corra-s0mente-h0je.com

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 40.84.211.232, located in San Antonio, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is corra-s0mente-h0je.com.
TLS certificate: Issued by R3 on January 16th 2021. Valid for: 3 months.

This is the only time corra-s0mente-h0je.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	40.84.211.232 40.84.211.232	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
2	2

1 40.84.211.232 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

corra-s0mente-h0je.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	youtube.com www.youtube.com
1	corra-s0mente-h0je.com corra-s0mente-h0je.com	1 KB
2	2

	Domain	Requested by
1	www.youtube.com	corra-s0mente-h0je.com
1	corra-s0mente-h0je.com
2	2

This site contains links to these domains. Also see Links.

Domain
www.americanas.com.br

Subject Issuer	Validity	Valid
corra-s0mente-h0je.com R3	`2021-01-16` - `2021-04-16`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://corra-s0mente-h0je.com/ofertas.php
Frame ID: D3E1F31412F99CE7F0A980F9FA4FB8A0
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/TGau_hhmDC4?controls=0
Frame ID: 68E02F047E4A5F30DB58FA7D206AE8EB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

YouTube (Video Players) Expand

Overall confidence: 100%
Detected patterns

html /<(?:param|embed|iframe)[^>]+youtube(?:-nocookie)?\.com\/(?:v|embed)/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

Page Statistics

2
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1 kB
Transfer

3 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.americanas.com.br/especial/oferta-do-dia
Title: Mais ofertas

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request ofertas.php Show response
corra-s0mente-h0je.com/ 3 KB
1 KB 423ms
136ms Document
text/html 40.84.211.232
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://corra-s0mente-h0je.com/ofertas.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.84.211.232 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx / PHP/7.4.14 PleskLin
Resource Hash: ea009604afdea2fdd011bd9bcb8d2a6a259dabb5e96f027af9a84b5284f0e5f0

Request headers

:method: GET
:authority: corra-s0mente-h0je.com
:scheme: https
:path: /ofertas.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server: nginx
date: Fri, 29 Jan 2021 14:30:29 GMT
content-type: text/html; charset=UTF-8
content-length: 1286
x-powered-by: PHP/7.4.14 PleskLin
vary: Accept-Encoding
content-encoding: gzip

GET
H2 200 TGau_hhmDC4
www.youtube.com/embed/ Frame 68E0 0
0 125ms
105ms Document
text/html 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/TGau_hhmDC4?controls=0

Requested by

Host: corra-s0mente-h0je.com
URL: https://corra-s0mente-h0je.com/ofertas.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/TGau_hhmDC4?controls=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://corra-s0mente-h0je.com/ofertas.php
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://corra-s0mente-h0je.com/ofertas.php

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache
content-length: 21927
expires: Tue, 27 Apr 1971 19:44:06 GMT
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
strict-transport-security: max-age=31536000
content-encoding: br
date: Fri, 29 Jan 2021 14:30:30 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: VISITOR_INFO1_LIVE=RMnUfn0AVq0; path=/; domain=.youtube.com; secure; expires=Wed, 28-Jul-2021 14:30:29 GMT; httponly; samesite=None YSC=b_qjvq26T1k; path=/; domain=.youtube.com; secure; httponly; samesite=None GPS=1; path=/; domain=.youtube.com; expires=Fri, 29-Jan-2021 15:00:29 GMT VISITOR_INFO1_LIVE=RMnUfn0AVq0; path=/; domain=.youtube.com; secure; expires=Wed, 28-Jul-2021 14:30:29 GMT; httponly; samesite=None CONSENT=PENDING+315; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: b_qjvq26T1k
			.youtube.com/	1970-01-19 20:04:42	Name: VISITOR_INFO1_LIVE Value: RMnUfn0AVq0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

corra-s0mente-h0je.com
www.youtube.com
2a00:1450:4001:813::200e
40.84.211.232
ea009604afdea2fdd011bd9bcb8d2a6a259dabb5e96f027af9a84b5284f0e5f0

corra-s0mente-h0je.com Open in urlscan Pro 40.84.211.232 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

2 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

1 kBTransfer

3 kBSize

2 Cookies

1 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

2 Cookies

Indicators

corra-s0mente-h0je.com Open in urlscan Pro
40.84.211.232 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1 kB
Transfer

3 kB
Size

2
Cookies

2 HTTP transactions
0 data transactions