helpdesk-ap40.itfour.com.br Open in urlscan Pro
200.198.182.201 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://helpdesk-ap40.itfour.com.br/
Submission: On July 24 via api (July 24th 2024, 6:05:37 am UTC) from US — Scanned from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 13 HTTP transactions. The main IP is 200.198.182.201, located in São Paulo, Brazil and belongs to EQUINIX, NL. The main domain is helpdesk-ap40.itfour.com.br.
TLS certificate: Issued by R10 on July 22nd 2024. Valid for: 3 months.

This is the only time helpdesk-ap40.itfour.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
11	200.198.182.201 200.198.182.201	15830 (EQUINIX) (EQUINIX)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:81c::200a	15169 (GOOGLE) (GOOGLE)
13	3

11 200.198.182.201 (São Paulo, Brazil)

ASN15830 (EQUINIX, NL)

helpdesk-ap40.itfour.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	itfour.com.br helpdesk-ap40.itfour.com.br	183 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	893 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	6 KB
13	3

	Domain	Requested by
11	helpdesk-ap40.itfour.com.br	helpdesk-ap40.itfour.com.br
1	fonts.googleapis.com	helpdesk-ap40.itfour.com.br
1	cdnjs.cloudflare.com	helpdesk-ap40.itfour.com.br
13	3

This site contains no links.

Subject Issuer	Validity	Valid
helpdesk-ap40.itfour.com.br R10	`2024-07-22` - `2024-10-20`	3 months	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://helpdesk-ap40.itfour.com.br/
Frame ID: 578E5769583132831E90D250E88FD21D
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

iT4! - Portal do Parceiro

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<input[^>]+name="__VIEWSTATE

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

13
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

190 kB
Transfer

467 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
helpdesk-ap40.itfour.com.br/ 5 KB
3 KB 2319ms
872ms Document
text/html 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://helpdesk-ap40.itfour.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c1a5a37dd576fea2bc3dd5281ed303952a5bb04954cbf3a67915b76b10b11c92

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cache-control: private
content-encoding: gzip
content-length: 2559
content-type: text/html; charset=utf-8
date: Wed, 24 Jul 2024 06:05:24 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET

GET
H2 200 servicedesk.css
helpdesk-ap40.itfour.com.br/Content/ 9 KB
3 KB 273ms
270ms Stylesheet
text/css 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://helpdesk-ap40.itfour.com.br/Content/servicedesk.css
Requested by: Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1f576177c65a53d12bbb11c66b6b552a23d6a648384b7941746219fec8f2f471

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:24 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2022 13:23:36 GMT
server: Microsoft-IIS/10.0
etag: "66edbcf4c6cd81:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 2560

GET
H2 200 bootstrap.min.css
helpdesk-ap40.itfour.com.br/Content/ 156 KB
36 KB 530ms
527ms Stylesheet
text/css 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://helpdesk-ap40.itfour.com.br/Content/bootstrap.min.css
Requested by: Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:24 GMT
content-encoding: gzip
last-modified: Thu, 27 Feb 2020 12:46:14 GMT
server: Microsoft-IIS/10.0
etag: "16ef3ee56bedd51:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 36257

GET
H3 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 190ms
91ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1011838
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5631
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-7918"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OpXJ93uZHiNzOH%2FlVq%2F7N21uTUP6WPkAEVVW4tKPY6sEHpTYb3WqasQjxuxcxoA%2Ft8eIjMPT%2BvsTZnalu7lAbNAEp23zgLhTCopG9AKptliHPS9MoAhT0E1DELBgOwAH8q2PbfX4"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a81b7e2ff501637-SJC
expires: Mon, 14 Jul 2025 06:05:24 GMT

GET
H2 200 WebResource.axd Show response
helpdesk-ap40.itfour.com.br/ 23 KB
6 KB 271ms
269ms Script
application/x-javascript 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://helpdesk-ap40.itfour.com.br/WebResource.axd?d=pynGkmcFUV13He1Qd6_TZILtjGP9Yw4hNkEjmgCIL2Ii7-v_r1ZeFoziK2nJJE-3hTdMjmkz8vc22P5-JW9qnQ2&t=638463643005154172
Requested by: Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:24 GMT
content-encoding: gzip
last-modified: Mon, 18 Mar 2024 16:11:40 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public
content-length: 6007
expires: Thu, 24 Jul 2025 06:05:24 GMT

