grupoapro.com Open in urlscan Pro
169.60.169.155 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://jii.li/khZyv
Effective URL:
https://grupoapro.com/combo/update/pay-method.php
Submission: On April 10 via manual (April 10th 2023, 8:45:49 am UTC) from QA — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 14 HTTP transactions. The main IP is 169.60.169.155, located in United States and belongs to SOFTLAYER, US. The main domain is grupoapro.com.
TLS certificate: Issued by R3 on April 1st 2023. Valid for: 3 months.

This is the only time grupoapro.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3034::ac43:8e64	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	67.23.238.71 67.23.238.71	33182 (DIMENOC) (DIMENOC)
13	169.60.169.155 169.60.169.155	36351 (SOFTLAYER) (SOFTLAYER)
14	2

1 2606:4700:3034::ac43:8e64 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

jii.li	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.23.238.71 (Orlando, United States)

ASN33182 (DIMENOC, US)
PTR: us133-pl.valueserver.net

acprojeto.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 169.60.169.155 (United States)

ASN36351 (SOFTLAYER, US)
PTR: vps3.sys3-inter.net

grupoapro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	grupoapro.com grupoapro.com	488 KB
1	acprojeto.com.br acprojeto.com.br	382 B
1	jii.li 1 redirects jii.li	621 B
14	3

	Domain	Requested by
13	grupoapro.com	grupoapro.com
1	acprojeto.com.br
1	jii.li	1 redirects
14	3

This site contains no links.

Subject Issuer	Validity	Valid
acprojeto.com.br R3	`2023-03-30` - `2023-06-28`	3 months	crt.sh
grupoapro.com R3	`2023-04-01` - `2023-06-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://grupoapro.com/combo/update/pay-method.php
Frame ID: EE7074A513420925FD5CDD7C0945BB54
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Update my payment

Page URL History Show full URLs

https://jii.li/khZyv HTTP 301
https://acprojeto.com.br/auther.php Page URL
https://grupoapro.com/combo/update/pay-method.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

488 kB
Transfer

1443 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://jii.li/khZyv HTTP 301
https://acprojeto.com.br/auther.php Page URL
https://grupoapro.com/combo/update/pay-method.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://jii.li/khZyv HTTP 301
https://acprojeto.com.br/auther.php

