certificacao-segurosantanetbr2017.j.dnr.kz Open in urlscan Pro
185.22.66.15  Malicious Activity! Public Scan

URL: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Submission: On June 11 via automatic, source phishtank

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 185.22.66.15, located in Almaty, Kazakhstan and belongs to PS, KZ. The main domain is certificacao-segurosantanetbr2017.j.dnr.kz.
This is the only time certificacao-segurosantanetbr2017.j.dnr.kz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

IP Address AS Autonomous System
7 185.22.66.15 48716 (PS)
3 185.22.66.16 48716 (PS)
10 2
Apex Domain
Subdomains
Transfer
10 dnr.kz
certificacao-segurosantanetbr2017.j.dnr.kz
167 KB
10 1
Domain Requested by
10 certificacao-segurosantanetbr2017.j.dnr.kz certificacao-segurosantanetbr2017.j.dnr.kz
10 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Frame ID: 29037.1
Requests: 10 HTTP requests in this frame

Screenshot


Page Statistics

10
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

167 kB
Transfer

167 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index1.php
certificacao-segurosantanetbr2017.j.dnr.kz/
4 KB
4 KB
Document
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Protocol
HTTP/1.1
Server
185.22.66.15 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv1.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
17894973469c78ada20a6dad564c17dd16ebeee6737090c1f491e63ac7de3ee8

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:12 GMT
Server
openresty/1.11.2.1
Connection
keep-alive
Content-Length
3770
X-Resolver-IP
185.22.66.15 185.22.66.15
Content-Type
text/html; charset=UTF-8
scripts_campos.js
certificacao-segurosantanetbr2017.j.dnr.kz/scripts/
5 KB
5 KB
Script
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/scripts/scripts_campos.js
Requested by
Host: certificacao-segurosantanetbr2017.j.dnr.kz
URL: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Protocol
HTTP/1.1
Server
185.22.66.15 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv1.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
af0f9f0e56321e5b3e30860252a8af5c7d8db1e388ff9e2acae25ea8d5278fa3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:12 GMT
Last-Modified
Thu, 22 Sep 2016 14:38:36 GMT
Server
openresty/1.11.2.1
ETag
"125e-53d199de41300"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4702
X-Resolver-IP
185.22.66.15 185.22.66.15
pular_campos.js
certificacao-segurosantanetbr2017.j.dnr.kz/scripts/
243 B
243 B
Script
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/scripts/pular_campos.js
Requested by
Host: certificacao-segurosantanetbr2017.j.dnr.kz
URL: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Protocol
HTTP/1.1
Server
185.22.66.16 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv2.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
ed3ccd95757d22ccb591f7af700cf0ae2bb443ee5774def476e15e620bb9ad34

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:12 GMT
Last-Modified
Thu, 22 Sep 2016 14:38:42 GMT
Server
openresty/1.11.2.1
ETag
"f3-53d199e3fa080"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
243
X-Resolver-IP
185.22.66.16 185.22.66.16
somente_numeros.js
certificacao-segurosantanetbr2017.j.dnr.kz/scripts/
207 B
207 B
Script
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/scripts/somente_numeros.js
Requested by
Host: certificacao-segurosantanetbr2017.j.dnr.kz
URL: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Protocol
HTTP/1.1
Server
185.22.66.15 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv1.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
5d8843283c8852a0fa99a7400127614ba769af2dd87878dbd2c38db3c77cc0b3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:13 GMT
Last-Modified
Thu, 22 Sep 2016 14:38:34 GMT
Server
openresty/1.11.2.1
ETag
"cf-53d199dc58e80"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
207
X-Resolver-IP
185.22.66.15 185.22.66.15
script_data.js
certificacao-segurosantanetbr2017.j.dnr.kz/scripts/
926 B
926 B
Script
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/scripts/script_data.js
Requested by
Host: certificacao-segurosantanetbr2017.j.dnr.kz
URL: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Protocol
HTTP/1.1
Server
185.22.66.15 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv1.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
e4e217eb6faccd2cc80d24a62142344797890dbf4b3fa5de49ad345898c2b6ec

