pizzariabonamassa.com.br Open in urlscan Pro
192.99.8.151 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://go2l.ink/1y8W
Effective URL:
https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Submission: On June 11 via manual (June 11th 2019, 6:44:18 pm UTC) from US

Summary HTTP 29 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 29 HTTP transactions. The main IP is 192.99.8.151, located in Montreal, Canada and belongs to OVH, FR. The main domain is pizzariabonamassa.com.br.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 22nd 2019. Valid for: 3 months.

This is the only time pizzariabonamassa.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: US Universities (Education) University of Iowa (Education)

Domain & IP information

	IP Address	AS Autonomous System
1 1	184.168.131.241 184.168.131.241	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
8	192.99.8.151 192.99.8.151	16276 (OVH) (OVH)
2	209.197.3.7 209.197.3.7	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
2	2a00:1450:400... 2a00:1450:4001:818::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:81f::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
29	6

1 184.168.131.241 (Scottsdale, United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net

go2l.ink	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 192.99.8.151 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: puma.br-rgt.net

pizzariabonamassa.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.197.3.7 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x007.map2.ssl.hwcdn.net

e2b8u3v8.map2.ssl.hwcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	pizzariabonamassa.com.br pizzariabonamassa.com.br	334 KB
3	google-analytics.com ssl.google-analytics.com www.google-analytics.com	35 KB
2	googleapis.com ajax.googleapis.com	31 KB
2	hwcdn.net e2b8u3v8.map2.ssl.hwcdn.net	32 KB
1	go2l.ink 1 redirects go2l.ink	251 B
0	Failed function sub() { [native code] }. Failed
29	6

	Domain	Requested by
8	pizzariabonamassa.com.br	pizzariabonamassa.com.br
2	ajax.googleapis.com	pizzariabonamassa.com.br
2	ssl.google-analytics.com	pizzariabonamassa.com.br
2	e2b8u3v8.map2.ssl.hwcdn.net	pizzariabonamassa.com.br
1	www.google-analytics.com	e2b8u3v8.map2.ssl.hwcdn.net
1	go2l.ink	1 redirects
0	cipmepknanmbbaneimacddfemfbfgpgo Failed	pizzariabonamassa.com.br
29	7

This site contains links to these domains. Also see Links.

Domain
apps.its.uiowa.edu
myui.uiowa.edu

Subject Issuer	Validity	Valid
pizzariabonamassa.com.br cPanel, Inc. Certification Authority	`2019-04-22` - `2019-07-21`	3 months	crt.sh
*.map2.ssl.hwcdn.net COMODO RSA Domain Validation Secure Server CA	`2018-04-10` - `2020-04-09`	2 years	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-05-21` - `2019-08-13`	3 months	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-05-21` - `2019-08-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Frame ID: D21C9F8608CFC0EA2D59AEC65BD9549D
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://go2l.ink/1y8W HTTP 302
https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

29
Requests

52 %
HTTPS

50 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

432 kB
Transfer

582 kB
Size

2
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://apps.its.uiowa.edu/pwtool/reset
Title: Forgot your HawkID password?

Search URL Search Domain Scan URL

URL: https://myui.uiowa.edu/my-ui/guest-login.page
Title: Click here for the guest login page

Search URL Search Domain Scan URL

URL: https://myui.uiowa.edu/my-ui/courses/dashboard.page
Title: Courses

Search URL Search Domain Scan URL

URL: https://myui.uiowa.edu/my-ui/help/dashboard.page
Title: Help

Search URL Search Domain Scan URL

URL: https://myui.uiowa.edu/my-ui/home.page
Title: News & Information

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://go2l.ink/1y8W HTTP 302
https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request HawkID.php Show response
pizzariabonamassa.com.br/wp-content/themes/com/uiowa/
Redirect Chain

http://go2l.ink/1y8W
https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php

14 KB
15 KB

565ms
209ms

Document
text/html

192.99.8.151
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.99.8.151 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: puma.br-rgt.net
Software: Apache / PHP/5.6.40
Resource Hash: e73ec758c4da39298816c8e87058029d84beb14bd29d502d4f72af110f869bd7