GET
H2 200 ScriptResource.axd Show response
helpdesk-ap40.itfour.com.br/ 100 KB
25 KB 1053ms
1051ms Script
application/x-javascript 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://helpdesk-ap40.itfour.com.br/ScriptResource.axd?d=NJmAwtEo3Ipnlaxl6CMhvjMznxz1ag8sxSrwOoB4DjQ64Vyk2TPN6C8Ed3DMZVkiHsWdjUZYL7jR0CWZc2QLR6v6Ra2x1osPIokayi9Yz8RGNaWmkNkH_BxoTeewARQpQx-PQJqUfVEFLqtmCu3_qkpuqRckGiIdm-TCNSmhcJA1&t=ffffffffe6d5a9ac
Requested by: Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 66b804e7a96a87c11e1dd74ea04ac2285df5ad9043f48046c3e5000114d39b1c

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:24 GMT
content-encoding: gzip
last-modified: Wed, 24 Jul 2024 06:05:24 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: application/x-javascript
cache-control: public
content-length: 25609
expires: Thu, 24 Jul 2025 06:05:24 GMT

GET
H2 200 ScriptResource.axd Show response
helpdesk-ap40.itfour.com.br/ 39 KB
10 KB 1051ms
1049ms Script
application/x-javascript 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://helpdesk-ap40.itfour.com.br/ScriptResource.axd?d=dwY9oWetJoJoVpgL6Zq8OLDkO8EbPUldWg3AeRPwSPYORmrWVwFLhgog2O4wGo5tToXepxuaiDqL0EwiXesWkCgRnvgAlCTRLY8w8JTgRDR_iWF0ZQa5FN1S6H1ILLBqKtfb9D4VlQN1u6R757fw6HDFJWXMfjczSinj3Nly-sE1&t=ffffffffe6d5a9ac
Requested by: Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 398cdf1b27ef247e5bc77805f266bb441e60355463fc3d1776f41aae58b08cf1

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:24 GMT
content-encoding: gzip
last-modified: Wed, 24 Jul 2024 06:05:24 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: application/x-javascript
cache-control: public
content-length: 9984
expires: Thu, 24 Jul 2025 06:05:24 GMT

GET
H2 200 WebResource.axd Show response
helpdesk-ap40.itfour.com.br/ 3 KB
1021 B 1050ms
1048ms Script
application/x-javascript 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://helpdesk-ap40.itfour.com.br/WebResource.axd?d=JoBkLzP19aTuxbWOhHobYgdfpb_y2sw7RRt9vXiTGN9fSZrzmwUqI1m47ltNuS-DLvuYYe4GCQENfD3BcrkylA2&t=638463643005154172
Requested by: Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 144524233f795d6a425b76f7ae5c0bb622b5f67e2e6ae73532ad526528ca07cf

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:24 GMT
content-encoding: gzip
last-modified: Mon, 18 Mar 2024 16:11:40 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public
content-length: 978
expires: Thu, 24 Jul 2025 06:05:24 GMT

GET
H2 200 logo_iT4.png
helpdesk-ap40.itfour.com.br/Assets/ 5 KB
5 KB 549ms
548ms Image
image/png 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://helpdesk-ap40.itfour.com.br/Assets/logo_iT4.png
Requested by: Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d2d205871ecd87ac9ea6e35ba9a9e8b317a1147987b930a0693f863889291d5c

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:24 GMT
last-modified: Thu, 27 Feb 2020 15:05:53 GMT
server: Microsoft-IIS/10.0
etag: "57f0677fedd51:0"
x-powered-by: ASP.NET
content-type: image/png
accept-ranges: bytes
content-length: 4611

