www.analiafranco.com.br

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 177.70.106.253, located in Brazil and belongs to Mandic S.A., BR. The main domain is www.analiafranco.com.br.

This is the only time www.analiafranco.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

	IP Address		AS Autonomous System
4	177.70.106.253 177.70.106.253		262545 (Mandic S.A.) (Mandic S.A.)
4	1

4 177.70.106.253 (Brazil)

ASN262545 (Mandic S.A., BR)

www.analiafranco.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	analiafranco.com.br www.analiafranco.com.br	147 KB
4	1

	Domain	Requested by
4	www.analiafranco.com.br	www.analiafranco.com.br
4	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/itk_kbps.php
Frame ID: 19EC30F3577D5DE6C25C370D0180E83A
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

147 kB
Transfer

150 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request itk_kbps.php Show response www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/	5 KB 2 KB	691ms 465ms	Document text/html	177.70.106.253 Mandic S.A.
General Check archive.org Show headers Download Go to Full URL http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/itk_kbps.php Protocol HTTP/1.1 Server 177.70.106.253 , Brazil, ASN262545 (Mandic S.A., BR), Reverse DNS Software nginx / PHP/5.6.20 PleskLin Resource Hash `6b2e9946659f87957ca280815768b0d9d740f300c4d80fe990a031cb8f9c2b1e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.analiafranco.com.br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Mar 2018 14:33:52 GMT Content-Encoding gzip Server nginx X-Powered-By PHP/5.6.20 PleskLin Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	all_acess.css www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/css/	4 KB 4 KB	227ms 227ms	Stylesheet text/css	177.70.106.253 Mandic S.A.
General Check archive.org Show headers Download Go to Full URL http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/css/all_acess.css Requested by Host: www.analiafranco.com.br URL: http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/itk_kbps.php Protocol HTTP/1.1 Server 177.70.106.253 , Brazil, ASN262545 (Mandic S.A., BR), Reverse DNS Software nginx / PleskLin Resource Hash `1b3737682e71d644fda3aa9912ce4f0490ea75910c44b1912d5240f6f4eea19b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.analiafranco.com.br User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/itk_kbps.php Connection keep-alive Cache-Control no-cache Referer http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/itk_kbps.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Mar 2018 14:33:52 GMT ETag "f06da3-ed1-567a80f8e178f" Last-Modified Sun, 18 Mar 2018 04:13:16 GMT Server nginx X-Powered-By PleskLin Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 3793
GET H/1.1	200 OK	bg_all_acess_fi.jpg www.analiafranco.com.br/Bankline02/parceiros/_imagens/	130 KB 131 KB	228ms 228ms	Image image/jpeg	177.70.106.253 Mandic S.A.
General Check archive.org Show headers Download Go to Show image Full URL http://www.analiafranco.com.br/Bankline02/parceiros/_imagens/bg_all_acess_fi.jpg Requested by Host: www.analiafranco.com.br URL: http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/itk_kbps.php Protocol HTTP/1.1 Server 177.70.106.253 , Brazil, ASN262545 (Mandic S.A., BR), Reverse DNS Software nginx / PleskLin Resource Hash `f61db8ff444eaba3ad6e7ecdffd716231ab70f807fd93c30542304332f9a18bb` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.analiafranco.com.br User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/css/all_acess.css Connection keep-alive Cache-Control no-cache Referer http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/css/all_acess.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Mar 2018 14:33:52 GMT ETag "f06c30-2098e-567a80cc2840f" Last-Modified Sun, 18 Mar 2018 04:12:29 GMT Server nginx X-Powered-By PleskLin Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 133518
GET H/1.1	200 OK	btn_ok.jpg www.analiafranco.com.br/Bankline02/parceiros/_imagens/	11 KB 11 KB	459ms 233ms	Image image/jpeg	177.70.106.253 Mandic S.A.
General Check archive.org Show headers Download Go to Show image Full URL http://www.analiafranco.com.br/Bankline02/parceiros/_imagens/btn_ok.jpg Requested by Host: www.analiafranco.com.br URL: http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/itk_kbps.php Protocol HTTP/1.1 Server 177.70.106.253 , Brazil, ASN262545 (Mandic S.A., BR), Reverse DNS Software nginx / PleskLin Resource Hash `947637c75928e8c632b3552535287bc596c887d8ee6dc3c739d43a1fc7be1e3d` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.analiafranco.com.br User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/css/all_acess.css Connection keep-alive Cache-Control no-cache Referer http://www.analiafranco.com.br/Bankline02/parceiros/acesso/acesso/css/all_acess.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 18 Mar 2018 14:33:52 GMT ETag "f06c3a-2b4b-567a80ce532f7" Last-Modified Sun, 18 Mar 2018 04:12:32 GMT Server nginx X-Powered-By PleskLin Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 11083

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| SomenteNumero function| check_form

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.analiafranco.com.br
177.70.106.253
1b3737682e71d644fda3aa9912ce4f0490ea75910c44b1912d5240f6f4eea19b
6b2e9946659f87957ca280815768b0d9d740f300c4d80fe990a031cb8f9c2b1e
947637c75928e8c632b3552535287bc596c887d8ee6dc3c739d43a1fc7be1e3d
f61db8ff444eaba3ad6e7ecdffd716231ab70f807fd93c30542304332f9a18bb

www.analiafranco.com.br Open in urlscan Pro 177.70.106.253 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

147 kBTransfer

150 kBSize

0 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

www.analiafranco.com.br Open in urlscan Pro
177.70.106.253 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

147 kB
Transfer

150 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!