brhack.net
Open in
urlscan Pro
64.182.45.55
Malicious Activity!
Public Scan
Effective URL: http://brhack.net/office_auto/auth.php?EiMjiB1SGkUQUKVqYSXWvs4mAWbh6i6KAT4Tu6LaqF1kqWKpOHlkaqGLmR2ta9eK2iDwppGP4Ha...
Submission: On July 02 via automatic, source phishtank
Summary
This is the only time brhack.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 191.6.208.63 191.6.208.63 | 28299 (IPV6 Inte...) (IPV6 Internet Ltda) | |
1 6 | 64.182.45.55 64.182.45.55 | 54489 (CORESPACE...) (CORESPACE-DAL) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2606:4700::68... 2606:4700::6810:84e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 152.199.23.37 152.199.23.37 | 15133 (EDGECAST) (EDGECAST) | |
10 | 6 |
ASN28299 (IPV6 Internet Ltda, BR)
PTR: web156.kinghost.net
camararionovo.mg.gov.br |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
brhack.net
1 redirects
brhack.net |
45 KB |
1 |
msftauth.net
aadcdn.msftauth.net |
762 B |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
14 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
7 KB |
1 |
jquery.com
code.jquery.com |
24 KB |
1 |
camararionovo.mg.gov.br
camararionovo.mg.gov.br |
1017 B |
10 | 6 |
Domain | Requested by | |
---|---|---|
6 | brhack.net |
1 redirects
camararionovo.mg.gov.br
brhack.net |
1 | aadcdn.msftauth.net |
brhack.net
|
1 | stackpath.bootstrapcdn.com |
brhack.net
|
1 | cdnjs.cloudflare.com |
brhack.net
|
1 | code.jquery.com |
brhack.net
|
1 | camararionovo.mg.gov.br | |
10 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.live.com |
login.microsoftonline.com |
www.microsoft.com |
privacy.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
camararionovo.mg.gov.br Let's Encrypt Authority X3 |
2020-05-27 - 2020-08-25 |
3 months | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2019-09-14 - 2020-10-13 |
a year | crt.sh |
aadcdn.msftauth.net Microsoft IT TLS CA 5 |
2018-11-07 - 2020-11-07 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://brhack.net/office_auto/auth.php?EiMjiB1SGkUQUKVqYSXWvs4mAWbh6i6KAT4Tu6LaqF1kqWKpOHlkaqGLmR2ta9eK2iDwppGP4HavEVUsDfMOFsz2kCwuLKeN3Sksi1inJsSnoMP21CQH5qKp2gTO08C31WwjXOGGhy4FkUImwy4CYP
Frame ID: E039003E505BA3B503F3DA63656C8370
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://camararionovo.mg.gov.br/wp-content/themes-old/index.html Page URL
-
http://brhack.net/office_auto/index.php
HTTP 302
http://brhack.net/office_auto/auth.php?EiMjiB1SGkUQUKVqYSXWvs4mAWbh6i6KAT4Tu6LaqF1kqWKpOHlkaqG... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Create one!
Search URL Search Domain Scan URL
Title: Can’t access your account?
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://camararionovo.mg.gov.br/wp-content/themes-old/index.html Page URL
-
http://brhack.net/office_auto/index.php
HTTP 302
http://brhack.net/office_auto/auth.php?EiMjiB1SGkUQUKVqYSXWvs4mAWbh6i6KAT4Tu6LaqF1kqWKpOHlkaqGLmR2ta9eK2iDwppGP4HavEVUsDfMOFsz2kCwuLKeN3Sksi1inJsSnoMP21CQH5qKp2gTO08C31WwjXOGGhy4FkUImwy4CYP Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
index.html
camararionovo.mg.gov.br/wp-content/themes-old/ |
902 B 1017 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
auth.php
brhack.net/office_auto/ Redirect Chain
|
11 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
brhack.net/office_auto/css/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jqueryLib.js
brhack.net/office_auto/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ |
49 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
actions.js
brhack.net/office_auto/js/ |
754 B 722 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/ |
2 KB 762 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ms-logo.png
brhack.net/office_auto/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| Popper object| bootstrap string| $c string| $current_email function| decodeCustom function| isValidEmail function| getUrlParameter string| currentEmail object| ListEntries function| extractDomain function| validateEmail function| isValidPassword object| input0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
brhack.net
camararionovo.mg.gov.br
cdnjs.cloudflare.com
code.jquery.com
stackpath.bootstrapcdn.com
152.199.23.37
191.6.208.63
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:2a
2606:4700::6810:84e5
64.182.45.55
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
113e56520c10a5d3291c8e30eb5d4a4fab48cc6325acfb2de15e9bd97b29f3d8
45bb87bb2c895bab40429374796921a72a4c83843f03b05f04d6e283f3267124
75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35
858056de817424d0f5093ffc9b6c75e23a600bc71c0332f6bee1944030c13c70
8d53ac65b4128f50f6a974dbddf96e12508f5a0d90a475be65111643a00ff5a5
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e2eadf4051df7b8fb26a9ce8a6318c4bacf7b3fe59e264e21c9327e88bfc673c