opaodontologia.com
Open in
urlscan Pro
108.179.252.34
Malicious Activity!
Public Scan
Effective URL: https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/?sslchannel=true&sessionid=...
Submission: On June 25 via api from CH
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on June 5th 2019. Valid for: 3 months.
This is the only time opaodontologia.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online) Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 204.10.38.146 204.10.38.146 | 33322 (NDCHOST) (NDCHOST - Network Data Center Host) | |
2 14 | 108.179.252.34 108.179.252.34 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
1 | 64.111.118.105 64.111.118.105 | 26347 (DREAMHOST-AS) (DREAMHOST-AS - New Dream Network) | |
1 | 54.173.243.251 54.173.243.251 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
14 | 3 |
ASN33322 (NDCHOST - Network Data Center Host, Inc., US)
PTR: cp1.ndchost.com
pegasusablon.omoriginals.com |
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: br510-ip05.hostgator.com.br
opaodontologia.com |
ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US)
PTR: sepusa.com
www.sepusa.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-173-243-251.compute-1.amazonaws.com
auth.mycase.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
opaodontologia.com
2 redirects
opaodontologia.com |
34 KB |
1 |
mycase.com
auth.mycase.com |
9 KB |
1 |
sepusa.com
www.sepusa.com |
20 KB |
1 |
omoriginals.com
1 redirects
pegasusablon.omoriginals.com |
263 B |
14 | 4 |
Domain | Requested by | |
---|---|---|
14 | opaodontologia.com |
2 redirects
opaodontologia.com
|
1 | auth.mycase.com |
opaodontologia.com
|
1 | www.sepusa.com |
opaodontologia.com
|
1 | pegasusablon.omoriginals.com | 1 redirects |
14 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
opaodontologia.com Let's Encrypt Authority X3 |
2019-06-05 - 2019-09-03 |
3 months | crt.sh |
www.sepusa.com Go Daddy Secure Certificate Authority - G2 |
2018-06-22 - 2020-06-22 |
2 years | crt.sh |
*.mycase.com COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-11-12 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/?sslchannel=true&sessionid=syA1EUjKEpH7SPrv48oQQWvAXGE7tRPWqpX4jgPXGw5ymw3qEsguoM5mtKuXCjT2JQ727W0Nt6lQCpgh
Frame ID: 7BE73BCE8A1D91FD0388D62BD5FBC71C
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://pegasusablon.omoriginals.com/
HTTP 301
https://opaodontologia.com/SBPegasusAblon/ HTTP 302
https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752 HTTP 301
https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/ Page URL
- https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/?sslcha... Page URL
Detected technologies
Ruby (Programming Languages) ExpandDetected patterns
- meta csrf-param /^authenticity_token$/i
Ruby on Rails (Web Frameworks) Expand
Detected patterns
- meta csrf-param /^authenticity_token$/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://pegasusablon.omoriginals.com/
HTTP 301
https://opaodontologia.com/SBPegasusAblon/ HTTP 302
https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752 HTTP 301
https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/ Page URL
- https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/?sslchannel=true&sessionid=syA1EUjKEpH7SPrv48oQQWvAXGE7tRPWqpX4jgPXGw5ymw3qEsguoM5mtKuXCjT2JQ727W0Nt6lQCpgh Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://pegasusablon.omoriginals.com/ HTTP 301
- https://opaodontologia.com/SBPegasusAblon/ HTTP 302
- https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752 HTTP 301
- https://opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/ Redirect Chain
|
211 B 268 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/ |
4 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7118777056
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-1123.min.js.t%C3%A9l%C3%A9chargement
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js.t%C3%A9l%C3%A9chargement
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
28 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-c65b39075e2d8157df63.css
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
103 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.png
www.sepusa.com/wp-content/uploads/2018/05/ |
24 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
comodo_secure_seal_100x85_transp.png
auth.mycase.com/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-1123.min.js.t%C3%A9l%C3%A9chargement
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js.t%C3%A9l%C3%A9chargement
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
office365.png
opaodontologia.com/SBPegasusAblon/UKJCIAOSJDJkksdMMS/customer-IDPP00C752/login_sessions/login_source/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online) Microsoft (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
opaodontologia.com/ | Name: PHPSESSID Value: 160d5198976cc908398ae388663a095b |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.mycase.com
opaodontologia.com
pegasusablon.omoriginals.com
www.sepusa.com
108.179.252.34
204.10.38.146
54.173.243.251
64.111.118.105
008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420
0279d4b5715b4504d9f0f479f417612288e601ccea979062350749d54da0c4d5
133f96ceac619d2317cd9e4e3e9f40f30929fb612c170231cb400953d3546602
39e352f10b3f1ee293a316ccc391e26bc8b1bd215d3a04c8e796ee6f4a7635a4
8e3815a7031ef0b847556d6e5696b9d014b6c2ebb42713c2268cca80e49e1cd0
b96774b4e3fcd079ad151707d1c05b52ddddc95660c60cd0bd8fffd0fc4a8d35
c046edf5f7d4d563b701a5c5e3cd215f53167db88c7dab4d601daf039cd7f1df