urlscan.io logo urlscan.io
SecurityTrails logo

naoadiabetes.pt Open in urlscan Pro
5.206.228.2  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ad.atdmt.com/s/go;adv=205005;c.a=35020;p.a=Sunday7205;a.a=05350;qpb=1;cache=05350;?h=irmagen.ir/9yWas9yWa7Xat...
Effective URL: https://naoadiabetes.pt/ws1.php
Submission: On March 14 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 5 countries across 6 domains to perform 12 HTTP transactions. The main IP is 5.206.228.2, located in Portugal and belongs to NETSOLUTIONS, NL. The main domain is naoadiabetes.pt.
TLS certificate: Issued by R3 on February 1st 2022. Valid for: 3 months.
This is the only time naoadiabetes.pt was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 2a03:2880:f02... 32934 (FACEBOOK)
1 1 65.108.96.250 24940 (HETZNER-AS)
2 5 5.206.228.2 47674 (NETSOLUTIONS)
7 152.199.23.37 15133 (EDGECAST)
1 40.126.31.6 8075 (MICROSOFT...)
1 104.101.116.119 16625 (AKAMAI-AS)
12 4
1    2a03:2880:f02d:10d:face:b00c:0:8c (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
ad.atdmt.com
1    65.108.96.250 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.250.96.108.65.clients.your-server.de
irmagen.ir
5    5.206.228.2 (Portugal)

ASN47674 (NETSOLUTIONS, NL)
PTR: myserver.coded.pt
naoadiabetes.pt
7    152.199.23.37 (United States)

ASN15133 (EDGECAST, US)
aadcdn.msftauth.net
1    40.126.31.6 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.live.com
1    104.101.116.119 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-101-116-119.deploy.static.akamaitechnologies.com
www.cmegroup.com
Apex Domain
Subdomains		 Transfer
7 msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 1271
66 KB
5 naoadiabetes.pt
naoadiabetes.pt
69 KB
1 cmegroup.com
www.cmegroup.com — Cisco Umbrella Rank: 68084
1 live.com
login.live.com — Cisco Umbrella Rank: 76
1 irmagen.ir
irmagen.ir
308 B
1 atdmt.com
ad.atdmt.com — Cisco Umbrella Rank: 2903
982 B
12 6
Domain Requested by
7 aadcdn.msftauth.net naoadiabetes.pt
5 naoadiabetes.pt 2 redirects naoadiabetes.pt
1 www.cmegroup.com naoadiabetes.pt
1 login.live.com naoadiabetes.pt
1 irmagen.ir 1 redirects
1 ad.atdmt.com 1 redirects
12 6

This site contains links to these domains. Also see Links.

Domain
passwordreset.cmegroup.com
www.cmegroup.com
privacy.cmegroup.com
Subject Issuer Validity Valid
naoadiabetes.pt
R3		 2022-02-01 -
2022-05-02		 3 months crt.sh
aadcdn.msftauth.net
DigiCert SHA2 Secure Server CA		 2021-05-13 -
2022-05-13		 a year crt.sh
graph.windows.net
DigiCert SHA2 Secure Server CA		 2022-02-24 -
2023-02-24		 a year crt.sh
cmegroup.com
DigiCert SHA2 Secure Server CA		 2021-11-03 -
2022-11-03		 a year crt.sh

This page contains 2 frames:

Primary Page: https://naoadiabetes.pt/ws1.php
Frame ID: 33F1D234C86795FF2C6ECEFB2BDCB0DC
Requests: 11 HTTP requests in this frame

Frame: https://www.cmegroup.com/
Frame ID: BABC38CBB0AA7EBA8E91F95C9654AB47
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

  1. https://ad.atdmt.com/s/go;adv=205005;c.a=35020;p.a=Sunday7205;a.a=05350;qpb=1;cache=05350;?h=irma... HTTP 302
    https://irmagen.ir/9yWas9yWa7Xatyr7Purs9yWrvic9yWq0Hcm9yWgrr7Pupa7Xcr7Pm HTTP 302
    https://naoadiabetes.pt/?client-request-id=ZWFzZS5hdHlvdXJzZXJ2aWNlQGNtZWdyb3VwLmNvbQ== HTTP 302
    https://naoadiabetes.pt/ws1.php Page URL

