alert-importltaupy.0hi.me Open in urlscan Pro
185.27.134.217 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://alert-importltaupy.0hi.me/?i=1
Effective URL:
http://alert-importltaupy.0hi.me/?i=2
Submission: On April 18 via api (April 18th 2023, 12:09:34 pm UTC) from JP — Scanned from GB

Summary HTTP 21 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 21 HTTP transactions. The main IP is 185.27.134.217, located in United Kingdom and belongs to WILDCARD-AS Wildcard UK Limited, GB. The main domain is alert-importltaupy.0hi.me.

This is the only time alert-importltaupy.0hi.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

	IP Address	AS Autonomous System
17	185.27.134.217 185.27.134.217	34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited)
1	172.217.16.138 172.217.16.138	15169 (GOOGLE) (GOOGLE)
1	104.21.44.140 104.21.44.140	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	64.185.227.155 64.185.227.155	18450 (WEBNX) (WEBNX)
1	34.117.59.81 34.117.59.81	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
21	5

17 185.27.134.217 (United Kingdom)

ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)

alert-importltaupy.0hi.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.138 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f138.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.44.140 (None, )

ASN13335 (CLOUDFLARENET, US)

0hi.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.185.227.155 (United States)

ASN18450 (WEBNX, US)
PTR: 64-185-227-155.static.webnx.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com

ipinfo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	0hi.me alert-importltaupy.0hi.me 0hi.me	460 KB
1	ipinfo.io ipinfo.io — Cisco Umbrella Rank: 4940	555 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2662	115 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 607	31 KB
21	4

	Domain	Requested by
17	alert-importltaupy.0hi.me	alert-importltaupy.0hi.me
1	ipinfo.io	ajax.googleapis.com
1	api.ipify.org	ajax.googleapis.com
1	0hi.me	alert-importltaupy.0hi.me
1	ajax.googleapis.com	alert-importltaupy.0hi.me
21	5

This site contains links to these domains. Also see Links.

Domain
0hi.me

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
0hi.me E1	`2023-04-11` - `2023-07-10`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh
*.host.io R3	`2023-03-27` - `2023-06-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://alert-importltaupy.0hi.me/?i=2
Frame ID: 85CA34AA71D4F33608745EC69BEDB2B6
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banca Electronica

Page URL History Show full URLs

http://alert-importltaupy.0hi.me/?i=1 Page URL
http://alert-importltaupy.0hi.me/?i=2 Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

19 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

491 kB
Transfer

928 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://0hi.me/
Title: Free Unlimited Hosting - FranzLab

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://alert-importltaupy.0hi.me/?i=1 Page URL
http://alert-importltaupy.0hi.me/?i=2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
alert-importltaupy.0hi.me/ 836 B
832 B 82ms
39ms Document
text/html 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/?i=1
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: a0fd6156e0d1bf2c1aa1fba52fccf2fdedcd1aaff9b1546fe7b0f4350c27c137

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 18 Apr 2023 12:09:28 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK aes.js Show response
alert-importltaupy.0hi.me/ 30 KB
31 KB 37ms
36ms Script
application/javascript 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/aes.js
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=1
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:28 GMT
Last-Modified: Sat, 08 Aug 2015 08:12:26 GMT
Server: nginx
ETag: "55c5b9ea-79e6"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 31206

GET
H/1.1 200
OK Primary Request / Show response
alert-importltaupy.0hi.me/ 14 KB
4 KB 78ms
78ms Document
text/html 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/?i=2
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=1
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: 953d77d2ea283052a596441e42d57f64142ab7df732431e19217332692c9161e

Request headers

Referer: http://alert-importltaupy.0hi.me/?i=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 18 Apr 2023 12:09:29 GMT
Expires: Thu, 18 May 2023 12:09:29 GMT
Last-Modified: Fri, 14 Apr 2023 18:27:30 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK material-icons.css
alert-importltaupy.0hi.me/css/ 1013 B
861 B 39ms
38ms Stylesheet
text/css 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/css/material-icons.css
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: a8a9e862241b63d16b12537d6ff014db5ab9c39f76335fdc24de98efa73071a3

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Apr 2023 18:24:12 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
Connection: keep-alive
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK -style18.css
alert-importltaupy.0hi.me/css/ 377 KB
44 KB 81ms
44ms Stylesheet
text/css 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/css/-style18.css
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: 3835995c3b0db0e2e73e30e46bb986270204c2d27c14b4a1c166914345c11082

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Apr 2023 18:24:17 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
Connection: keep-alive
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK teclado-1.5.css
alert-importltaupy.0hi.me/css/ 1 KB
945 B 75ms
39ms Stylesheet
text/css 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/css/teclado-1.5.css
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: c6c7fb1cb06332f108a2ea2c3e1fd2c0d9204eb9a8c8d6640fa0f07be3bd4b65

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Apr 2023 18:24:17 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
Connection: keep-alive
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 439ms
38ms Script
text/javascript 172.217.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f138.1e100.net

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 08:15:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 273262
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 14 Apr 2024 08:15:07 GMT