Request headers

:method: GET
:authority: pizzariabonamassa.com.br
:scheme: https
:path: /wp-content/themes/com/uiowa/HawkID.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 11 Jun 2019 18:43:56 GMT
server: Apache
x-powered-by: PHP/5.6.40
content-type: text/html; charset=UTF-8

Redirect headers

Server: nginx/1.12.2
Date: Tue, 11 Jun 2019 18:43:55 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Location: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php

GET
H2 200 bootstrap.min.css
pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/ 97 KB
98 KB 123ms
111ms Stylesheet
text/css 192.99.8.151
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/bootstrap.min.css
Requested by: Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.99.8.151 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: puma.br-rgt.net
Software: Apache /
Resource Hash: 46a2de362f54e3c988cc8c9fbf68fe12018c8ae42fe11509a747f52f17834466

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 11 Jun 2019 18:43:57 GMT
last-modified: Thu, 01 Mar 2018 00:46:04 GMT
server: Apache
accept-ranges: bytes
content-length: 99548
content-type: text/css

GET
H2 200 simple-login.css
pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/ 3 KB
3 KB 120ms
108ms Stylesheet
text/css 192.99.8.151
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/simple-login.css
Requested by: Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.99.8.151 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: puma.br-rgt.net
Software: Apache /
Resource Hash: 23436568dc11cdeaa51ac4bcaf83529fb196d8fd5e9e1e423b5d7c808adf0556

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 11 Jun 2019 18:43:57 GMT
last-modified: Thu, 01 Mar 2018 00:46:04 GMT
server: Apache
accept-ranges: bytes
content-length: 2847
content-type: text/css

GET
H2 200 ga.js.download Show response
pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/ 45 KB
46 KB 323ms
311ms Script
application/javascript 192.99.8.151
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/ga.js.download
Requested by: Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.99.8.151 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: puma.br-rgt.net
Software: Apache /
Resource Hash: 7c2c58fc24e2d3458b88680cfad4577011697df9a1406808f2f7d8f46060d8a7

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 11 Jun 2019 18:43:57 GMT
last-modified: Thu, 01 Mar 2018 00:46:04 GMT
server: Apache
accept-ranges: bytes
content-length: 46275
content-type: application/javascript

GET
H2 200 fb9e66ea-4707-4278-8469-574fc4263123.js.download Show response
pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/ 35 KB
35 KB 320ms
310ms Script
application/javascript 192.99.8.151
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/fb9e66ea-4707-4278-8469-574fc4263123.js.download
Requested by: Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.99.8.151 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: puma.br-rgt.net
Software: Apache /
Resource Hash: aa99efb299ea82cf5f741a65d1949694a2a6353c7ebc7a8a54b52857061a56f0

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 11 Jun 2019 18:43:57 GMT
last-modified: Thu, 01 Mar 2018 00:46:04 GMT
server: Apache
accept-ranges: bytes
content-length: 35791
content-type: application/javascript

GET
H2 200 jquery.min.js.download Show response
pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/ 84 KB
84 KB 318ms
310ms Script
application/javascript 192.99.8.151
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/jquery.min.js.download
Requested by: Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.99.8.151 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: puma.br-rgt.net
Software: Apache /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 11 Jun 2019 18:43:57 GMT
last-modified: Thu, 01 Mar 2018 00:46:04 GMT
server: Apache
accept-ranges: bytes
content-length: 85578
content-type: application/javascript

GET
H2 200 jz6rmF.js.download Show response
pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/ 35 KB
35 KB 207ms
147ms Script
application/javascript 192.99.8.151
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/jz6rmF.js.download
Requested by: Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.99.8.151 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: puma.br-rgt.net
Software: Apache /
Resource Hash: 476981d3a31a5348ff22f410c2c65ef9960c2cff9f9fa64f5749d05aa4e597b4

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 11 Jun 2019 18:43:57 GMT
last-modified: Thu, 01 Mar 2018 00:46:04 GMT
server: Apache
accept-ranges: bytes
content-length: 35688
content-type: application/javascript