Page Statistics

12
Requests

92 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

4
IPs

5
Countries

135 kB
Transfer

218 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ad.atdmt.com/s/go;adv=205005;c.a=35020;p.a=Sunday7205;a.a=05350;qpb=1;cache=05350;?h=irmagen.ir/9yWas9yWa7Xatyr7Purs9yWrvic9yWq0Hcm9yWgrr7Pupa7Xcr7Pm HTTP 302
    https://irmagen.ir/9yWas9yWa7Xatyr7Purs9yWrvic9yWq0Hcm9yWgrr7Pupa7Xcr7Pm HTTP 302
    https://naoadiabetes.pt/?client-request-id=ZWFzZS5hdHlvdXJzZXJ2aWNlQGNtZWdyb3VwLmNvbQ== HTTP 302
    https://naoadiabetes.pt/ws1.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10
  • https://naoadiabetes.pt/); HTTP 302
  • https://naoadiabetes.pt/ws1.php

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request ws1.php
naoadiabetes.pt/
Redirect Chain
  • https://ad.atdmt.com/s/go;adv=205005;c.a=35020;p.a=Sunday7205;a.a=05350;qpb=1;cache=05350;?h=irmagen.ir/9yWas9yWa7Xatyr7Purs9yWrvic9yWq0Hcm9yWgrr7Pupa7Xcr7Pm
  • https://irmagen.ir/9yWas9yWa7Xatyr7Purs9yWrvic9yWq0Hcm9yWgrr7Pupa7Xcr7Pm
  • https://naoadiabetes.pt/?client-request-id=ZWFzZS5hdHlvdXJzZXJ2aWNlQGNtZWdyb3VwLmNvbQ==
  • https://naoadiabetes.pt/ws1.php
33 KB
33 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://naoadiabetes.pt/ws1.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
5.206.228.2 , Portugal, ASN47674 (NETSOLUTIONS, NL),
Reverse DNS
myserver.coded.pt
Software
nginx /
Resource Hash
fe9bf9751548bf1e3f1b5ee6e5d7d39689b63d9b64156a0924d717e5e2c46cbf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx
Date
Mon, 14 Mar 2022 02:37:43 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache

Redirect headers

Server
nginx
Date
Mon, 14 Mar 2022 02:37:43 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
0
Connection
keep-alive
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Location
ws1.php
converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 		108 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FCC) /
Resource Hash
8b6a3b17737161e5fe8c29e401372a94b8e650226cf0cd17b4c3c4de5b380b11

Request headers

Referer
https://naoadiabetes.pt/
Origin
https://naoadiabetes.pt
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 14 Mar 2022 02:37:47 GMT
content-encoding
gzip
content-md5
0O2H9juGYL0zkzcYWr0NIg==
age
13947641
x-cache
HIT
content-length
19877
x-ms-lease-status
unlocked
last-modified
Tue, 28 Sep 2021 21:42:58 GMT
server
ECAcc (frc/8FCC)
etag
0x8D982C8F03AF4D4
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
4cd84846-501e-0061-5f72-b8a27b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
convergedlogin_pfetchsessionsprogress_3cdbaab1cf6d9b038234.js
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_3cdbaab1cf6d9b038234.js
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FC1) /
Resource Hash
0140da8c4170309baa728814f96185de2c71bb6a9101d51cb040ece949aa3128

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 14 Mar 2022 02:37:47 GMT
content-encoding
gzip
content-md5
iY5CLUIh9JBLJeGkywpVeQ==
age
11814359
x-cache
HIT
content-length
5420
x-ms-lease-status
unlocked
last-modified
Mon, 25 Oct 2021 18:32:55 GMT
server
ECAcc (frc/8FC1)
etag
0x8D997E5DC79B53A
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
fc77aabe-d01e-0043-3cd9-cbd147000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
convergedlogin_pidpdisambiguation_76e0875415977704da38.js
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_76e0875415977704da38.js
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F96) /
Resource Hash
e9b270d2a6af5d01dd798963a97d66ce020da7501b55c0239c0b5d7c1d5d2375

