inusual-ip-l0gin.vastserve.com Open in urlscan Pro
185.27.134.106  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://inusual-ip-l0gin.vastserve.com/?i=2 Page URL
2. http://inusual-ip-l0gin.vastserve.com/?i=3 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response inusual-ip-l0gin.vastserve.com/	841 B 836 B	359ms 123ms	Document text/html	185.27.134.106 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://inusual-ip-l0gin.vastserve.com/?i=2 Protocol HTTP/1.1 Server 185.27.134.106 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash 89e38cbbd9f5a51d13377bdadf739bca89a965a36ae2d64357397601555a2ddd Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Cache-Control no-cache Connection keep-alive Content-Encoding gzip Content-Type text/html Date Wed, 07 Jun 2023 15:58:55 GMT Expires Thu, 01 Jan 1970 00:00:01 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding
GET H/1.1	200 OK	aes.js Show response inusual-ip-l0gin.vastserve.com/	30 KB 31 KB	124ms 123ms	Script application/javascript	185.27.134.106 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://inusual-ip-l0gin.vastserve.com/aes.js Requested by Host: inusual-ip-l0gin.vastserve.com URL: http://inusual-ip-l0gin.vastserve.com/?i=2 Protocol HTTP/1.1 Server 185.27.134.106 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc Request headers accept-language en-US,en;q=0.9 Referer http://inusual-ip-l0gin.vastserve.com/?i=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers Date Wed, 07 Jun 2023 15:58:56 GMT Last-Modified Sat, 08 Aug 2015 08:12:32 GMT Server nginx ETag "55c5b9f0-79e6" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 31206
GET H/1.1	200 OK	Primary Request / Show response inusual-ip-l0gin.vastserve.com/	3 KB 1 KB	154ms 152ms	Document text/html	185.27.134.106 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://inusual-ip-l0gin.vastserve.com/?i=3 Requested by Host: inusual-ip-l0gin.vastserve.com URL: http://inusual-ip-l0gin.vastserve.com/?i=2 Protocol HTTP/1.1 Server 185.27.134.106 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash dc2332761d2f259ad72ad69921bd9864e9c997b4441a6fdbdafeedb26f022c87 Request headers Referer http://inusual-ip-l0gin.vastserve.com/?i=2 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate Connection keep-alive Content-Encoding gzip Content-Type text/html Date Wed, 07 Jun 2023 15:58:56 GMT Expires Fri, 07 Jul 2023 15:58:56 GMT Last-Modified Wed, 05 Apr 2023 19:33:41 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	css2 fonts.googleapis.com/	11 KB 1 KB	182ms 75ms	Stylesheet text/css	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:wght@100;400;500;700;900&display=swap Requested by Host: inusual-ip-l0gin.vastserve.com URL: http://inusual-ip-l0gin.vastserve.com/?i=3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2fc1849983f4ee3d42dc8f4f6054fddab0301e1417082175dee6bf8d30e4b7cb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer http://inusual-ip-l0gin.vastserve.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Wed, 07 Jun 2023 15:58:57 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 07 Jun 2023 14:06:57 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 07 Jun 2023 15:58:57 GMT
GET H/1.1	200 OK	normalize.css inusual-ip-l0gin.vastserve.com/assets/css/	7 KB 2 KB	125ms 124ms	Stylesheet text/css	185.27.134.106 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://inusual-ip-l0gin.vastserve.com/assets/css/normalize.css Requested by Host: inusual-ip-l0gin.vastserve.com URL: http://inusual-ip-l0gin.vastserve.com/?i=3 Protocol HTTP/1.1 Server 185.27.134.106 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash d592f1c585062f14b5c94145f916377badda3351026d67a5c96f95f8a6885472 Request headers accept-language en-US,en;q=0.9 Referer http://inusual-ip-l0gin.vastserve.com/?i=3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers Date Wed, 07 Jun 2023 15:58:56 GMT Content-Encoding gzip Last-Modified Wed, 05 Apr 2023 19:33:44 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate Connection keep-alive Expires Fri, 07 Jul 2023 15:58:56 GMT
