www.nacionalproduto.com.br

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 7 HTTP transactions. The main IP is 69.49.115.40, located in Fort Lauderdale, United States and belongs to INFB2-AS - InternetNamesForBusiness.com, US. The main domain is www.nacionalproduto.com.br.

This is the only time www.nacionalproduto.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2001:8d8:1000... 2001:8d8:1000:f14d:1661:3a5:2312:e804	8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48)
3	69.49.115.40 69.49.115.40	30447 (INFB2-AS) (INFB2-AS - InternetNamesForBusiness.com)
2	66.175.41.113 66.175.41.113	30447 (INFB2-AS) (INFB2-AS - InternetNamesForBusiness.com)
2	2a02:26f0:122... 2a02:26f0:122:39e::bfb	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	3

1 2001:8d8:1000:f14d:1661:3a5:2312:e804 (Germany) 1 redirects

ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)

laboratorioinstantlab.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 69.49.115.40 (Fort Lauderdale, United States)

ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US)
PTR: hostedc76.carrierzone.com

www.nacionalproduto.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.175.41.113 (Davis, United States)

ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US)
PTR: testmerch2.carrierzone.com

count.carrierzone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:122:39e::bfb (European Union)

ASN20940 (AKAMAI-ASN1, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	nacionalproduto.com.br www.nacionalproduto.com.br	88 KB
2	nflxext.com assets.nflxext.com	174 KB
2	carrierzone.com count.carrierzone.com	35 KB
1	laboratorioinstantlab.com 1 redirects laboratorioinstantlab.com	291 B
7	4

	Domain	Requested by
3	www.nacionalproduto.com.br	www.nacionalproduto.com.br
2	assets.nflxext.com	www.nacionalproduto.com.br
2	count.carrierzone.com	www.nacionalproduto.com.br
1	laboratorioinstantlab.com	1 redirects
7	4

This site contains no links.

Subject Issuer	Validity	Valid
*.carrierzone.com RapidSSL SHA256 CA - G3	`2015-08-10` - `2018-10-16`	3 years	crt.sh
secure.cdn.nflximg.net Symantec Class 3 Secure Server CA - G4	`2017-03-27` - `2019-03-27`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://www.nacionalproduto.com.br/195www.netflix.com/Login/
Frame ID: 22858.1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://laboratorioinstantlab.com/1pago-netflix.php HTTP 302
http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

