![](/screenshots/8eae98f1-b8aa-407f-9979-cec4e250e354.png)
autoescolaferrari.com
Open in
urlscan Pro
178.250.189.95
Malicious Activity!
Public Scan
Effective URL: https://autoescolaferrari.com/4t3i/
Submission: On September 26 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on September 23rd 2023. Valid for: 3 months.
This is the only time autoescolaferrari.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 185.229.66.242 185.229.66.242 | 210644 (AEZA-AS) (AEZA-AS) | |
7 | 178.250.189.95 178.250.189.95 | 203394 (MDCLOUD) (MDCLOUD) | |
7 | 1 |
ASN210644 (AEZA-AS, GB)
PTR: various-screw.aeza.network
kerstfotos.com |
ASN203394 (MDCLOUD, GB)
PTR: 254083.vps.hostiko.network
autoescolaferrari.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
autoescolaferrari.com
autoescolaferrari.com |
478 KB |
2 |
kerstfotos.com
2 redirects
kerstfotos.com |
1 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
7 | autoescolaferrari.com |
autoescolaferrari.com
|
2 | kerstfotos.com | 2 redirects |
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
autoescolaferrari.com R3 |
2023-09-23 - 2023-12-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://autoescolaferrari.com/4t3i/
Frame ID: 34A05C1183CE4FAABBECEA43F2BDC9D5
Requests: 7 HTTP requests in this frame
Screenshot
![](/screenshots/8eae98f1-b8aa-407f-9979-cec4e250e354.png)
Page Title
WhatsAppPage URL History Show full URLs
-
http://kerstfotos.com/3743575
HTTP 301
https://kerstfotos.com/3743575 HTTP 302
https://autoescolaferrari.com/4t3i/ Page URL
Detected technologies
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://kerstfotos.com/3743575
HTTP 301
https://kerstfotos.com/3743575 HTTP 302
https://autoescolaferrari.com/4t3i/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
autoescolaferrari.com/4t3i/ Redirect Chain
|
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index-244b5f6d.js
autoescolaferrari.com/4t3i/assets/ |
113 KB 113 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index-f455d7d7.css
autoescolaferrari.com/4t3i/assets/ |
360 KB 360 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
autoescolaferrari.com/socket.io/ |
118 B 357 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
autoescolaferrari.com/socket.io/ |
2 B 223 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
autoescolaferrari.com/socket.io/ |
32 B 270 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
autoescolaferrari.com/socket.io/ |
1 B 238 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture boolean| systemThemeDark object| theme object| systemThemeMode object| systemTheme boolean| darkTheme object| __VUE_INSTANCE_SETTERS__ boolean| __VUE__3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
kerstfotos.com/ | Name: _subid Value: 3eb4837a6b1 |
|
kerstfotos.com/ | Name: ec66c Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjUxXCI6MTY5NTcyNDQ0OH0sXCJjYW1wYWlnbnNcIjp7XCI1MFwiOjE2OTU3MjQ0NDh9LFwidGltZVwiOjE2OTU3MjQ0NDh9In0.zeW_ZG6lCuCGaQTXlqhHWq7c003OcOG6BSBKQM6e3LY |
|
autoescolaferrari.com/ | Name: Auth Value: 382eadcee87f1f0b09aaa678e9f51467 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
autoescolaferrari.com
kerstfotos.com
178.250.189.95
185.229.66.242
1ce82343a1c8579fd29cf39c70fb0b0463c66a13353dca1cfd73006738e205e3
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
674ad095f614b2b3b6f60d3c76c4227f09593f7e2a37cac690a506fc75cb8acd
7352c4ac7d52b405d1eee3290b161f5ec24067133e1f875d4817930c45c990e6
c4449ebfcaf3c18f45cba0d157c420e9e0d63e44b8560adc4a4748a5d73ed1ef
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
f455d7d72089983d85c9eb2c103a3fc1da6c1b8f5e63c23ec0c513f8222e4766