![](/screenshots/f00e42bf-b48d-48ae-8217-6645463bd077.png)
oestemarine.com.br
Open in
urlscan Pro
162.241.36.66
Malicious Activity!
Public Scan
Submission: On May 25 via automatic, source openphish
Summary
This is the only time oestemarine.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 162.241.36.66 162.241.36.66 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
7 | 13.224.95.66 13.224.95.66 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
10 | 4 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-3921427.dinamicasul.com.br
oestemarine.com.br |
ASN16509 (AMAZON-02, US)
PTR: server-13-224-95-66.zrh50.r.cloudfront.net
www.mweb.co.za |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
mweb.co.za
www.mweb.co.za |
64 KB |
1 |
googleapis.com
ajax.googleapis.com |
34 KB |
1 |
oestemarine.com.br
oestemarine.com.br |
13 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
10 | 4 |
Domain | Requested by | |
---|---|---|
7 | www.mweb.co.za |
oestemarine.com.br
www.mweb.co.za |
1 | ajax.googleapis.com |
oestemarine.com.br
|
1 | oestemarine.com.br | |
0 | Failed |
oestemarine.com.br
|
10 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.mweb.co.za |
myaccount.mweb.co.za |
myaccount.ignite.co.za |
www.icode.org.za |
www.iab.net |
ispa.org.za |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.mweb.co.za Amazon |
2021-05-13 - 2022-06-11 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-05-03 - 2021-07-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://oestemarine.com.br/wp-includes/std/templates/mwebportal/MyEmailLogin.htm
Frame ID: 11CB97B7604DC1A8D6B9DB9793DB50B1
Requests: 10 HTTP requests in this frame
12 Outgoing links
These are links going to different origins than the main page.
Title: My Email Login
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: Are you an MWEB customer?
Search URL Search Domain Scan URL
Title: Forgotten Password?
Search URL Search Domain Scan URL
Title: Legal Notices
Search URL Search Domain Scan URL
Title: About Us
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: MWEB Stores
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
MyEmailLogin.htm
oestemarine.com.br/wp-includes/std/templates/mwebportal/ |
12 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css-compulsory-combined.css
www.mweb.co.za/Portals/27/Skins/Foundation5/css/ |
192 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
site.css
www.mweb.co.za/Portals/27/Skins/Foundation5/css/ |
50 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
none.php
{siteurl}/php/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
100.png
www.mweb.co.za/portals/27/skins/foundation5/css/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icode.png
www.mweb.co.za/portals/27/Images/Home/2015/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iab.png
www.mweb.co.za/portals/27/Images/Home/2015/ |
912 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ispa.png
www.mweb.co.za/portals/27/Images/Home/2015/ |
962 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo.png
www.mweb.co.za/Portals/27/Skins/Foundation5/css/images/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery string| siteURL0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
oestemarine.com.br
www.mweb.co.za
13.224.95.66
162.241.36.66
2a00:1450:4001:828::200a
55b7cc92f141ef58793f297b71df95a8b168ebd67fc46fb4b76aa87700649d1c
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6ef59a1b668eb33435b96b8a3e348f7ab3d837becdb7b30f7ac36a06d6da2b26
76fe6b3e689e9eae484b8a75d5408eed23cbbcb6b3f414e8ebfab826e128f23c
7cb84b40ab3a180e996b273a45ae4ea8dc20d89ca615a9e4d2c8a7decc702885
a743398628da31cfb9d020ab9d9280632b139d69eb1b6cf56cfdc36ca504ae88
af57e894c878a60dd459e64f88a9cf27752cbad2b341d06cf8afb6548c1e2bdd
e6c0227b26bffe1d3ca83c9aba627d551351c33cd4085a05aea774b2279028ab
ff3281a0ea76b6957926ff5a565d54a0f5c321899b608983b3b0c546fdd27c2e