158.197.95.34.bc.googleusercontent.com Open in urlscan Pro
34.95.197.158 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save3.php
Effective URL:
https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll
Submission Tags: @ipnigh
Submission: On February 20 via api (February 20th 2020, 12:51:10 am UTC) from GB

Summary HTTP 12 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 34.95.197.158, located in United States and belongs to GOOGLE, US. The main domain is 158.197.95.34.bc.googleusercontent.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 30th 2020. Valid for: 3 months.

This is the only time 158.197.95.34.bc.googleusercontent.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 12	34.95.197.158 34.95.197.158		15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2b		20446 (HIGHWINDS3) (HIGHWINDS3)
12	2

12 34.95.197.158 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 158.197.95.34.bc.googleusercontent.com

158.197.95.34.bc.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	googleusercontent.com 1 redirects 158.197.95.34.bc.googleusercontent.com	263 KB
1	jquery.com code.jquery.com	33 KB
12	2

	Domain	Requested by
12	158.197.95.34.bc.googleusercontent.com	1 redirects 158.197.95.34.bc.googleusercontent.com
1	code.jquery.com	158.197.95.34.bc.googleusercontent.com
12	2

This site contains no links.

Subject Issuer	Validity	Valid
prefeitura.municipal.tributos.iptu2020.rcshpg.com.br Let's Encrypt Authority X3	`2020-01-30` - `2020-04-29`	3 months	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll
Frame ID: 74F2A312BFE5480E0B4CBF16954188B2
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save3.php HTTP 302
https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