GET
H/1.1 200
OK acceso_rapido.css
alert-importltaupy.0hi.me/css/ 8 KB
2 KB 76ms
39ms Stylesheet
text/css 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/css/acceso_rapido.css
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: 319fb82d6c961eac132e22cc91e1c5198b786eb3f51ce41734ed0bdd07cf05b5

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Apr 2023 18:24:12 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
Connection: keep-alive
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK font_style.css
alert-importltaupy.0hi.me/css/ 31 KB
5 KB 76ms
40ms Stylesheet
text/css 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/css/font_style.css
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: 3c6bf6e7adc1a2514f2d0b547280fd7acd8ea087f1152e2e433d7ee53dae0d67

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Apr 2023 18:24:12 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
Connection: keep-alive
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK logo.png
alert-importltaupy.0hi.me/img/ 4 KB
5 KB 38ms
37ms Image
image/png 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://alert-importltaupy.0hi.me/img/logo.png
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: f947d9a990cae972a26578ab12d4a0404e23c278b91522ea8697f1f9c7c36c2f

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Last-Modified: Fri, 14 Apr 2023 18:24:24 GMT
Server: nginx
Content-Type: image/png
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4390
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK icon-lock.png
alert-importltaupy.0hi.me/img/ 486 B
819 B 44ms
43ms Image
image/png 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://alert-importltaupy.0hi.me/img/icon-lock.png
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: ed95140a8d5d700cde505b942e3ddb05b0670cee3cf7b6747d8af99bfc8b1fdb

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Last-Modified: Fri, 14 Apr 2023 18:24:24 GMT
Server: nginx
Content-Type: image/png
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 486
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK icon-24hs.png
alert-importltaupy.0hi.me/img/ 1004 B
1 KB 43ms
42ms Image
image/png 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://alert-importltaupy.0hi.me/img/icon-24hs.png
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: d484e247878a4c7619e5701a6275c403f697f71b454a1456f3d3884b9c9a544e

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Last-Modified: Fri, 14 Apr 2023 18:24:25 GMT
Server: nginx
Content-Type: image/png
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1004
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK popup-truncamiento-usd.jpg
alert-importltaupy.0hi.me/img/ 86 KB
86 KB 44ms
43ms Image
image/jpeg 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://alert-importltaupy.0hi.me/img/popup-truncamiento-usd.jpg
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: 263348aa15a816d2e2efb959951695ae07177d1b95d58a3970a665376a5bb5a6

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Last-Modified: Fri, 14 Apr 2023 18:24:26 GMT
Server: nginx
Content-Type: image/jpeg
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 87602
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK banner.jpg
alert-importltaupy.0hi.me/img/ 224 KB
224 KB 44ms
43ms Image
image/jpeg 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://alert-importltaupy.0hi.me/img/banner.jpg
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: 345c1b30bfb1dacb178b5a86ca805f57d0a54f802192b58f6eaeb70fc6214127

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Last-Modified: Fri, 14 Apr 2023 18:24:27 GMT
Server: nginx
Content-Type: image/jpeg
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 229276
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK flagFooterParaguai.png
alert-importltaupy.0hi.me/img/ 2 KB
2 KB 84ms
40ms Image
image/png 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://alert-importltaupy.0hi.me/img/flagFooterParaguai.png
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: 5785c509a2717ba8917e07bc47f6fd3081f07ebdeba1aab2560b79aadaec31d8

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Last-Modified: Fri, 14 Apr 2023 18:24:25 GMT
Server: nginx
Content-Type: image/png
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2223
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H/1.1 200
OK sax.js Show response
alert-importltaupy.0hi.me/js/ 1 KB
1 KB 37ms
37ms Script
application/javascript 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/js/sax.js
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: 39a1b1e0f643a7d76137fe3f077ea5f741578b9519b870e6f436c132e2670676

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/?i=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Apr 2023 18:24:34 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
Connection: keep-alive
Expires: Thu, 18 May 2023 12:09:29 GMT

GET
H2 200 franzlab-antipishing.js Show response
0hi.me/js/ 14 KB
6 KB 452ms
74ms Script
application/javascript 104.21.44.140
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://0hi.me/js/franzlab-antipishing.js

Requested by

Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/?i=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.44.140 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7aaa948933aa3b2b601742abf4fa05dfc5382bd30f0fbbb165d73e2e8e180b57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 12:09:30 GMT
via: 1.1 varnish (Varnish/7.1)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; preload
neko: dynamic :3
age: 1493303
cf-polished: origSize=15140
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Sat, 01 Apr 2023 04:36:17 GMT
server: cloudflare
etag: W/"3b24-5f83edde51d6f-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mAVMHm4zihK73JWzBYQZNih4PXxkmsFlDJhmrECuOc%2BvbTEpeIEPirInr7vwQ5DtqQ7xxD9zmdW0CPdZYPlACZog76%2FTv8035OFxv%2F2qUMh6ShVWRgtmS%2BE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
x-varnish: 65096
cache-control: max-age=31536000
cf-ray: 7b9ccc9b6a548897-LHR