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
*/*
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:13 GMT
Last-Modified
Thu, 22 Sep 2016 14:38:40 GMT
Server
openresty/1.11.2.1
ETag
"39e-53d199e211c00"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
926
X-Resolver-IP
185.22.66.15 185.22.66.15
7.png
certificacao-segurosantanetbr2017.j.dnr.kz/images/
67 KB
67 KB
Image
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/images/7.png
Requested by
Host: certificacao-segurosantanetbr2017.j.dnr.kz
URL: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Protocol
HTTP/1.1
Server
185.22.66.15 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv1.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
05c36da200dca6f96cb0183fcaf5fba25d53b2233f69371a76eaabcec0c3b99a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:13 GMT
Last-Modified
Thu, 22 Sep 2016 14:38:20 GMT
Server
openresty/1.11.2.1
ETag
"10c9b-53d199cefef00"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
68763
X-Resolver-IP
185.22.66.15 185.22.66.15
9.png
certificacao-segurosantanetbr2017.j.dnr.kz/images/
3 KB
3 KB
Image
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/images/9.png
Requested by
Host: certificacao-segurosantanetbr2017.j.dnr.kz
URL: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Protocol
HTTP/1.1
Server
185.22.66.15 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv1.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
299985cb46aee092002b0126d8acee4eb698ffc13454761dc66fa608c3f3d5be

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:13 GMT
Last-Modified
Thu, 22 Sep 2016 14:38:18 GMT
Server
openresty/1.11.2.1
ETag
"d94-53d199cd16a80"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3476
X-Resolver-IP
185.22.66.15 185.22.66.15
2.gif
certificacao-segurosantanetbr2017.j.dnr.kz/images/
1 KB
1 KB
Image
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/images/2.gif
Requested by
Host: certificacao-segurosantanetbr2017.j.dnr.kz
URL: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Protocol
HTTP/1.1
Server
185.22.66.15 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv1.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
985718c35c10a8246bb0753b5390172f72f77dc08f54485c185773cf1f8dbe93

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:13 GMT
Last-Modified
Thu, 22 Sep 2016 14:38:28 GMT
Server
openresty/1.11.2.1
ETag
"4ad-53d199d6a0100"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1197
X-Resolver-IP
185.22.66.15 185.22.66.15
6.png
certificacao-segurosantanetbr2017.j.dnr.kz/images/
86 KB
86 KB
Image
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/images/6.png
Requested by
Host: certificacao-segurosantanetbr2017.j.dnr.kz
URL: http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Protocol
HTTP/1.1
Server
185.22.66.16 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv2.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
e1c116b479b8bda2dfe4b18d85f58b60ffdf08dd98ed52eb5a8f9bd156769d2c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:13 GMT
Last-Modified
Thu, 22 Sep 2016 14:38:24 GMT
Server
openresty/1.11.2.1
ETag
"15749-53d199d2cf800"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
87881
X-Resolver-IP
185.22.66.16 185.22.66.16
favicon.ico
certificacao-segurosantanetbr2017.j.dnr.kz/
209 B
209 B
Other
General
Full URL
http://certificacao-segurosantanetbr2017.j.dnr.kz/favicon.ico
Protocol
HTTP/1.1
Server
185.22.66.16 Almaty, Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
rslv2.j.dnr.kz
Software
openresty/1.11.2.1 /
Resource Hash
b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
certificacao-segurosantanetbr2017.j.dnr.kz
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://certificacao-segurosantanetbr2017.j.dnr.kz/index1.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Sun, 11 Jun 2017 17:10:13 GMT
Server
openresty/1.11.2.1
Connection
keep-alive
Content-Length
209
Content-Type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies