URL: http://raifix.com.br/365/index.php
Submission: On July 09 via automatic, source phishtank

Summary

This website contacted 5 IPs in 5 countries across 4 domains to perform 12 HTTP transactions. The main IP is 187.63.160.86, located in Brazil and belongs to BITCOM PROVEDOR DE SERVICOS DE INTERNET LTDA, BR. The main domain is raifix.com.br.
This is the only time raifix.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

IP Address AS Autonomous System
1 187.63.160.86 28169 (BITCOM PR...)
7 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 104.41.216.16 8075 (MICROSOFT...)
1 1 2a01:111:f100... 8075 (MICROSOFT...)
1 2620:1ec:a92:... 8068 (MICROSOFT...)
12 5
Domain Requested by
9 secure.aadcdn.microsoftonline-p.com raifix.com.br
1 portal.office.com secure.aadcdn.microsoftonline-p.com
1 portal.microsoftonline.com 1 redirects
1 login.microsoftonline.com secure.aadcdn.microsoftonline-p.com
1 raifix.com.br
12 5
Subject Issuer Validity Valid
portal.office.com
Microsoft IT TLS CA 5
2017-09-20 -
2019-09-20
2 years crt.sh

This page contains 2 frames:

Primary Page: http://raifix.com.br/365/index.php
Frame ID: 624011F84B34E0F1ECE1E1171C3266EE
Requests: 11 HTTP requests in this frame

Frame: https://portal.office.com/Prefetch/Prefetch.aspx
Frame ID: D71314D92BA10624DF868732CD5B1206
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 50%
Detected patterns
  • env /^head$/i

Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

12
Requests

8 %
HTTPS

67 %
IPv6

4
Domains

5
Subdomains

5
IPs

5
Countries

337 kB
Transfer

550 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10
  • https://portal.microsoftonline.com/Prefetch/Prefetch.aspx HTTP 302
  • https://portal.office.com/Prefetch/Prefetch.aspx

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.php
raifix.com.br/365/
42 KB
42 KB
Document
General
Full URL
http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
187.63.160.86 , Brazil, ASN28169 (BITCOM PROVEDOR DE SERVICOS DE INTERNET LTDA, BR),
Reverse DNS
plsk-lnx-09.visao.psi.br
Software
nginx / PHP/5.4.16 PleskLin
Resource Hash
8e4b00e760111a33d523a954eccff90bf6c5d05ef817e67a6e13ccfbdfbf2021

Request headers

Host
raifix.com.br
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
624011F84B34E0F1ECE1E1171C3266EE

Response headers

Server
nginx
Date
Mon, 09 Jul 2018 04:37:43 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.4.16 PleskLin
login.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/
21 KB
5 KB
Stylesheet
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/login.min.css
Requested by
Host: raifix.com.br
URL: http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
b5ea0ffbe39f577651336a1aba7746881cf235b9f7ccc1c51b151162b3da4feb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://raifix.com.br/365/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 09 Jul 2018 04:37:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 20 Apr 2017 14:49:53 GMT
Content-MD5
B1nWOiVU+79RwbDKdQI8AQ==
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=604800
Strict-Transport-Security
max-age=31536000
Content-Length
4718
jquery.1.11.min.js
secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/
108 KB
38 KB
Script
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/jquery.1.11.min.js
Requested by
Host: raifix.com.br
URL: http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
1ef58f0d9bf24f284e32dab61049b9dc600e2380a880452ddc1d858e986f3574
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://raifix.com.br/365/index.php
Origin
http://raifix.com.br

Response headers

Date
Mon, 09 Jul 2018 04:37:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 20 Apr 2017 14:49:52 GMT
Content-MD5
7WNAwjfHkmgF3Msi7oO6bQ==
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=604800
Strict-Transport-Security
max-age=31536000
Content-Length
38476
aad.login.min.js
secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/
173 KB
42 KB
Script
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/aad.login.min.js
Requested by
Host: raifix.com.br
URL: http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
47b9dd327a73e9fc499898f78153fee7ca31de7a192dbf26664ce28ea8a3e717
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://raifix.com.br/365/index.php
Origin
http://raifix.com.br