GET
H2 200 / Show response
api.ipify.org/ 20 B
115 B 382ms
92ms XHR
application/json 64.185.227.155
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 64.185.227.155 , United States, ASN18450 (WEBNX, US),
Reverse DNS: 64-185-227-155.static.webnx.com
Software: /
Resource Hash: 784f90ad084201a15d2d25bcbbc27105924ecbd73ea1750f0c0e5097d8d2b481

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: http://alert-importltaupy.0hi.me/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-origin: http://alert-importltaupy.0hi.me
date: Tue, 18 Apr 2023 12:09:30 GMT
content-length: 20
vary: Origin
content-type: application/json

GET
H2 200 / Show response
ipinfo.io/ 302 B
555 B 206ms
134ms XHR
application/json 34.117.59.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ipinfo.io/

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

81.59.117.34.bc.googleusercontent.com

Software

Resource Hash

931714b8ca40cf9204981f961b0877825327db4b99546fd6f8f6fc54c57b362c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: http://alert-importltaupy.0hi.me/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 12:09:30 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip
via: 1.1 google
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H/1.1 404
Not Found ico-arrow1.png
alert-importltaupy.0hi.me/img/ 1 KB
1 KB 71ms
40ms Image
text/html 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://alert-importltaupy.0hi.me/img/ico-arrow1.png
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/css/-style18.css
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: 2b7ea8dd60889f75129a486330728ccbdbbf6f85b923d7805534cdaffa1beaa8

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://alert-importltaupy.0hi.me/css/-style18.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Content-Encoding: gzip
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK MaterialIcons-Regular.woff2
alert-importltaupy.0hi.me/css/ 43 KB
44 KB 114ms
94ms Font
application/octet-stream 185.27.134.217
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: http://alert-importltaupy.0hi.me/css/MaterialIcons-Regular.woff2
Requested by: Host: alert-importltaupy.0hi.me
URL: http://alert-importltaupy.0hi.me/css/material-icons.css
Protocol: HTTP/1.1
Server: 185.27.134.217 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software: nginx /
Resource Hash: a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726

Request headers

Referer: http://alert-importltaupy.0hi.me/css/material-icons.css
Origin: http://alert-importltaupy.0hi.me
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 12:09:29 GMT
Last-Modified: Fri, 14 Apr 2023 18:24:17 GMT
Server: nginx
Transfer-Encoding: chunked
Cache-Control: max-age=0
Connection: keep-alive
Accept-Ranges: bytes
Expires: Tue, 18 Apr 2023 12:09:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			alert-importltaupy.0hi.me/	1970-01-20 20:46:19	Name: __test Value: 5cd8f37c7c83f2a59fec2c58af9ba5a5

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://alert-importltaupy.0hi.me/img/ico-arrow1.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0hi.me
ajax.googleapis.com
alert-importltaupy.0hi.me
api.ipify.org
ipinfo.io
104.21.44.140
172.217.16.138
185.27.134.217
34.117.59.81
64.185.227.155
263348aa15a816d2e2efb959951695ae07177d1b95d58a3970a665376a5bb5a6
2b7ea8dd60889f75129a486330728ccbdbbf6f85b923d7805534cdaffa1beaa8
319fb82d6c961eac132e22cc91e1c5198b786eb3f51ce41734ed0bdd07cf05b5
345c1b30bfb1dacb178b5a86ca805f57d0a54f802192b58f6eaeb70fc6214127
3835995c3b0db0e2e73e30e46bb986270204c2d27c14b4a1c166914345c11082
39a1b1e0f643a7d76137fe3f077ea5f741578b9519b870e6f436c132e2670676
3c6bf6e7adc1a2514f2d0b547280fd7acd8ea087f1152e2e433d7ee53dae0d67
5785c509a2717ba8917e07bc47f6fd3081f07ebdeba1aab2560b79aadaec31d8
784f90ad084201a15d2d25bcbbc27105924ecbd73ea1750f0c0e5097d8d2b481
7aaa948933aa3b2b601742abf4fa05dfc5382bd30f0fbbb165d73e2e8e180b57
931714b8ca40cf9204981f961b0877825327db4b99546fd6f8f6fc54c57b362c
953d77d2ea283052a596441e42d57f64142ab7df732431e19217332692c9161e
a0fd6156e0d1bf2c1aa1fba52fccf2fdedcd1aaff9b1546fe7b0f4350c27c137
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
a8a9e862241b63d16b12537d6ff014db5ab9c39f76335fdc24de98efa73071a3
c6c7fb1cb06332f108a2ea2c3e1fd2c0d9204eb9a8c8d6640fa0f07be3bd4b65
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc
d484e247878a4c7619e5701a6275c403f697f71b454a1456f3d3884b9c9a544e
ed95140a8d5d700cde505b942e3ddb05b0670cee3cf7b6747d8af99bfc8b1fdb
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f947d9a990cae972a26578ab12d4a0404e23c278b91522ea8697f1f9c7c36c2f

alert-importltaupy.0hi.me Open in urlscan Pro 185.27.134.217 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

19 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

491 kBTransfer

928 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

alert-importltaupy.0hi.me Open in urlscan Pro
185.27.134.217 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

19 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

491 kB
Transfer

928 kB
Size

1
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!