GET
H2 200 uiowa-dome.png
pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/ 18 KB
19 KB 209ms
150ms Image
image/png 192.99.8.151
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/uiowa-dome.png
Requested by: Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.99.8.151 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: puma.br-rgt.net
Software: Apache /
Resource Hash: 5790171db3ebcf4215667322c8fda796f3157b872b53d45bf153cca7aa1d75bc

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 11 Jun 2019 18:43:57 GMT
last-modified: Thu, 01 Mar 2018 00:46:04 GMT
server: Apache
accept-ranges: bytes
content-length: 18909
content-type: image/png

GET web-search-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET video-search-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET google-images-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET google-translate-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET wikipedia-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET btn_settings.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/ 0
0

GET facebook-share-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET twitter-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET pinterest-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET google-plus-center-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET linkedin-content.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/ 0
0

GET
H/1.1 200
OK fb9e66ea-4707-4278-8469-574fc4263123.js Show response
e2b8u3v8.map2.ssl.hwcdn.net/s/ 42 KB
18 KB 5219ms
126ms Script
text/javascript 209.197.3.7
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://e2b8u3v8.map2.ssl.hwcdn.net/s/fb9e66ea-4707-4278-8469-574fc4263123.js?cb=19503
Requested by: Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.7 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x007.map2.ssl.hwcdn.net
Software: /
Resource Hash: c08989f30ee0addd928665834b3a7a79d8d17e5fc1b9c83e38cbe918cd04b83c

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 18:44:02 GMT
Content-Encoding: gzip
X-HW: 1560278641.dop005.fr8.t,1560278642.cds069.fr8.shn,1560278642.dop005.fr8.t,1560278642.cds021.fr8.c
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=11000
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 18334

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 134ms
6ms Script
text/javascript 2a00:1450:4001:818::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 21 May 2019 23:53:44 GMT
server: Golfe2
age: 1767
date: Tue, 11 Jun 2019 18:14:30 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17168
expires: Tue, 11 Jun 2019 20:14:30 GMT

GET dropToShareHint.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/ 0
0

GET dropToSearchHint.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/ 0
0

GET btn_settings.png
cipmepknanmbbaneimacddfemfbfgpgo/images/content/ 0
0

GET
H2 404 openxtag.js Show response
ajax.googleapis.com/ajax/libs/ 2 KB
2 KB 69ms
45ms XHR
text/html 2a00:1450:4001:81f::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/openxtag.js

Requested by

Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/fb9e66ea-4707-4278-8469-574fc4263123.js.download

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

24e59526b5fc9816d6e16a670bf9603b1c01ecff1b432926cc3cd72eefaf502c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
Origin: https://pizzariabonamassa.com.br

Response headers

date: Tue, 11 Jun 2019 18:43:57 GMT
x-content-type-options: nosniff
server: sffe
status: 404
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 1582
x-xss-protection: 0

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
199 B 13ms
12ms Image
image/gif 2a00:1450:4001:818::2008
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.1&utms=1&utmn=1925223477&utmhn=pizzariabonamassa.com.br&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=HawkID%20Login%20for%20myUI&utmhid=2026293227&utmr=-&utmp=%2Fwp-content%2Fthemes%2Fcom%2Fuiowa%2FHawkID.php&utmht=1560278637390&utmac=UA-21427431-1&utmcc=__utma%3D123778187.1218152607.1560278637.1560278637.1560278637.1%3B%2B__utmz%3D123778187.1560278637.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=285388882&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jun 2019 18:43:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
29 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81f::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/fb9e66ea-4707-4278-8469-574fc4263123.js.download

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 03 Jun 2019 19:13:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 689437
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Jun 2020 19:13:20 GMT

GET
H/1.1 200
OK jz6rmF.js Show response
e2b8u3v8.map2.ssl.hwcdn.net/k/709010/12c/ 35 KB
14 KB 4839ms
32ms Script
text/javascript 209.197.3.7
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://e2b8u3v8.map2.ssl.hwcdn.net/k/709010/12c/jz6rmF.js
Requested by: Host: pizzariabonamassa.com.br
URL: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID_files/fb9e66ea-4707-4278-8469-574fc4263123.js.download
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.7 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x007.map2.ssl.hwcdn.net
Software: /
Resource Hash: 97f454e8dd422e2597ec098c1dfd5f13fc9fa19fa7467110e6ca66e34a56b0b1