Response headers

Date
Mon, 09 Jul 2018 04:37:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 20 Apr 2017 14:49:15 GMT
Content-MD5
Z6kirrwkNGZ7TLrgO1K9NQ==
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=604800
Strict-Transport-Security
max-age=31536000
Content-Length
42794
microsoft_logo.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/images/
1 KB
1 KB
Image
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/images/microsoft_logo.png
Requested by
Host: raifix.com.br
URL: http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://raifix.com.br/365/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 09 Jul 2018 04:37:44 GMT
Last-Modified
Thu, 20 Apr 2017 14:51:25 GMT
Content-MD5
5LZ1AH3GSS7lkBMdH337sw==
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=604800
Connection
keep-alive
Content-Length
1040
login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/
89 B
454 B
Stylesheet
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/login_hover.min.css
Requested by
Host: raifix.com.br
URL: http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://raifix.com.br/365/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 09 Jul 2018 04:37:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 20 Apr 2017 14:49:55 GMT
Content-MD5
k+LdzPr5J17LuCAOBMVTBQ==
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=604800
Strict-Transport-Security
max-age=31536000
Content-Length
82
bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/
4 KB
5 KB
Image
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/bannerlogo?ts=635974776182591704
Requested by
Host: raifix.com.br
URL: http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
2a02:26f0:6c00:2bf::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://raifix.com.br/365/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 09 Jul 2018 04:37:44 GMT
Last-Modified
Mon, 09 Jul 2018 04:20:31 GMT
Content-MD5
nwmifU9ps1V8dDNXSinXJg==
Strict-Transport-Security
max-age=31536000
Content-Type
image\jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86364
Connection
keep-alive
Content-Length
4585
heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/
199 KB
199 KB
Image
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/heroillustration?ts=635974776187911809
Requested by
Host: raifix.com.br
URL: http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
2a02:26f0:6c00:2bf::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://raifix.com.br/365/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 09 Jul 2018 04:37:44 GMT
Last-Modified
Mon, 09 Jul 2018 04:20:31 GMT
Content-MD5
ZSg7Ej6yNeYXaumMAqxbHA==
Strict-Transport-Security
max-age=31536000
Content-Type
image\jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86368
Connection
keep-alive
Content-Length
203294
work_account.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/images/
1 KB
2 KB
Image
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/images/work_account.png
Requested by
Host: raifix.com.br
URL: http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
9fc929be7892b2f4498627d22bc1b3990dc380efcfe40fe6c3cac2dea7565c8e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://raifix.com.br/365/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 09 Jul 2018 04:37:44 GMT
Last-Modified
Thu, 20 Apr 2017 14:51:36 GMT
Content-MD5
GWPGsZJrdzmG9T+ETOTDLg==
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=604800
Connection
keep-alive
Content-Length
1487
use_another_account.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/images/
756 B
1 KB
Image
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/images/use_another_account.png
Requested by
Host: raifix.com.br
URL: http://raifix.com.br/365/index.php
Protocol
HTTP/1.1
Server
2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
a0ecb34d7d42843a8d2b9a65886984f8e50936461b15aede60ba6e97e781ea6c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://raifix.com.br/365/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 09 Jul 2018 04:37:44 GMT
Last-Modified
Thu, 20 Apr 2017 14:51:34 GMT
Content-MD5
kPzjxgRIU0Xx7Ptx4ULddw==
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=604800
Connection
keep-alive
Content-Length
756
reportpageload
login.microsoftonline.com/common/instrumentation/
0
964 B
XHR
General
Full URL
https://login.microsoftonline.com/common/instrumentation/reportpageload
Requested by
Host: secure.aadcdn.microsoftonline-p.com
URL: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/jquery.1.11.min.js
Protocol
HTTP/1.1
Server
104.41.216.16 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
http://raifix.com.br
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers
canary,client-request-id,content-type,hpgact,hpgid

Response headers

Cache-Control
private
Content-Type
application/json; charset=utf-8
Prefetch.aspx
portal.office.com/Prefetch/ Frame D713
Redirect Chain
  • https://portal.microsoftonline.com/Prefetch/Prefetch.aspx
  • https://portal.office.com/Prefetch/Prefetch.aspx
0
0
Document
General
Full URL
https://portal.office.com/Prefetch/Prefetch.aspx
Requested by
Host: secure.aadcdn.microsoftonline-p.com
URL: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5814.20/content/cdnbundles/jquery.1.11.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:a92::156 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

:method
GET
:authority
portal.office.com
:scheme
https
:path
/Prefetch/Prefetch.aspx
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://raifix.com.br/365/index.php
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
624011F84B34E0F1ECE1E1171C3266EE
Referer
http://raifix.com.br/365/index.php

Response headers

status
200
cache-control
no-store, no-cache,no-store, no-cache
content-length
3243
content-type
text/html; charset=utf-8
content-encoding
gzip
vary
Accept-Encoding
set-cookie
s.SessID=47ab9556-12bf-4312-ad67-91d2284ec31e; path=/; secure; HttpOnly s.SessID=47ab9556-12bf-4312-ad67-91d2284ec31e; path=/; secure; HttpOnly p.PersID=d914bc86-c678-40f1-a874-c87594b5b047; expires=Tue, 06-Aug-2019 04:37:45 GMT; path=/; secure; HttpOnly
strict-transport-security
max-age=31536000
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
x-msedge-ref
Ref A: 9C6D5F1F4E3F474F9E7275649C6E8D03 Ref B: VIEEDGE0413 Ref C: 2018-07-09T04:37:45Z
date
Mon, 09 Jul 2018 04:37:45 GMT

Redirect headers

status
302
cache-control
no-store, no-cache
content-type
text/html; charset=utf-8
location
https://portal.office.com/Prefetch/Prefetch.aspx
server
Microsoft-IIS/10.0
set-cookie
s.SessID=a8fb2eec-0b50-43c6-80de-e022acfc104b; path=/; secure; HttpOnly
x-powered-by
ASP.NET
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
date
Mon, 09 Jul 2018 04:37:45 GMT
content-length
165

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B boolean| isTouch string| cssId object| head object| link undefined| msViewportStyle function| $ function| jQuery object| jQuery111209700608809577667 object| MSLogin object| proxy object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info object| MSLogout object| ThirdPartyCookieStates object| PostType object| LoginOption object| TenantBranding object| users object| Tiles object| EmailDiscovery object| Support object| Post object| StrongAuthCheck object| Util object| WindowsBrowserSso number| tokenClickCount object| $Api

0 Cookies