158.197.95.34.bc.googleusercontent.com
Open in
urlscan Pro
34.95.197.158
Malicious Activity!
Public Scan
Submitted URL: http://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save4.php
Effective URL: http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=13,48,10,PM,44,2,02,000000,14,1,2020,Friday;.dll
Submission: On February 14 via api from CA
Effective URL: http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=13,48,10,PM,44,2,02,000000,14,1,2020,Friday;.dll
Submission: On February 14 via api from CA
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 34.95.197.158, located in
United States and
belongs to GOOGLE, US.
The main domain is 158.197.95.34.bc.googleusercontent.com.
This is the only time 158.197.95.34.bc.googleusercontent.com was scanned on urlscan.io!
This is the only time 158.197.95.34.bc.googleusercontent.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banco Itau (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 8 | 34.95.197.158 34.95.197.158 | 15169 (GOOGLE) (GOOGLE) | |
| 7 | 1 |
8
34.95.197.158
(United States)
ASN15169 (GOOGLE, US)
PTR: 158.197.95.34.bc.googleusercontent.com
ASN15169 (GOOGLE, US)
PTR: 158.197.95.34.bc.googleusercontent.com
| 158.197.95.34.bc.googleusercontent.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
googleusercontent.com
1 redirects
158.197.95.34.bc.googleusercontent.com |
90 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 8 | 158.197.95.34.bc.googleusercontent.com |
1 redirects
158.197.95.34.bc.googleusercontent.com
|
| 7 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=13,48,10,PM,44,2,02,000000,14,1,2020,Friday;.dll
Frame ID: 7C3E7628DBAF857EF1C75DD4016E54C0
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save4.php
HTTP 302
http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=13,48,10,PM,44,2,02,000000,... Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Ubuntu
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Ubuntu/i
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save4.php
HTTP 302
http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=13,48,10,PM,44,2,02,000000,14,1,2020,Friday;.dll Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
router_finish.php
158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.css
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/ |
196 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
_home.css
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo2.png
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/ |
41 KB 41 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
30horas.png
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
empresa.png
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
loading.gif
158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/ |
14 KB 15 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banco Itau (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate string| Cod function| SetNovo0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
158.197.95.34.bc.googleusercontent.com
34.95.197.158
305548fd47969838632e728513aeaa10fa877cdc2760440163f8f0a0b001c179
30bdac7863e281c4a40fd3486434041fafa2fa73ecc77c8efb6ea785bd2a0ba9
450f0a54063643428ac021b8b70c0f1180dce15e46e87c73b48bf77151bf4bd5
4c421aab8d61e958d50547c91cef51de755fc37ef25b6fbf735b1fb3cfa14d93
7fd6386516d11c73ccf9649b59b0edf76f541bfab3b4787f0474e8957e992e38
9d7e36f365c1da17289b26706a8f996d1713ee5fd647f7be43fdcbd60f464d39
bad8117c7b23f326216e85e630e3915ea1c73387a7b7d2da61e800e96fc8b8c6