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 18:44:02 GMT
Content-Encoding: gzip
X-HW: 1560278641.dop005.fr8.t,1560278642.cds069.fr8.shn,1560278642.dop005.fr8.t,1560278642.cds055.fr8.c
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=333300
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 13720

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81a::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: e2b8u3v8.map2.ssl.hwcdn.net
URL: https://e2b8u3v8.map2.ssl.hwcdn.net/s/fb9e66ea-4707-4278-8469-574fc4263123.js?cb=19503

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8f88cb7a1cd4134f5d616b9fca90b9069fa16c162b7ae66ba1b500c490b41dd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pizzariabonamassa.com.br/wp-content/themes/com/uiowa/HawkID.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 21 May 2019 23:53:44 GMT
server: Golfe2
age: 7015
date: Tue, 11 Jun 2019 16:47:07 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17595
expires: Tue, 11 Jun 2019 18:47:07 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/web-search-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/video-search-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/google-images-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/google-translate-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/wikipedia-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/btn_settings.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/facebook-share-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/twitter-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/pinterest-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/google-plus-center-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/providers/linkedin-content.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/dropToShareHint.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/dropToSearchHint.png

Domain: cipmepknanmbbaneimacddfemfbfgpgo
URL: chrome-extension://cipmepknanmbbaneimacddfemfbfgpgo/images/content/btn_settings.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Universities (Education) University of Iowa (Education)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.pizzariabonamassa.com.br/	1970-01-19 01:26:05	Name: _gid Value: GA1.3.147151971.1560278642
			.pizzariabonamassa.com.br/	1970-01-19 18:55:50	Name: _ga Value: GA1.3.79243040.1560278642

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cipmepknanmbbaneimacddfemfbfgpgo
e2b8u3v8.map2.ssl.hwcdn.net
go2l.ink
pizzariabonamassa.com.br
ssl.google-analytics.com
www.google-analytics.com
cipmepknanmbbaneimacddfemfbfgpgo
184.168.131.241
192.99.8.151
209.197.3.7
2a00:1450:4001:818::2008
2a00:1450:4001:81a::200e
2a00:1450:4001:81f::200a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
23436568dc11cdeaa51ac4bcaf83529fb196d8fd5e9e1e423b5d7c808adf0556
24e59526b5fc9816d6e16a670bf9603b1c01ecff1b432926cc3cd72eefaf502c
46a2de362f54e3c988cc8c9fbf68fe12018c8ae42fe11509a747f52f17834466
476981d3a31a5348ff22f410c2c65ef9960c2cff9f9fa64f5749d05aa4e597b4
5790171db3ebcf4215667322c8fda796f3157b872b53d45bf153cca7aa1d75bc
7c2c58fc24e2d3458b88680cfad4577011697df9a1406808f2f7d8f46060d8a7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8f88cb7a1cd4134f5d616b9fca90b9069fa16c162b7ae66ba1b500c490b41dd2
97f454e8dd422e2597ec098c1dfd5f13fc9fa19fa7467110e6ca66e34a56b0b1
aa99efb299ea82cf5f741a65d1949694a2a6353c7ebc7a8a54b52857061a56f0
c08989f30ee0addd928665834b3a7a79d8d17e5fc1b9c83e38cbe918cd04b83c
e73ec758c4da39298816c8e87058029d84beb14bd29d502d4f72af110f869bd7

pizzariabonamassa.com.br Open in urlscan Pro 192.99.8.151 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

29 Requests

52 %HTTPS

50 %IPv6

6 Domains

7 Subdomains

6 IPs

3 Countries

432 kBTransfer

582 kBSize

2 Cookies

5 Outgoing links

Page URL History

Redirected requests

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

2 Cookies

Indicators

pizzariabonamassa.com.br Open in urlscan Pro
192.99.8.151 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

29
Requests

52 %
HTTPS

50 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

432 kB
Transfer

582 kB
Size

2
Cookies

29 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!