lufthansa.protocolo10em30dias.com

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 45.178.181.231, located in São Paulo, Brazil and belongs to AbsamHost Internet Data Center, BR. The main domain is lufthansa.protocolo10em30dias.com.
TLS certificate: Issued by R3 on September 7th 2023. Valid for: 3 months.

This is the only time lufthansa.protocolo10em30dias.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lufthansa (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
2 8	45.178.181.231 45.178.181.231		269098 (AbsamHost...) (AbsamHost Internet Data Center)
6	2

8 45.178.181.231 (São Paulo, Brazil) 2 redirects

ASN269098 (AbsamHost Internet Data Center, BR)
PTR: server-web1.sp.mxh.samtooweb.com

lufthansa.protocolo10em30dias.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	protocolo10em30dias.com 2 redirects lufthansa.protocolo10em30dias.com	210 KB
6	1

	Domain	Requested by
8	lufthansa.protocolo10em30dias.com	2 redirects lufthansa.protocolo10em30dias.com
6	1

This site contains no links.

Subject Issuer	Validity	Valid
lufthansa.protocolo10em30dias.com R3	`2023-09-07` - `2023-12-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php
Frame ID: FA3208D6E6959C12C8D8D5DC87732CA2
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/ HTTP 302
https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/index.php HTTP 302
https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