Page Statistics

7
Requests

43 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

297 kB
Transfer

297 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://laboratorioinstantlab.com/1pago-netflix.php HTTP 302
http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response www.nacionalproduto.com.br/195www.netflix.com/Login/ Redirect Chain http://laboratorioinstantlab.com/1pago-netflix.php http://www.nacionalproduto.com.br/195www.netflix.com/Login/	4 KB 4 KB	702ms 277ms	Document text/html	69.49.115.40 InternetNamesForB...
General Check archive.org Show headers Download Go to Full URL http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Protocol HTTP/1.1 Server 69.49.115.40 Fort Lauderdale, United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US), Reverse DNS hostedc76.carrierzone.com Software / Resource Hash `ad5f4d30ec3df0c5449cebf1b6919da10b415c04a0d6a17b54ab505d89334e23` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.nacionalproduto.com.br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Cache-Control no-cache Connection keep-alive User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Response headers Date Thu, 12 Oct 2017 15:57:00 GMT Connection Keep-Alive Set-Cookie TS0194eee0=013c871b0608c512d20d263c32d84a13bf918a9ffba22c20efbc45e0126064b9819365a300b417a2c965b3f60925533ea705b715dd; Path=/ Keep-Alive timeout=10, max=100 Content-Length 4011 Content-Type text/html; charset=UTF-8 Redirect headers Date Thu, 12 Oct 2017 15:56:59 GMT Server Apache X-Powered-By PHP/5.6.31 Content-Type text/html; charset=UTF-8 Location http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Connection keep-alive Keep-Alive timeout=15 Content-Length 0
GET H/1.1	200 OK	Cookie set z.css www.nacionalproduto.com.br/195www.netflix.com/Login/css/	35 KB 35 KB	133ms 133ms	Stylesheet text/css	69.49.115.40 InternetNamesForB...
General Check archive.org Show headers Download Go to Full URL http://www.nacionalproduto.com.br/195www.netflix.com/Login/css/z.css Requested by Host: www.nacionalproduto.com.br URL: http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Protocol HTTP/1.1 Server 69.49.115.40 Fort Lauderdale, United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US), Reverse DNS hostedc76.carrierzone.com Software / Resource Hash `4abd9472f2e7b527e94d3861e1be1bcb93e7aea5540a8675b68659cd45da427c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.nacionalproduto.com.br User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Cookie TS0194eee0=013c871b0608c512d20d263c32d84a13bf918a9ffba22c20efbc45e0126064b9819365a300b417a2c965b3f60925533ea705b715dd Connection keep-alive Cache-Control no-cache Referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Response headers Date Thu, 12 Oct 2017 15:57:00 GMT Connection Keep-Alive Last-Modified Sat, 21 May 2016 16:48:38 GMT Set-Cookie TS0194eee0=013c871b0608c512d20d263c32d84a13bf918a9ffba22c20efbc45e0126064b9819365a300b417a2c965b3f60925533ea705b715dd; Path=/ Keep-Alive timeout=10, max=99 Content-Length 36174 Content-Type text/css
GET H/1.1	200 OK	Cookie set a.css www.nacionalproduto.com.br/195www.netflix.com/Login/css/	49 KB 49 KB	263ms 133ms	Stylesheet text/css	69.49.115.40 InternetNamesForB...
General Check archive.org Show headers Download Go to Full URL http://www.nacionalproduto.com.br/195www.netflix.com/Login/css/a.css Requested by Host: www.nacionalproduto.com.br URL: http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Protocol HTTP/1.1 Server 69.49.115.40 Fort Lauderdale, United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US), Reverse DNS hostedc76.carrierzone.com Software / Resource Hash `7131bec2f0db051e6501f4c8523d0cad23dca3a5813306ab5458e53a3bf6a820` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.nacionalproduto.com.br User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Cookie TS0194eee0=013c871b0608c512d20d263c32d84a13bf918a9ffba22c20efbc45e0126064b9819365a300b417a2c965b3f60925533ea705b715dd Connection keep-alive Cache-Control no-cache Referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Response headers Date Thu, 12 Oct 2017 15:57:00 GMT Connection Keep-Alive Last-Modified Sat, 21 May 2016 17:17:40 GMT Set-Cookie TS0194eee0=013c871b0608c512d20d263c32d84a13bf918a9ffba22c20efbc45e0126064b9819365a300b417a2c965b3f60925533ea705b715dd; Path=/ Keep-Alive timeout=10, max=100 Content-Length 49899 Content-Type text/css
GET H/1.1	200 OK	count.js Show response count.carrierzone.com/app/count_server/	35 KB 35 KB	670ms 134ms	Script text/javascript	66.175.41.113 InternetNamesForB...
General Check archive.org Show headers Download Go to Full URL https://count.carrierzone.com/app/count_server/count.js Requested by Host: www.nacionalproduto.com.br URL: http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.175.41.113 Davis, United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US), Reverse DNS testmerch2.carrierzone.com Software Apache/2.2.15 (CentOS) / Resource Hash `f418e6b5416f03cbc22b24f481582e2d55ee0f7ca6989c562b59f12c9229214e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host count.carrierzone.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Accept / Referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Connection keep-alive Cache-Control no-cache Referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Response headers Date Thu, 12 Oct 2017 15:57:00 GMT Last-Modified Fri, 08 Jun 2012 10:17:02 GMT Server Apache/2.2.15 (CentOS) Content-Type text/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=100 Content-Length 36029
