent.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 34.95.197.158 34.95.197.158 | 15169 (GOOGLE) (GOOGLE) | |
| 12 | 1 |
12
34.95.197.158
(United States)
ASN15169 (GOOGLE, US)
PTR: 158.197.95.34.bc.googleusercontent.com
ASN15169 (GOOGLE, US)
PTR: 158.197.95.34.bc.googleusercontent.com
| 158.197.95.34.bc.googleusercontent.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
googleusercontent.com
158.197.95.34.bc.googleusercontent.com |
221 KB |
| 12 | 1 |
| Domain | Requested by | |
|---|---|---|
| 12 | 158.197.95.34.bc.googleusercontent.com |
158.197.95.34.bc.googleusercontent.com
|
| 12 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| prefeitura.municipal.tributos.iptu2020.rcshpg.com.br Let's Encrypt Authority X3 |
2020-01-30 - 2020-04-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_pass_error.php?secury=21,03,54,PM,48,2,02,000000,18,9,2020,Tuesday;.dll
Frame ID: 9906EAC0DD2591EC30EF4B84E6D1BE22
Requests: 12 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Ubuntu
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Ubuntu/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
router_pass_error.php
158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/ |
11 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.css
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/ |
196 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
_home.css
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo2.png
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/ |
41 KB 41 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
30horas.png
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
empresa.png
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
apagar.png
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lateral.png
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/ |
138 KB 138 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.2.1.min.js
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.js
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
padrao_mk.js
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cpf.js
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate string| Cod function| SetNovo function| randomize function| preenche function| resetForm number| a string| text object| texto object| array_texto0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
158.197.95.34.bc.googleusercontent.com
34.95.197.158
27bca583762f22fc8243239d412a12bf8013f5759f16de61e4ede64e3995a2c9
305548fd47969838632e728513aeaa10fa877cdc2760440163f8f0a0b001c179
30bdac7863e281c4a40fd3486434041fafa2fa73ecc77c8efb6ea785bd2a0ba9
450f0a54063643428ac021b8b70c0f1180dce15e46e87c73b48bf77151bf4bd5
67c7b905c66f2ac1e85fbc19f7993a3d33c593dfe0ef6464b89d25a585448945
9d7e36f365c1da17289b26706a8f996d1713ee5fd647f7be43fdcbd60f464d39
bad8117c7b23f326216e85e630e3915ea1c73387a7b7d2da61e800e96fc8b8c6
cdfec44bef6a2fc7110e06603ea5f925b76574ed1c5a8bcd43bcceba4e898d83