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	auther.php Show response acprojeto.com.br/ Redirect Chain https://jii.li/khZyv https://acprojeto.com.br/auther.php	162 B 382 B	456ms 149ms	Document text/html	67.23.238.71 DIMENOC
General Check archive.org Show headers Download Go to Full URL https://acprojeto.com.br/auther.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 67.23.238.71 Orlando, United States, ASN33182 (DIMENOC, US), Reverse DNS us133-pl.valueserver.net Software nginx / PHP/7.0.33 PleskLin Resource Hash `2b3c2de2204313b19b78e19e9c519c8f432f4d9dc5460f57e1cc0bd23762cd60` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding br Content-Type text/html; charset=UTF-8 Date Mon, 10 Apr 2023 08:45:44 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding X-Cache-Status BYPASS X-Powered-By PHP/7.0.33 PleskLin Redirect headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 7b59b71589313a9a-FRA content-type text/html; charset=UTF-8 date Mon, 10 Apr 2023 08:45:44 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location https://acprojeto.com.br/auther.php nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dujd5pAc22flF%2B%2Bgz2eFJQFHCLjDNJ8FMnQvrriv22A36oy2sJJ4iino3hYDWDEHTWbn3Sn9TJ1ck13A3pjRnSQd9UbD3evrH1w7p66xt1vE4bxOfjujHILL8%2B8oyRZ7KT18B3w%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H/1.1	200 OK	Primary Request pay-method.php Show response grupoapro.com/combo/update/	6 KB 7 KB	1178ms 413ms	Document text/html	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `c940175f9b98b51d207d577e868409373a281925ad78081ea8786af87eda775e` Request headers Referer https://acprojeto.com.br/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Content-Encoding gzip Content-Length 6295 Content-Type text/html; charset=UTF-8 Date Mon, 10 Apr 2023 08:45:43 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server Microsoft-IIS/8.0 Vary Accept-Encoding X-Powered-By ASP.NET X-Powered-By-Plesk PleskWin
GET H/1.1	200 OK	bootstrap.min.css grupoapro.com/combo/update/assets/css/	152 KB 23 KB	315ms 315ms	Stylesheet text/css	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/css/bootstrap.min.css Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:43 GMT Content-Encoding gzip Last-Modified Wed, 13 Feb 2019 14:01:40 GMT Server Microsoft-IIS/8.0 ETag "0fa59a4a4c3d41:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 23158
GET H/1.1	200 OK	helpers.css grupoapro.com/combo/update/assets/css/	41 KB 5 KB	468ms 156ms	Stylesheet text/css	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/css/helpers.css Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Content-Encoding gzip Last-Modified Tue, 27 Nov 2018 06:16:08 GMT Server Microsoft-IIS/8.0 ETag "0845caf1886d41:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 4615
GET H/1.1	200 OK	fonts.css grupoapro.com/combo/update/assets/css/	4 KB 754 B	471ms 156ms	Stylesheet text/css	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/css/fonts.css Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `213e1c07e15eea7f20b56e8dab08ce45429188b20c55cd91d45c84cdda5c0635` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Content-Encoding gzip Last-Modified Mon, 04 Nov 2019 04:14:52 GMT Server Microsoft-IIS/8.0 ETag "086cd67c692d51:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 432
GET H/1.1	200 OK	main.css grupoapro.com/combo/update/assets/css/	7 KB 2 KB	473ms 157ms	Stylesheet text/css	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/css/main.css Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `12b149321ee22338ec4eea71aa7cd7e26f6a6523bb4fabb41a1cdddc70cb6bbe` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Content-Encoding gzip Last-Modified Wed, 18 Dec 2019 10:42:48 GMT Server Microsoft-IIS/8.0 ETag "0448ee38fb5d51:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 1683
GET H/1.1	200 OK	logo.png grupoapro.com/combo/update/assets/images/	8 KB 8 KB	303ms 157ms	Image image/png	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Show image Full URL https://grupoapro.com/combo/update/assets/images/logo.png Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `305b5de89053d7e8f5992ea78620dbd920302d3883af880d0a10b33a7babcf98` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Last-Modified Sun, 10 Nov 2019 05:06:56 GMT Server Microsoft-IIS/8.0 ETag "09854ac8497d51:0" X-Powered-By ASP.NET Content-Type image/png Accept-Ranges bytes Content-Length 8040
GET H/1.1	200 OK	ccc.png grupoapro.com/combo/update/assets/images/	4 KB 4 KB	307ms 158ms	Image image/png	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Show image Full URL https://grupoapro.com/combo/update/assets/images/ccc.png Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `f98866ff4f1462a25484ffd8a645aa4b65a203115878efb5c0d26dc3ce4157f2` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Last-Modified Mon, 16 Dec 2019 06:47:22 GMT Server Microsoft-IIS/8.0 ETag "039faaadcb3d51:0" X-Powered-By ASP.NET Content-Type image/png Accept-Ranges bytes Content-Length 4250
GET H/1.1	200 OK	jquery.min.js Show response grupoapro.com/combo/update/assets/js/	86 KB 30 KB	778ms 475ms	Script application/javascript	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/js/jquery.min.js Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Content-Encoding gzip Last-Modified Thu, 12 Sep 2019 03:52:54 GMT Server Microsoft-IIS/8.0 ETag "0ef518e1d69d51:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 30655
GET H/1.1	200 OK	popper.min.js Show response grupoapro.com/combo/update/assets/js/	20 KB 7 KB	619ms 309ms	Script application/javascript	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/js/popper.min.js Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Content-Encoding gzip Last-Modified Mon, 26 Nov 2018 02:02:46 GMT Server Microsoft-IIS/8.0 ETag "0a7d91f2c85d41:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 7235
GET H/1.1	200 OK	bootstrap.min.js Show response grupoapro.com/combo/update/assets/js/	59 KB 16 KB	492ms 476ms	Script application/javascript	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/js/bootstrap.min.js Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `da31b50d5906c738ffbc3f2562e7d4ca1d2447a6c4745faaf3fded996c661da9` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Content-Encoding gzip Last-Modified Fri, 10 Sep 2021 09:24:24 GMT Server Microsoft-IIS/8.0 ETag "0d4d2a425a6d71:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 15701
GET H/1.1	200 OK	fontawesome.min.js Show response grupoapro.com/combo/update/assets/js/	1 MB 378 KB	311ms 311ms	Script application/javascript	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/js/fontawesome.min.js Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Content-Encoding gzip Last-Modified Mon, 26 Nov 2018 05:03:18 GMT Server Microsoft-IIS/8.0 ETag "0af39584585d41:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 386696
GET H/1.1	200 OK	jquery.payment.js Show response grupoapro.com/combo/update/assets/js/	18 KB 4 KB	157ms 156ms	Script application/javascript	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/js/jquery.payment.js Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `d7399d77beb8b8da046b06a4e106e28ac095ec09882a6cf6e04d52735396a1b6` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Content-Encoding gzip Last-Modified Fri, 25 Oct 2019 01:51:08 GMT Server Microsoft-IIS/8.0 ETag "0e5eabd68ad51:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 3724
GET H/1.1	200 OK	main.js Show response grupoapro.com/combo/update/assets/js/	2 KB 3 KB	158ms 157ms	Script application/javascript	169.60.169.155 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://grupoapro.com/combo/update/assets/js/main.js Requested by Host: grupoapro.com URL: https://grupoapro.com/combo/update/pay-method.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 169.60.169.155 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS vps3.sys3-inter.net Software Microsoft-IIS/8.0 / ASP.NET Resource Hash `1610f592ec255322e51b61c1c024cf895fa3f0f1cf6606512091eedcfe068f96` Request headers accept-language de-DE,de;q=0.9 Referer https://grupoapro.com/combo/update/pay-method.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Mon, 10 Apr 2023 08:45:44 GMT Content-Encoding gzip Last-Modified Wed, 12 Feb 2020 06:10:24 GMT Server Microsoft-IIS/8.0 ETag "0c8e71c6be1d51:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 2458