GET H2	200	login-daredevil-1500x1000.2.jpg assets.nflxext.com/ffe/siteui/acquisition/login/	96 KB 97 KB	39ms 12ms	Image image/jpeg	2a02:26f0:122:39e::bfb AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/login/login-daredevil-1500x1000.2.jpg Requested by Host: www.nacionalproduto.com.br URL: http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:39e::bfb , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash `2fe58973af7207f53c1b315444103f8262b3e4d58c67c7770c68b852a5a8bceb` Request headers :path /ffe/siteui/acquisition/login/login-daredevil-1500x1000.2.jpg pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority assets.nflxext.com referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/css/a.css :scheme https :method GET Referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/css/a.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Response headers date Thu, 12 Oct 2017 15:57:01 GMT last-modified Fri, 18 Dec 2015 17:08:57 GMT server Apache content-md5 jSqaRFvrocE+IrF4v/nvmA== content-type image/jpeg status 200 cache-control public, max-age=79156979 accept-ranges bytes content-length 98672 expires Wed, 15 Apr 2020 20:00:00 GMT
GET H2	200	nf-icon-v1-80.woff assets.nflxext.com/ffe/siteui/fonts/	78 KB 77 KB	35ms 8ms	Font application/octet-stream	2a02:26f0:122:39e::bfb AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-80.woff Requested by Host: www.nacionalproduto.com.br URL: http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:39e::bfb , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash `2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d` Request headers :path /ffe/siteui/fonts/nf-icon-v1-80.woff pragma no-cache origin http://www.nacionalproduto.com.br accept-encoding gzip, deflate user-agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 accept / cache-control no-cache :authority assets.nflxext.com referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/css/z.css :scheme https :method GET User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/css/z.css Origin http://www.nacionalproduto.com.br Response headers date Thu, 12 Oct 2017 15:57:01 GMT content-encoding gzip last-modified Thu, 28 Jan 2016 20:46:04 GMT server Apache content-md5 GkWpE2r/FESZk08OjSTsgQ== status 200 vary Accept-Encoding content-type text/plain access-control-allow-origin * cache-control public, max-age=79156979 accept-ranges bytes expires Wed, 15 Apr 2020 20:00:00 GMT
GET H/1.1	200 OK	Cookie set ctin.php count.carrierzone.com/track/	42 B 42 B	463ms 323ms	Image image/gif	66.175.41.113 InternetNamesForB...
General Check archive.org Show headers Download Go to Show image Full URL http://count.carrierzone.com/track/ctin.php?t=1507823821490&custnum=9325d01571ac2c39&sname=www.nacionalproduto.com.br&pagename=index.php&group=%2Fservices%2Fwebpages%2Fn%2Fa%2Fnacionalproduto.com.br%2Fpublic%2F195www.netflix.com%2FLogin&version=%24Rev%3A%207840%20%24&js=1&jv=0&resolution=1600x1200&color_depth=24&campaign=&referrer=&page_url=http%253A%252F%252Fwww.nacionalproduto.com.br%252F195www.netflix.com%252FLogin%252F&plugins= Requested by Host: www.nacionalproduto.com.br URL: http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Protocol HTTP/1.1 Server 66.175.41.113 Davis, United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US), Reverse DNS testmerch2.carrierzone.com Software Apache/2.2.15 (CentOS) / PHP/5.2.17 Resource Hash `5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host count.carrierzone.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.nacionalproduto.com.br/195www.netflix.com/Login/ Connection keep-alive Cache-Control no-cache Referer http://www.nacionalproduto.com.br/195www.netflix.com/Login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36 Response headers Pragma no-cache Date Thu, 12 Oct 2017 15:57:01 GMT Last-Modified Thu, 12 Oct 2017 15:57:01 GMT Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.2.17 P3P CP="NOI NID ADMa OUR IND UNI COM NAV" Set-Cookie CTCNTNM_9325d01571ac2c39=6dcd32d0cdd782f2c44f452d473e5a04; expires=Wed, 10-Jan-2018 15:57:01 GMT Cache-Control no-store, no-cache, must-revalidate post-check=0, pre-check=0 Connection Keep-Alive Content-Type image/gif Keep-Alive timeout=10, max=100 Content-Length 42 Expires Thu, 01 Jan 1970 01:23:45 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.nacionalproduto.com.br/	1970-01-01 00:00:00	Name: TS0194eee0 Value: 013c871b0608c512d20d263c32d84a13bf918a9ffba22c20efbc45e0126064b9819365a300b417a2c965b3f60925533ea705b715dd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
count.carrierzone.com
laboratorioinstantlab.com
www.nacionalproduto.com.br
2001:8d8:1000:f14d:1661:3a5:2312:e804
2a02:26f0:122:39e::bfb
66.175.41.113
69.49.115.40
2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d
2fe58973af7207f53c1b315444103f8262b3e4d58c67c7770c68b852a5a8bceb
4abd9472f2e7b527e94d3861e1be1bcb93e7aea5540a8675b68659cd45da427c
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947
7131bec2f0db051e6501f4c8523d0cad23dca3a5813306ab5458e53a3bf6a820
ad5f4d30ec3df0c5449cebf1b6919da10b415c04a0d6a17b54ab505d89334e23
f418e6b5416f03cbc22b24f481582e2d55ee0f7ca6989c562b59f12c9229214e

www.nacionalproduto.com.br Open in urlscan Pro 69.49.115.40 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

43 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

297 kBTransfer

297 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

www.nacionalproduto.com.br Open in urlscan Pro
69.49.115.40 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

43 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

297 kB
Transfer

297 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!