valedigital.org.br Open in urlscan Pro
187.191.98.202 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://valedigital.org.br/office/index.php
Submission: On June 03 via automatic, source phishtank (June 3rd 2019, 10:00:45 am UTC)

Summary HTTP 5 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 187.191.98.202, located in Brazil and belongs to Mandic S.A., BR. The main domain is valedigital.org.br.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 23rd 2019. Valid for: 3 months.

This is the only time valedigital.org.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
2	187.191.98.202 187.191.98.202		262545 (Mandic S.A.) (Mandic S.A.)
3	151.101.36.193 151.101.36.193		54113 (FASTLY) (FASTLY - Fastly)
5	2

2 187.191.98.202 (Brazil)

ASN262545 (Mandic S.A., BR)
PTR: mail01.emidhost4.com.br

valedigital.org.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.36.193 (Amsterdam, Netherlands)

ASN54113 (FASTLY - Fastly, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	imgur.com i.imgur.com	206 KB
2	valedigital.org.br valedigital.org.br	2 KB
5	2

	Domain	Requested by
3	i.imgur.com	valedigital.org.br
2	valedigital.org.br	valedigital.org.br
5	2

This site contains no links.

Subject Issuer	Validity	Valid
valedigital.org.br cPanel, Inc. Certification Authority	`2019-03-23` - `2019-06-21`	3 months	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2018-12-14` - `2020-02-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://valedigital.org.br/office/index.php
Frame ID: ABC1F95E32695514CA6E626B2E23BFCE
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Perl (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_perl(?:\/([\d\.]+))?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_perl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_perl(?:\/([\d\.]+))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_perl(?:\/([\d\.]+))?/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

208 kB
Transfer

207 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response valedigital.org.br/office/	529 B 819 B	979ms 296ms	Document text/html	187.191.98.202 Mandic S.A.
General Check archive.org Show headers Download Go to Full URL https://valedigital.org.br/office/index.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 187.191.98.202 , Brazil, ASN262545 (Mandic S.A., BR), Reverse DNS mail01.emidhost4.com.br Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 mod_perl/2.0.8 Perl/v5.10.1 / PHP/5.5.30 Resource Hash `41d09137cebf0933242ab9b767b78d14263a83cbd2bcd941d6d17dddcd89ea9e` Request headers Host valedigital.org.br Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 03 Jun 2019 10:00:16 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 mod_perl/2.0.8 Perl/v5.10.1 X-Powered-By PHP/5.5.30 Connection close Transfer-Encoding chunked Content-Type text/html
GET H/1.1	200 OK	style.css valedigital.org.br/office/	1 KB 1 KB	708ms 239ms	Stylesheet text/css	187.191.98.202 Mandic S.A.
General Check archive.org Show headers Download Go to Full URL https://valedigital.org.br/office/style.css Requested by Host: valedigital.org.br URL: https://valedigital.org.br/office/index.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 187.191.98.202 , Brazil, ASN262545 (Mandic S.A., BR), Reverse DNS mail01.emidhost4.com.br Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 mod_perl/2.0.8 Perl/v5.10.1 / Resource Hash `786e3cf7c9528cec6ed1531f04e907ef4c34e7fae16071ffd4e22830b6c11fb5` Request headers Referer https://valedigital.org.br/office/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 03 Jun 2019 10:00:17 GMT Last-Modified Wed, 15 May 2019 04:43:56 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 mod_perl/2.0.8 Perl/v5.10.1 ETag "2815aed-412-588e5cc0f5b00" Content-Type text/css Connection close Accept-Ranges bytes Content-Length 1042
GET H2	200	nzqsLYY.png i.imgur.com/	3 KB 3 KB	41ms 40ms	Image image/png	151.101.36.193 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/nzqsLYY.png Requested by Host: valedigital.org.br URL: https://valedigital.org.br/office/index.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.36.193 Amsterdam, Netherlands, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cat factory 1.0 / Resource Hash `09dec7f4c4642e0bb5f42204dbe72ed7b33ce0e1995a1a50515a031e16a6db44` Request headers Referer https://valedigital.org.br/office/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 10:00:17 GMT age 2338325 x-cache HIT, HIT status 200 content-length 3295 x-served-by cache-bwi5141-BWI, cache-ams21020-AMS last-modified Wed, 09 Jan 2019 21:22:22 GMT server cat factory 1.0 x-timer S1559556018.548793,VS0,VE1 etag "fc2fe29418f2052539d2e54af1b03fce" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	x1CFiV7.png i.imgur.com/	73 KB 73 KB	43ms 42ms	Image image/png	151.101.36.193 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/x1CFiV7.png Requested by Host: valedigital.org.br URL: https://valedigital.org.br/office/index.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.36.193 Amsterdam, Netherlands, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cat factory 1.0 / Resource Hash `64666923804cb5f618f529f66718bdfd378fb630d6c68910f840e428a9ddd23a` Request headers Referer https://valedigital.org.br/office/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 10:00:17 GMT age 1695953 x-cache HIT, HIT status 200 content-length 74453 x-served-by cache-bwi5147-BWI, cache-ams21020-AMS last-modified Tue, 14 May 2019 18:54:24 GMT server cat factory 1.0 x-timer S1559556018.548934,VS0,VE2 etag "710f9e1e169ca0ee92aab397e0d5dd1f" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	EdBYZ7u.jpg i.imgur.com/	129 KB 130 KB	27ms 21ms	Image image/jpeg	151.101.36.193 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/EdBYZ7u.jpg Requested by Host: valedigital.org.br URL: https://valedigital.org.br/office/index.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.36.193 Amsterdam, Netherlands, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cat factory 1.0 / Resource Hash `fe864d14812bede4f5d3daf602057f4e63409c615823bdcf1caf304014270d80` Request headers Referer https://valedigital.org.br/office/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 10:00:18 GMT age 1696606 x-cache HIT, HIT status 200 content-length 132419 x-served-by cache-bwi5120-BWI, cache-ams21020-AMS last-modified Tue, 14 May 2019 18:43:30 GMT server cat factory 1.0 x-timer S1559556018.237241,VS0,VE4 etag "0f0d416c10714bd094a0a223c547b3d3" access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.imgur.com
valedigital.org.br
151.101.36.193
187.191.98.202
09dec7f4c4642e0bb5f42204dbe72ed7b33ce0e1995a1a50515a031e16a6db44
41d09137cebf0933242ab9b767b78d14263a83cbd2bcd941d6d17dddcd89ea9e
64666923804cb5f618f529f66718bdfd378fb630d6c68910f840e428a9ddd23a
786e3cf7c9528cec6ed1531f04e907ef4c34e7fae16071ffd4e22830b6c11fb5
fe864d14812bede4f5d3daf602057f4e63409c615823bdcf1caf304014270d80