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
jii.li/	1969-12-31 23:59:59	Name: PHPSESSID Value: 279fvrb6u1eb9pv983pfpsqa49
jii.li/	1970-01-20 10:58:37	Name: short_48282 Value: 1
grupoapro.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: aiu7d0sk69q50uaau4s7nb2ilo

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acprojeto.com.br
grupoapro.com
jii.li
169.60.169.155
2606:4700:3034::ac43:8e64
67.23.238.71
12b149321ee22338ec4eea71aa7cd7e26f6a6523bb4fabb41a1cdddc70cb6bbe
1610f592ec255322e51b61c1c024cf895fa3f0f1cf6606512091eedcfe068f96
213e1c07e15eea7f20b56e8dab08ce45429188b20c55cd91d45c84cdda5c0635
21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
2b3c2de2204313b19b78e19e9c519c8f432f4d9dc5460f57e1cc0bd23762cd60
305b5de89053d7e8f5992ea78620dbd920302d3883af880d0a10b33a7babcf98
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
c940175f9b98b51d207d577e868409373a281925ad78081ea8786af87eda775e
d7399d77beb8b8da046b06a4e106e28ac095ec09882a6cf6e04d52735396a1b6
da31b50d5906c738ffbc3f2562e7d4ca1d2447a6c4745faaf3fded996c661da9
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765
f98866ff4f1462a25484ffd8a645aa4b65a203115878efb5c0d26dc3ce4157f2

grupoapro.com Open in urlscan Pro 169.60.169.155 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

488 kBTransfer

1443 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

3 Cookies

Indicators

grupoapro.com Open in urlscan Pro
169.60.169.155 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

488 kB
Transfer

1443 kB
Size

3
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!