www.ludicando.com.br Open in urlscan Pro
2606:4700:30::681b:a08a Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff...
Submission: On January 27 via automatic, source openphish (January 27th 2019, 12:33:45 pm UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2606:4700:30::681b:a08a, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.ludicando.com.br.

This is the only time www.ludicando.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ziggo (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:30:... 2606:4700:30::681b:a08a	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5	8.247.32.202 8.247.32.202	3356 (LEVEL3) (LEVEL3 - Level 3 Parent)
4	8.247.18.183 8.247.18.183	3356 (LEVEL3) (LEVEL3 - Level 3 Parent)
11	3

2 2606:4700:30::681b:a08a (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.ludicando.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 8.247.32.202 (United States)

ASN3356 (LEVEL3 - Level 3 Parent, LLC, US)

www.ziggo.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 8.247.18.183 (United States)

ASN3356 (LEVEL3 - Level 3 Parent, LLC, US)

www.ziggo.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	ziggo.nl www.ziggo.nl	116 KB
2	ludicando.com.br www.ludicando.com.br	103 KB
11	2

	Domain	Requested by
9	www.ziggo.nl	www.ludicando.com.br
2	www.ludicando.com.br	www.ludicando.com.br
11	2

This site contains no links.

Subject Issuer	Validity	Valid
www.ziggo.nl GlobalSign Domain Validation CA - SHA256 - G2	`2017-01-26` - `2019-04-24`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
Frame ID: 919617581C52D599AAC723805B97B210
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<div class="[^"]*parbase/i
script /\/etc\/designs\//i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<div class="[^"]*parbase/i
script /\/etc\/designs\//i

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+foundation[^>"]+css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

11
Requests

82 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

220 kB
Transfer

470 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set vergoeding.htm Show response
www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/ 12 KB
3 KB 60ms
34ms Document
text/html 2606:4700:30::681b:a08a
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:a08a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / EasyEngine 3.7.4
Resource Hash: 3167ee7b090a0530aae5c5f51f23bb79ef250a04a801efdd4c074f602153cba1

Request headers

Host: www.ludicando.com.br
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 27 Jan 2019 12:33:30 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=def799727d1be4ef696c46230a745a1011548592410; expires=Mon, 27-Jan-20 12:33:30 GMT; path=/; domain=.ludicando.com.br; HttpOnly
Last-Modified: Sun, 27 Jan 2019 11:50:11 GMT
Vary: Accept-Encoding
X-Powered-By: EasyEngine 3.7.4
Server: cloudflare
CF-RAY: 49fb3f83745cc27e-FRA
Content-Encoding: gzip

GET
H/1.1 200
OK main.min.6f170ad3506a512a7f64a063d89bad8c.css
www.ziggo.nl/etc/clientlibs/foundation/ 9 KB
2 KB 134ms
25ms Stylesheet
text/css 8.247.32.202
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/clientlibs/foundation/main.min.6f170ad3506a512a7f64a063d89bad8c.css

Requested by

Host: www.ludicando.com.br
URL: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.32.202 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

cb869f72761897c7acbce179ab01bf112396e95620a04443ee819ec87f66598b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
Content-Encoding: gzip
X-Content-Type-Options: nosniff
P3P: CP="NON CUR OTPi OUR NOR UNI"
Connection: keep-alive
Content-Length: 1840
X-Xss-Protection: 1; mode=block
Last-Modified: Fri, 11 Jan 2019 23:55:21 GMT
Date: Sun, 27 Jan 2019 12:33:30 GMT
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
Content-Type: text/css;charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
ETag: W/"2225-57f376d8ed27a"
Accept-Ranges: bytes
Expires: Mon, 11 Feb 2019 00:00:19 GMT

GET
H/1.1 200
OK main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
www.ziggo.nl/etc/designs/ziggo-nl/css/ 219 KB
30 KB 133ms
26ms Stylesheet
text/css 8.247.32.202
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.32.202 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

d75dc7ddc4ceea023b09a6afb66729113c01dab4ad080d36f0bdcc2ff3aff0eb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
Content-Encoding: gzip
X-Content-Type-Options: nosniff
p3p: CP="NON CUR OTPi OUR NOR UNI"
Connection: keep-alive
Content-Length: 30210
X-Xss-Protection: 1; mode=block
Last-Modified: Sun, 27 Jan 2019 11:52:22 GMT
Date: Sun, 27 Jan 2019 12:33:30 GMT
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
ETag: "36c15-5806f3165f470"
Accept-Ranges: bytes
Expires: Tue, 26 Feb 2019 12:25:02 GMT