12
Requests

8 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

296 kB
Transfer

683 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save3.php HTTP 302
https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request router_info.php Show response 158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/ Redirect Chain https://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save3.php https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll	7 KB 2 KB	227ms 227ms	Document text/html	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `bb1f2fdc6dbcddafea5d0f05b9805b911212003b69fbd22572f42d82f74409bc` Request headers Host 158.197.95.34.bc.googleusercontent.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie PHPSESSID=j5mnr1h9t9i610t97f55lg7ec5 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers Date Thu, 20 Feb 2020 00:50:53 GMT Server Apache/2.4.18 (Ubuntu) Vary Accept-Encoding Content-Encoding gzip Content-Length 1729 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Thu, 20 Feb 2020 00:50:53 GMT Server Apache/2.4.18 (Ubuntu) Set-Cookie PHPSESSID=j5mnr1h9t9i610t97f55lg7ec5; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Location ../../../router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bootstrap.css 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/	196 KB 22 KB	234ms 234ms	Stylesheet text/css	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/bootstrap.css Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `9d7e36f365c1da17289b26706a8f996d1713ee5fd647f7be43fdcbd60f464d39` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Thu, 20 Feb 2020 00:50:53 GMT Content-Encoding gzip Last-Modified Tue, 25 Jul 2017 02:11:12 GMT Server Apache/2.4.18 (Ubuntu) ETag "31161-5551ad86bb000-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 22631
GET H/1.1	200 OK	_home.css 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/	10 KB 2 KB	668ms 227ms	Stylesheet text/css	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/_home.css Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `450f0a54063643428ac021b8b70c0f1180dce15e46e87c73b48bf77151bf4bd5` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Thu, 20 Feb 2020 00:50:54 GMT Content-Encoding gzip Last-Modified Fri, 17 May 2019 18:03:36 GMT Server Apache/2.4.18 (Ubuntu) ETag "26b5-589193392ce00-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 2083
GET H/1.1	200 OK	jquery-1.12.0.min.js Show response code.jquery.com/	95 KB 33 KB	29ms 6ms	Script application/javascript	2001:4de0:ac19::1:b:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.12.0.min.js Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Thu, 20 Feb 2020 00:50:53 GMT Content-Encoding gzip Last-Modified Fri, 08 Jan 2016 19:57:42 GMT Server nginx ETag W/"569014b6-17c52" Vary Accept-Encoding X-HW 1582159853.dop052.fr8.t,1582159853.cds041.fr8.shn,1582159853.cds041.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 33820
GET H/1.1	200 OK	logo2.png 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/	41 KB 41 KB	683ms 227ms	Image image/png	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/logo2.png Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `bad8117c7b23f326216e85e630e3915ea1c73387a7b7d2da61e800e96fc8b8c6` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Thu, 20 Feb 2020 00:50:54 GMT Last-Modified Wed, 16 May 2018 10:33:22 GMT Server Apache/2.4.18 (Ubuntu) ETag "a45e-56c503f7ea080" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 42078
GET H/1.1	200 OK	30horas.png 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/	3 KB 3 KB	683ms 227ms	Image image/png	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/30horas.png Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `30bdac7863e281c4a40fd3486434041fafa2fa73ecc77c8efb6ea785bd2a0ba9` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Thu, 20 Feb 2020 00:50:54 GMT Last-Modified Tue, 18 Dec 2018 01:36:34 GMT Server Apache/2.4.18 (Ubuntu) ETag "c60-57d41ed788c80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3168
GET H/1.1	200 OK	empresa.png 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/	4 KB 4 KB	684ms 227ms	Image image/png	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/empresa.png Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `305548fd47969838632e728513aeaa10fa877cdc2760440163f8f0a0b001c179` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Thu, 20 Feb 2020 00:50:54 GMT Last-Modified Tue, 18 Dec 2018 01:25:52 GMT Server Apache/2.4.18 (Ubuntu) ETag "eb0-57d41c7346800" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3760
GET H/1.1	200 OK	lateral.png 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/	138 KB 138 KB	684ms 227ms	Image image/png	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/lateral.png Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `67c7b905c66f2ac1e85fbc19f7993a3d33c593dfe0ef6464b89d25a585448945` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Thu, 20 Feb 2020 00:50:54 GMT Last-Modified Thu, 16 May 2019 18:29:56 GMT Server Apache/2.4.18 (Ubuntu) ETag "22878-5890573e85100" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 141432
GET H/1.1	200 OK	jquery-3.2.1.min.js Show response 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_js/	85 KB 30 KB	246ms 231ms	Script application/javascript	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_js/jquery-3.2.1.min.js Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 20 Feb 2020 00:50:54 GMT Content-Encoding gzip Last-Modified Fri, 26 May 2017 18:09:24 GMT Server Apache/2.4.18 (Ubuntu) ETag "15287-550713cbb7d00-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 30147
GET H/1.1	200 OK	bootstrap.js Show response 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_js/	101 KB 17 KB	231ms 230ms	Script application/javascript	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_js/bootstrap.js Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `60ce45567bcc08ff5ff0d9b123c90f18ae864873fb7abc103d22a29843b80072` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 20 Feb 2020 00:50:54 GMT Content-Encoding gzip Last-Modified Fri, 26 May 2017 18:09:26 GMT Server Apache/2.4.18 (Ubuntu) ETag "19378-550713cda0180-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 16911
GET H/1.1	200 OK	padrao_mk.js Show response 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_js/	2 KB 1 KB	229ms 229ms	Script application/javascript	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_js/padrao_mk.js Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `1441dd1b788acd480830a9ed0611e7169cdc4d571c8e30c167bc04bcb3cd7b15` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 20 Feb 2020 00:50:54 GMT Content-Encoding gzip Last-Modified Tue, 14 May 2019 17:11:00 GMT Server Apache/2.4.18 (Ubuntu) ETag "796-588dc1deff100-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 797
GET H/1.1	200 OK	cpf.js Show response 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_js/	1 KB 812 B	229ms 228ms	Script application/javascript	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_js/cpf.js Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `85f46d81230d9bc5910abbede107330a4c7039a59448d756b6d916e4eb87bbaf` Request headers Referer https://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_info.php?secury=21,50,53,PM,49,2,02,000000,19,9,2020,Wednesday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 20 Feb 2020 00:50:54 GMT Content-Encoding gzip Last-Modified Fri, 09 Nov 2018 20:01:56 GMT Server Apache/2.4.18 (Ubuntu) ETag "421-57a40d2c25500-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 463

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| Cod function| SetNovo function| $ function| jQuery boolean| cpfOK function| mascaraMike function| pulacampo function| SomenteNumero function| checkCPF function| ucfirst

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			158.197.95.34.bc.googleusercontent.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: j5mnr1h9t9i610t97f55lg7ec5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

158.197.95.34.bc.googleusercontent.com
code.jquery.com
2001:4de0:ac19::1:b:2b
34.95.197.158
1441dd1b788acd480830a9ed0611e7169cdc4d571c8e30c167bc04bcb3cd7b15
305548fd47969838632e728513aeaa10fa877cdc2760440163f8f0a0b001c179
30bdac7863e281c4a40fd3486434041fafa2fa73ecc77c8efb6ea785bd2a0ba9
450f0a54063643428ac021b8b70c0f1180dce15e46e87c73b48bf77151bf4bd5
5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf
60ce45567bcc08ff5ff0d9b123c90f18ae864873fb7abc103d22a29843b80072
67c7b905c66f2ac1e85fbc19f7993a3d33c593dfe0ef6464b89d25a585448945
75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35
85f46d81230d9bc5910abbede107330a4c7039a59448d756b6d916e4eb87bbaf
9d7e36f365c1da17289b26706a8f996d1713ee5fd647f7be43fdcbd60f464d39
bad8117c7b23f326216e85e630e3915ea1c73387a7b7d2da61e800e96fc8b8c6
bb1f2fdc6dbcddafea5d0f05b9805b911212003b69fbd22572f42d82f74409bc