GET H/1.1	200 OK	styles.css inusual-ip-l0gin.vastserve.com/assets/css/	3 KB 1 KB	246ms 123ms	Stylesheet text/css	185.27.134.106 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://inusual-ip-l0gin.vastserve.com/assets/css/styles.css Requested by Host: inusual-ip-l0gin.vastserve.com URL: http://inusual-ip-l0gin.vastserve.com/?i=3 Protocol HTTP/1.1 Server 185.27.134.106 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash aceb8c9e6030be6ccec4009e271f0e98974dc9e8dfcdd2767251b872645bba53 Request headers accept-language en-US,en;q=0.9 Referer http://inusual-ip-l0gin.vastserve.com/?i=3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers Date Wed, 07 Jun 2023 15:58:57 GMT Content-Encoding gzip Last-Modified Wed, 05 Apr 2023 19:33:44 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate Connection keep-alive Expires Fri, 07 Jul 2023 15:58:57 GMT
GET H/1.1	200 OK	l.png inusual-ip-l0gin.vastserve.com/assets/images/	4 KB 5 KB	247ms 124ms	Image image/png	185.27.134.106 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Show image Full URL http://inusual-ip-l0gin.vastserve.com/assets/images/l.png Requested by Host: inusual-ip-l0gin.vastserve.com URL: http://inusual-ip-l0gin.vastserve.com/?i=3 Protocol HTTP/1.1 Server 185.27.134.106 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash f947d9a990cae972a26578ab12d4a0404e23c278b91522ea8697f1f9c7c36c2f Request headers accept-language en-US,en;q=0.9 Referer http://inusual-ip-l0gin.vastserve.com/?i=3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers Date Wed, 07 Jun 2023 15:58:57 GMT Last-Modified Wed, 05 Apr 2023 19:33:47 GMT Server nginx Content-Type image/png Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate Connection keep-alive Accept-Ranges bytes Content-Length 4390 Expires Fri, 07 Jul 2023 15:58:57 GMT
GET H/1.1	200 OK	functions.js Show response inusual-ip-l0gin.vastserve.com/assets/js/	514 B 581 B	231ms 125ms	Script application/javascript	185.27.134.106 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://inusual-ip-l0gin.vastserve.com/assets/js/functions.js Requested by Host: inusual-ip-l0gin.vastserve.com URL: http://inusual-ip-l0gin.vastserve.com/?i=3 Protocol HTTP/1.1 Server 185.27.134.106 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash 790597e6103f483a8917d3a5393ab4f86626ac6716dc29dafa7f839a0a31bc1b Request headers accept-language en-US,en;q=0.9 Referer http://inusual-ip-l0gin.vastserve.com/?i=3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers Date Wed, 07 Jun 2023 15:58:57 GMT Content-Encoding gzip Last-Modified Wed, 05 Apr 2023 19:33:50 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate Connection keep-alive Expires Fri, 07 Jul 2023 15:58:57 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	163ms 45ms	Font font/woff2	2607:f8b0:4006:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:wght@100;400;500;700;900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80f::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://inusual-ip-l0gin.vastserve.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 03 Jun 2023 05:55:40 GMT x-content-type-options nosniff age 381797 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 02 Jun 2024 05:55:40 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	175ms 57ms	Font font/woff2	2607:f8b0:4006:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:wght@100;400;500;700;900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80f::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://inusual-ip-l0gin.vastserve.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 03 Jun 2023 17:16:32 GMT x-content-type-options nosniff age 340945 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 02 Jun 2024 17:16:32 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			inusual-ip-l0gin.vastserve.com/	1970-01-20 21:58:33	Name: __test Value: 2667634c40cf71b83cf94a87715f26d2

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: http://inusual-ip-l0gin.vastserve.com/?i=3(Line 9) Message: The key "minimun-sacale" is not recognized and ignored.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
inusual-ip-l0gin.vastserve.com
185.27.134.106
2607:f8b0:4006:80b::200a
2607:f8b0:4006:80f::2003
2fc1849983f4ee3d42dc8f4f6054fddab0301e1417082175dee6bf8d30e4b7cb
790597e6103f483a8917d3a5393ab4f86626ac6716dc29dafa7f839a0a31bc1b
89e38cbbd9f5a51d13377bdadf739bca89a965a36ae2d64357397601555a2ddd
aceb8c9e6030be6ccec4009e271f0e98974dc9e8dfcdd2767251b872645bba53
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc
d592f1c585062f14b5c94145f916377badda3351026d67a5c96f95f8a6885472
dc2332761d2f259ad72ad69921bd9864e9c997b4441a6fdbdafeedb26f022c87
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f947d9a990cae972a26578ab12d4a0404e23c278b91522ea8697f1f9c7c36c2f