GET
H/1.1 200
OK form.min.4e81c809efab4b0034dc79eed4223a6f.css
www.ziggo.nl/etc/designs/ziggo-nl/css/components/ 60 KB
9 KB 135ms
28ms Stylesheet
text/css 8.247.32.202
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/ziggo-nl/css/components/form.min.4e81c809efab4b0034dc79eed4223a6f.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.32.202 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

c38ec34dba518aefe32de1ecadddbfbf2f1ec42bd7aa4a5870f285552cc4037e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
Content-Encoding: gzip
X-Content-Type-Options: nosniff
p3p: CP="NON CUR OTPi OUR NOR UNI"
Connection: keep-alive
Content-Length: 9021
X-Xss-Protection: 1; mode=block
Last-Modified: Fri, 11 Jan 2019 23:55:13 GMT
Date: Sun, 27 Jan 2019 12:33:30 GMT
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
ETag: "ef72-57f376d157e32"
Accept-Ranges: bytes
Expires: Sun, 10 Feb 2019 23:55:21 GMT

GET
H/1.1 200
OK ziggo_logo.png
www.ziggo.nl/etc/designs/ziggo-nl/media/logos/ 8 KB
8 KB 134ms
27ms Image
image/png 8.247.32.202
Level 3 Parent

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ziggo.nl/etc/designs/ziggo-nl/media/logos/ziggo_logo.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.32.202 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

0626b1f8ba03d1e775fcec7d968c8779cb9c39c00df453184cf31b5d96f2feaf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Last-Modified: Fri, 11 Jan 2019 12:38:40 GMT
ETag: "1e6f-57f2df984a91a"
Strict-Transport-Security: max-age=31536000
P3P: CP="NON CUR OTPi OUR NOR UNI"
Cache-Control: max-age=2592000
Date: Sun, 27 Jan 2019 12:33:30 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 7791
X-Xss-Protection: 1; mode=block
Expires: Sun, 10 Feb 2019 12:38:44 GMT

GET
H/1.1 200
OK loadingindicator.min.e2b09fbd802ac3f34bfd356b0d641626.e2b09fbd802ac3f34bfd356b0d641626.js Show response
www.ziggo.nl/etc/designs/ziggo-nl/js/components/ 766 B
959 B 134ms
27ms Script
application/x-javascript 8.247.32.202
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/ziggo-nl/js/components/loadingindicator.min.e2b09fbd802ac3f34bfd356b0d641626.e2b09fbd802ac3f34bfd356b0d641626.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.32.202 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

12ce49917126abd96b1c8e512e22b7a33be24a2be99ef591ce91fc51450206b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
Content-Encoding: gzip
x-content-type-options: nosniff
p3p: CP="NON CUR OTPi OUR NOR UNI"
Connection: keep-alive
Content-Length: 392
x-xss-protection: 1; mode=block
Last-Modified: Sat, 12 Jan 2019 15:22:12 GMT
Date: Sun, 27 Jan 2019 12:33:30 GMT
Vary: Accept-Encoding
strict-transport-security: max-age=31536000
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=2592000
ETag: W/"2fe-57f4460363f14"
Accept-Ranges: bytes
Expires: Mon, 11 Feb 2019 15:22:12 GMT

GET
H/1.1 200
OK puub.png
www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/ 99 KB
100 KB 10ms
9ms Image
image/png 2606:4700:30::681b:a08a
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/puub.png
Requested by: Host: www.ludicando.com.br
URL: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:a08a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f249add9b41b2ad5463c65832f80d1005ddcfff59a839d12d29dc2a9f43a7ce

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.ludicando.com.br
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
Cookie: __cfduid=def799727d1be4ef696c46230a745a1011548592410
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.ludicando.com.br/wp-admin/img/www.ziggo.nl/login/9369c8f65482569dcef9564586d31a893e7c08e1b9743f9e4b2e14fe9c2a6dff8853c928e45902aab013ce3498232524/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 27 Jan 2019 12:33:30 GMT
CF-Cache-Status: HIT
Last-Modified: Sun, 27 Jan 2019 11:50:11 GMT
Server: cloudflare
ETag: "5c4d9af3-18dec"
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 49fb3f83c4a7c27e-FRA
Content-Length: 101868
Expires: Wed, 24 Jan 2029 12:33:30 GMT

GET
H/1.1 200
OK museosans_900-webfont.woff2
www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/ 17 KB
17 KB 110ms
16ms Font
application/octet-stream 8.247.18.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/museosans_900-webfont.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.18.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

43ef2963ba6db6f7edf6d5f0e0cf6d91a8d2fc663d8bcf1cee98b916cc6eb7bf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
Origin: http://www.ludicando.com.br

Response headers

content-security-policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Last-Modified: Fri, 25 Jan 2019 12:39:24 GMT
ETag: W/"438c-580479dfe621d:dtagent1013117120615011732Eu"
Strict-Transport-Security: max-age=31536000
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
Cache-Control: max-age=604800
Date: Sun, 27 Jan 2019 12:33:30 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 17292
X-XSS-Protection: 1; mode=block
Expires: Fri, 01 Feb 2019 12:39:25 GMT

