www.montemaq.com.br
Open in
urlscan Pro
200.198.179.54
Malicious Activity!
Public Scan
Effective URL: https://www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=d...
Submission: On February 22 via automatic, source openphish
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 4th 2017. Valid for: 3 months.
This is the only time www.montemaq.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 17 | 200.198.179.54 200.198.179.54 | 16397 (EQUINIX B...) (EQUINIX BRASIL SP) | |
1 | 104.111.251.171 104.111.251.171 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
8 | 104.111.238.93 104.111.238.93 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
25 | 3 |
ASN16397 (EQUINIX BRASIL SP, BR)
PTR: grecia.cray.com.br
www.montemaq.com.br |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-251-171.deploy.static.akamaitechnologies.com
secure.aadcdn.microsoftonline-p.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-238-93.deploy.static.akamaitechnologies.com
r1.res.office365.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
montemaq.com.br
1 redirects
www.montemaq.com.br |
3 MB |
8 |
office365.com
r1.res.office365.com |
725 KB |
1 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
454 B |
25 | 3 |
Domain | Requested by | |
---|---|---|
17 | www.montemaq.com.br |
1 redirects
www.montemaq.com.br
|
8 | r1.res.office365.com |
www.montemaq.com.br
|
1 | secure.aadcdn.microsoftonline-p.com |
www.montemaq.com.br
|
25 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.microsoftonline.com |
passwordreset.microsoftonline.com |
privacy.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
montemaq.com.br cPanel, Inc. Certification Authority |
2017-12-04 - 2018-03-04 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/457wbz7207gb6ifccfsip9x9.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=[test@testing.com]&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: (78E57EB22040D166DCA5B89F50956499)
Requests: 9 HTTP requests in this frame
Frame:
https://www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/prefetch.html
Frame ID: (36869A743612991DBD010A03DE7FE052)
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC...
HTTP 302
https://www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC... Page URL
Detected technologies
Perl (Programming Languages) ExpandDetected patterns
- headers server /mod_perl(?:\/([\d\.]+))?/i
UNIX (Operating Systems) Expand
Detected patterns
- headers server /Unix/i
OpenSSL (Web Server Extensions) Expand
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
mod_perl (Web Server Extensions) Expand
Detected patterns
- headers server /mod_perl(?:\/([\d\.]+))?/i
mod_ssl (Web Server Extensions) Expand
Detected patterns
- headers server /mod_ssl(?:\/([\d.]+))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
- headers server /mod_perl(?:\/([\d\.]+))?/i
- headers server /mod_ssl(?:\/([\d.]+))?/i
HeadJS (JavaScript Libraries) Expand
Detected patterns
- env /^head$/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: get a new Microsoft account
Search URL Search Domain Scan URL
Title: Can’t access your account?
Search URL Search Domain Scan URL
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/?email=%5btest@testing.com%5d
HTTP 302
https://www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/457wbz7207gb6ifccfsip9x9.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=[test@testing.com]&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
457wbz7207gb6ifccfsip9x9.php
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/ Redirect Chain
|
28 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.min.css
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ |
21 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hover.min.css
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ |
89 B 420 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
heroillustration
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.png
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.5482.5/content/cdnbundles/ |
89 B 454 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
prefetch.html
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ Frame (368 |
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.0.mouse.js.download
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ Frame (368 |
616 KB 617 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.1.mouse.js.download
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ Frame (368 |
615 KB 615 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.2.mouse.js.download
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ Frame (368 |
631 KB 631 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.3.mouse.js.download
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ Frame (368 |
601 KB 602 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite1.mouse.png
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ Frame (368 |
17 KB 17 KB |
Stylesheet
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite1.mouse.css
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ Frame (368 |
7 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.mouse.css
www.montemaq.com.br/dripo/.exec=destination=viewfile=6y7ugt6y7uhjsgyftcvgshbuygst/.(r5t6yfrt75gC34567890-msSFTRbk)=dhnb45678RSE5DR67T8YHJOINvcfr5t67y8ijo/oauth2_files/ Frame (368 |
182 KB 183 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.0.mouse.js
r1.res.office365.com/owa/prem/16.1641.3.2218499/scripts/ Frame (368 |
616 KB 167 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office365icons.woff
r1.res.office365.com/owa/prem/16.1641.3.2218499/resources/styles/fonts/ Frame (368 |
69 KB 70 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.1.mouse.js
r1.res.office365.com/owa/prem/16.1641.3.2218499/scripts/ Frame (368 |
615 KB 152 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.2.mouse.js
r1.res.office365.com/owa/prem/16.1641.3.2218499/scripts/ Frame (368 |
631 KB 161 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.3.mouse.js
r1.res.office365.com/owa/prem/16.1641.3.2218499/scripts/ Frame (368 |
601 KB 131 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite1.mouse.png
r1.res.office365.com/owa/prem/16.1641.3.2218499/resources/images/0/ Frame (368 |
17 KB 17 KB |
Stylesheet
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite1.mouse.css
r1.res.office365.com/owa/prem/16.1641.3.2218499/resources/images/0/ Frame (368 |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boot.worldwide.mouse.css
r1.res.office365.com/owa/prem/16.1641.3.2218499/resources/styles/0/ Frame (368 |
182 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| $Do function| GetString function| GetErrorString function| GetUrl object| $B boolean| isTouch string| cssId object| head object| link undefined| msViewportStyle0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
r1.res.office365.com
secure.aadcdn.microsoftonline-p.com
www.montemaq.com.br
104.111.238.93
104.111.251.171
200.198.179.54
14d4e89d55b1f962a895050b05a52c71c399a59764bbf5649ec09a72cd64fdbe
178df42e1f6ad96640a678fbaa3e02ec9249f073a4fbc7a96d93e49ad2dde991
1ab17681d9be59772a9fe04bc6f372666c585ae3ef5243f6835eea0aceed2215
22e2e634c4be292f6b014ab32b20312cb6d0f1ca0823153b74106ebe285503cb
40e24ee5fb3a7ad0a1f6944c52df6b7bd498e517ac05e8a846e9044c9248fbe6
4adc509888d791241ffdf9f00f634b4f6c38e09b4513c26c4cacdf1e7670e78d
4c660863b342b3cd6722ba30c181b4d48769b585e4abfd5f7494254104ee43cb
655aaf60de22be3b78c0dfcf5b9e385b8000dc5625f32f8695ac4f1c87d02fce
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91293ffbfb7e5b7df486a629115c54244f8a7d4d619406e21e3672eabe31cc20
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
9b607d8980230e60d3a40df5978de14e1d1c8f18dd7c0104974bd48ded9493ef
9fdb62c92091b48f08570b19077d643a182799347c2bcdf77ca610bddad3cbe6
c2deec71610eda786d6d857b228c2c1fda298f43c9bdcb22fdfe15d468769f76
e0a7163da2c74eeb6412f1851ce2bcfa3e7456bc7959b8790543f87350e29d35