209 kB
Transfer

908 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/ HTTP 302
https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/index.php HTTP 302
https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/ Redirect Chain https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/ https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/index.php https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php	183 KB 6 KB	245ms 245ms	Document text/html	45.178.181.231 AbsamHost Interne...
General Check archive.org Show headers Download Go to Full URL https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.178.181.231 São Paulo, Brazil, ASN269098 (AbsamHost Internet Data Center, BR), Reverse DNS server-web1.sp.mxh.samtooweb.com Software LiteSpeed / Resource Hash `1b29363640b5508d51f88c316689996af40c8257b1865fdcdfd38dabdc39c669` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Mon, 11 Sep 2023 15:57:55 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding Redirect headers cache-control no-cache, no-store, must-revalidate, max-age=0 content-length 0 content-type text/html; charset=UTF-8 date Mon, 11 Sep 2023 15:57:55 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location login.php pragma no-cache server LiteSpeed
GET H2	200	all.css lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/	375 KB 62 KB	242ms 242ms	Stylesheet text/css	45.178.181.231 AbsamHost Interne...
General Check archive.org Show headers Download Go to Full URL https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/all.css Requested by Host: lufthansa.protocolo10em30dias.com URL: https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.178.181.231 São Paulo, Brazil, ASN269098 (AbsamHost Internet Data Center, BR), Reverse DNS server-web1.sp.mxh.samtooweb.com Software LiteSpeed / Resource Hash `67aac97e694b7603219da39183b47f5440b2aa93ddab7dd5831bc0af033c338c` Request headers accept-language de-DE,de;q=0.9 Referer https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Mon, 11 Sep 2023 15:57:56 GMT content-encoding br last-modified Thu, 23 Feb 2023 20:09:42 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 62905 expires Mon, 18 Sep 2023 15:57:56 GMT
GET H2	200	jq.js Show response lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/cdns/	287 KB 82 KB	716ms 716ms	Script application/javascript	45.178.181.231 AbsamHost Interne...
General Check archive.org Show headers Download Go to Full URL https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/cdns/jq.js Requested by Host: lufthansa.protocolo10em30dias.com URL: https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.178.181.231 São Paulo, Brazil, ASN269098 (AbsamHost Internet Data Center, BR), Reverse DNS server-web1.sp.mxh.samtooweb.com Software LiteSpeed / Resource Hash `9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953` Request headers accept-language de-DE,de;q=0.9 Referer https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Mon, 11 Sep 2023 15:57:56 GMT content-encoding br last-modified Mon, 02 Jan 2023 19:14:00 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 83850 expires Mon, 18 Sep 2023 15:57:56 GMT
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `24b85252041352cd0d17d257a7aeaed94d470b173b032d321f01b3d78ab0d04c` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/svg+xml
GET H2	200	Login_Teaser_1.jpg lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/	19 KB 19 KB	244ms 244ms	Image image/jpeg	45.178.181.231 AbsamHost Interne...
General Check archive.org Show headers Download Go to Show image Full URL https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/Login_Teaser_1.jpg Requested by Host: lufthansa.protocolo10em30dias.com URL: https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.178.181.231 São Paulo, Brazil, ASN269098 (AbsamHost Internet Data Center, BR), Reverse DNS server-web1.sp.mxh.samtooweb.com Software LiteSpeed / Resource Hash `876f9fd292ca58290949b7a0c55be6f316045cdd0c24de2d9692db04e1f76e7b` Request headers accept-language de-DE,de;q=0.9 Referer https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Mon, 11 Sep 2023 15:57:56 GMT last-modified Thu, 23 Feb 2023 20:13:26 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 19368 expires Mon, 18 Sep 2023 15:57:56 GMT
GET H2	200	Login_Teaser_2.jpg lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/	18 KB 18 KB	246ms 245ms	Image image/jpeg	45.178.181.231 AbsamHost Interne...
General Check archive.org Show headers Download Go to Show image Full URL https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/Login_Teaser_2.jpg Requested by Host: lufthansa.protocolo10em30dias.com URL: https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.178.181.231 São Paulo, Brazil, ASN269098 (AbsamHost Internet Data Center, BR), Reverse DNS server-web1.sp.mxh.samtooweb.com Software LiteSpeed / Resource Hash `9fe593f72a58398fe5a0bb041bdc1135d0044e959a66d513452561508d836e80` Request headers accept-language de-DE,de;q=0.9 Referer https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Mon, 11 Sep 2023 15:57:56 GMT last-modified Thu, 23 Feb 2023 20:13:44 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 18098 expires Mon, 18 Sep 2023 15:57:56 GMT
GET H2	200	Login_Teaser_3.jpg lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/	23 KB 23 KB	244ms 244ms	Image image/jpeg	45.178.181.231 AbsamHost Interne...
General Check archive.org Show headers Download Go to Show image Full URL https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/res/Login_Teaser_3.jpg Requested by Host: lufthansa.protocolo10em30dias.com URL: https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.178.181.231 São Paulo, Brazil, ASN269098 (AbsamHost Internet Data Center, BR), Reverse DNS server-web1.sp.mxh.samtooweb.com Software LiteSpeed / Resource Hash `d3d380d260d4736174896df420c62ddd1dd8515b60d1775583c3556acdc673e9` Request headers accept-language de-DE,de;q=0.9 Referer https://lufthansa.protocolo10em30dias.com/b27kkzd2ab4cp4g5/auth/login.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Mon, 11 Sep 2023 15:57:56 GMT last-modified Thu, 23 Feb 2023 20:13:54 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 23256 expires Mon, 18 Sep 2023 15:57:56 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lufthansa (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lufthansa.protocolo10em30dias.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: a96cda0c6d848129707aa0e0bd6c11d6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lufthansa.protocolo10em30dias.com
45.178.181.231
1b29363640b5508d51f88c316689996af40c8257b1865fdcdfd38dabdc39c669
24b85252041352cd0d17d257a7aeaed94d470b173b032d321f01b3d78ab0d04c
67aac97e694b7603219da39183b47f5440b2aa93ddab7dd5831bc0af033c338c
876f9fd292ca58290949b7a0c55be6f316045cdd0c24de2d9692db04e1f76e7b
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
9fe593f72a58398fe5a0bb041bdc1135d0044e959a66d513452561508d836e80
d3d380d260d4736174896df420c62ddd1dd8515b60d1775583c3556acdc673e9

lufthansa.protocolo10em30dias.com Open in urlscan Pro 45.178.181.231 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

209 kBTransfer

908 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

lufthansa.protocolo10em30dias.com Open in urlscan Pro
45.178.181.231 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

209 kB
Transfer

908 kB
Size

1
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!