GET
H/1.1 200
OK museosans_700-webfont.woff2
www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/ 17 KB
18 KB 119ms
25ms Font
application/font-woff2 8.247.18.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/museosans_700-webfont.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.18.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

2408e86e87c5df52e8160530980e94acf40b083adb5f330abd9ad21b5b5f65e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
Origin: http://www.ludicando.com.br

Response headers

content-security-policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Last-Modified: Fri, 11 Jan 2019 12:38:40 GMT
ETag: "458c-57f2df99ca528:dtagent1013117120615011732Eu"
Strict-Transport-Security: max-age=31536000
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
Cache-Control: max-age=2592000
Date: Sun, 27 Jan 2019 12:33:30 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/font-woff2
Content-Length: 17804
X-XSS-Protection: 1; mode=block
Expires: Sun, 10 Feb 2019 12:39:01 GMT

GET
H/1.1 200
OK museosans_500-webfont.woff2
www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/ 17 KB
18 KB 111ms
17ms Font
application/font-woff2 8.247.18.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/museosans_500-webfont.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.18.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

26d51505332c23d6cbda9334670d7311bbb034572931905ecd97e7783a15c3db

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
Origin: http://www.ludicando.com.br

Response headers

content-security-policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Last-Modified: Fri, 11 Jan 2019 12:38:39 GMT
ETag: "44d4-57f2df98830a7:dtagent1013117120615011732Eu"
Strict-Transport-Security: max-age=31536000
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
Cache-Control: max-age=2592000
Date: Sun, 27 Jan 2019 12:33:30 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/font-woff2
Content-Length: 17620
X-XSS-Protection: 1; mode=block
Expires: Sun, 10 Feb 2019 12:39:38 GMT

GET
H/1.1 200
OK ziggonl.woff2
www.ziggo.nl/etc/designs/upc-generic/media/webfonts/glyphs/ 12 KB
12 KB 111ms
18ms Font
application/font-woff2 8.247.18.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/upc-generic/media/webfonts/glyphs/ziggonl.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.18.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

69d3b9d8d69a8fbedeadc58f1864ddabf1ee0895210d6b7fa4b6749a22ae939d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
Origin: http://www.ludicando.com.br

Response headers

content-security-policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Last-Modified: Fri, 11 Jan 2019 12:38:19 GMT
ETag: "2f94-57f2df8578e0d:dtagent1013117120615011732Eu"
Strict-Transport-Security: max-age=31536000
p3p: CP="NON CUR OTPi OUR NOR UNI"
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Date: Sun, 27 Jan 2019 12:33:30 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/font-woff2
Content-Length: 12180
X-XSS-Protection: 1; mode=block
Expires: Sun, 10 Feb 2019 12:39:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ziggo (Telecommunication)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| LGI

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ludicando.com.br/	1970-01-19 06:55:28	Name: __cfduid Value: def799727d1be4ef696c46230a745a1011548592410

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.ludicando.com.br
www.ziggo.nl
2606:4700:30::681b:a08a
8.247.18.183
8.247.32.202
0626b1f8ba03d1e775fcec7d968c8779cb9c39c00df453184cf31b5d96f2feaf
12ce49917126abd96b1c8e512e22b7a33be24a2be99ef591ce91fc51450206b8
1f249add9b41b2ad5463c65832f80d1005ddcfff59a839d12d29dc2a9f43a7ce
2408e86e87c5df52e8160530980e94acf40b083adb5f330abd9ad21b5b5f65e8
26d51505332c23d6cbda9334670d7311bbb034572931905ecd97e7783a15c3db
3167ee7b090a0530aae5c5f51f23bb79ef250a04a801efdd4c074f602153cba1
43ef2963ba6db6f7edf6d5f0e0cf6d91a8d2fc663d8bcf1cee98b916cc6eb7bf
69d3b9d8d69a8fbedeadc58f1864ddabf1ee0895210d6b7fa4b6749a22ae939d
c38ec34dba518aefe32de1ecadddbfbf2f1ec42bd7aa4a5870f285552cc4037e
cb869f72761897c7acbce179ab01bf112396e95620a04443ee819ec87f66598b
d75dc7ddc4ceea023b09a6afb66729113c01dab4ad080d36f0bdcc2ff3aff0eb

www.ludicando.com.br Open in urlscan Pro 2606:4700:30::681b:a08a Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

82 %HTTPS

33 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

220 kBTransfer

470 kBSize

1 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

www.ludicando.com.br Open in urlscan Pro
2606:4700:30::681b:a08a Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

220 kB
Transfer

470 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!