GET
H2 200 loading.gif
helpdesk-ap40.itfour.com.br/Assets/ 77 KB
77 KB 787ms
786ms Image
image/gif 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://helpdesk-ap40.itfour.com.br/Assets/loading.gif
Requested by: Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 16216e9cd993453b11bdb3188456c241b6f1925893c1539ab3a7a5e526236a1d

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:24 GMT
last-modified: Thu, 27 Feb 2020 17:37:39 GMT
server: Microsoft-IIS/10.0
etag: "d672579b94edd51:0"
x-powered-by: ASP.NET
content-type: image/gif
accept-ranges: bytes
content-length: 79073

GET
H2 200 css
fonts.googleapis.com/ 1 KB
893 B 450ms
160ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Quicksand&display=swap

Requested by

Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/Content/servicedesk.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1e8aa706d96df48dad9bcfdfdd590efb2d53a8650e85396f95ad3e3daff3db77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 24 Jul 2024 06:05:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 24 Jul 2024 04:11:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Jul 2024 06:05:24 GMT

GET
H2 200 ServiceDeskBG6.jpg
helpdesk-ap40.itfour.com.br/Assets/ 17 KB
17 KB 263ms
262ms Image
image/jpeg 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://helpdesk-ap40.itfour.com.br/Assets/ServiceDeskBG6.jpg
Requested by: Host: helpdesk-ap40.itfour.com.br
URL: https://helpdesk-ap40.itfour.com.br/Content/servicedesk.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/Content/servicedesk.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:25 GMT
last-modified: Wed, 16 Sep 2020 21:34:22 GMT
server: Microsoft-IIS/10.0
etag: "b1caf24718cd61:0"
x-powered-by: ASP.NET
content-type: image/jpeg
accept-ranges: bytes
content-length: 17453

GET
H2 200 favicon.ico
helpdesk-ap40.itfour.com.br/Assets/ 1 KB
1 KB 261ms
261ms Other
image/x-icon 200.198.182.201
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://helpdesk-ap40.itfour.com.br/Assets/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 200.198.182.201 São Paulo, Brazil, ASN15830 (EQUINIX, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 78cee3d1ab4e310f639380209d963aa306d85f3b7ea0f5f84b54eef8568040ce

Request headers

Referer: https://helpdesk-ap40.itfour.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 06:05:25 GMT
last-modified: Thu, 27 Feb 2020 13:45:01 GMT
server: Microsoft-IIS/10.0
etag: "1959981b74edd51:0"
x-powered-by: ASP.NET
content-type: image/x-icon
accept-ranges: bytes
content-length: 1406

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			helpdesk-ap40.itfour.com.br/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: toz0jfhqqjvpdygr3o43e34t

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://helpdesk-ap40.itfour.com.br/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
fonts.googleapis.com
helpdesk-ap40.itfour.com.br
104.17.25.14
200.198.182.201
2607:f8b0:4006:81c::200a
144524233f795d6a425b76f7ae5c0bb622b5f67e2e6ae73532ad526528ca07cf
16216e9cd993453b11bdb3188456c241b6f1925893c1539ab3a7a5e526236a1d
1e8aa706d96df48dad9bcfdfdd590efb2d53a8650e85396f95ad3e3daff3db77
1f576177c65a53d12bbb11c66b6b552a23d6a648384b7941746219fec8f2f471
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
398cdf1b27ef247e5bc77805f266bb441e60355463fc3d1776f41aae58b08cf1
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
66b804e7a96a87c11e1dd74ea04ac2285df5ad9043f48046c3e5000114d39b1c
78cee3d1ab4e310f639380209d963aa306d85f3b7ea0f5f84b54eef8568040ce
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
c1a5a37dd576fea2bc3dd5281ed303952a5bb04954cbf3a67915b76b10b11c92
d2d205871ecd87ac9ea6e35ba9a9e8b317a1147987b930a0693f863889291d5c
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

helpdesk-ap40.itfour.com.br Open in urlscan Pro 200.198.182.201 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

190 kBTransfer

467 kBSize

1 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

59 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

helpdesk-ap40.itfour.com.br Open in urlscan Pro
200.198.182.201 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

190 kB
Transfer

467 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!