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 14 Mar 2022 02:37:47 GMT
content-encoding
gzip
content-md5
1A1WnDfolxSryQ87DZzNXQ==
age
11815504
x-cache
HIT
content-length
2359
x-ms-lease-status
unlocked
last-modified
Mon, 25 Oct 2021 18:32:55 GMT
server
ECAcc (frc/8F96)
etag
0x8D997E5DC900061
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
ec7e0d1c-c01e-000a-3fd6-cbf4c7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
convergedlogin_ppassword_6f5648a25cfbe86f348c.js
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 		20 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_6f5648a25cfbe86f348c.js
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F8B) /
Resource Hash
7cb7621f3eb49c78b89d119106cf42981a3075da154dc96af6ca24f8f68c6f53

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 14 Mar 2022 02:37:47 GMT
content-encoding
gzip
content-md5
JELxaubb1KDAtUnzSblILg==
age
11837615
x-cache
HIT
content-length
5736
x-ms-lease-status
unlocked
last-modified
Mon, 25 Oct 2021 18:32:56 GMT
server
ECAcc (frc/8F8B)
etag
0x8D997E5DD3425FC
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
82e0f209-401e-006b-7aa2-cb8839000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
logo.svg
naoadiabetes.pt/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://naoadiabetes.pt/logo.svg
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
5.206.228.2 , Portugal, ASN47674 (NETSOLUTIONS, NL),
Reverse DNS
myserver.coded.pt
Software
nginx /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/ws1.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Mon, 14 Mar 2022 02:37:43 GMT
Last-Modified
Sun, 12 Dec 2021 22:06:44 GMT
Server
nginx
ETag
"5d2fa2bea8500"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3651
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 		513 B
441 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F6C) /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 14 Mar 2022 02:37:47 GMT
content-encoding
gzip
content-md5
TjUQkZ0p0Y7rbj6LJofS9Q==
age
24962022
x-cache
HIT
content-length
276
x-ms-lease-status
unlocked
last-modified
Thu, 16 Jan 2020 00:32:45 GMT
server
ECAcc (frc/8F6C)
etag
0x8D79A1B9B05915D
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
c711e8bd-e01e-0094-3b45-547244000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
Me.htm
login.live.com/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://login.live.com/Me.htm?v=3
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.126.31.6 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 		0
20 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FCC) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 14 Mar 2022 02:37:47 GMT
content-encoding
gzip
content-md5
0O2H9juGYL0zkzcYWr0NIg==
age
13947641
x-cache
HIT
content-length
19877
x-ms-lease-status
unlocked
last-modified
Tue, 28 Sep 2021 21:42:58 GMT
server
ECAcc (frc/8FCC)
etag
0x8D982C8F03AF4D4
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
4cd84846-501e-0061-5f72-b8a27b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
ux.converged.login.strings-en-gb.min_-hjcgqxfzfu0cwzblacdqq2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 		0
12 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_-hjcgqxfzfu0cwzblacdqq2.js
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F6C) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 14 Mar 2022 02:37:47 GMT
content-encoding
gzip
content-md5
GYbSFdLE8Xb9pCzSg7cJ6A==
age
12134650
x-cache
HIT
content-length
12608
x-ms-lease-status
unlocked
last-modified
Tue, 19 Oct 2021 04:06:56 GMT
server
ECAcc (frc/8F6C)
etag
0x8D992B5E417004E
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
6044ad75-801e-004b-7fef-c8f668000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
/
www.cmegroup.com/ Frame BABC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.cmegroup.com/
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.101.116.119 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-101-116-119.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.cmegroup.com *.quikstrike.net commodex.co.il openexchange.community.cmegroup.com staging.tickertocker.com http://www.straitsfinancial.com www.straitsfinancial.com http://straitsfinancial.com https://www.home.saxo https://app.topsteptrader.com https://help.topsteptrader.com https://staging.topsteptrader.com https://blueeditsitecore.sys.dom https://bluesitecore.sys.dom https://sitecoredev.orange.saxobank.com https://sitecoredev-nocache.orange.saxobank.com https://sitecoredevedit.orange.tst2.dom http://star-website.com https://www.investing.com https://*.benzinga.com https://bz.zingbot.bz https://www.zingbot.bz https://gdcdyn.interactivebrokers.com https://www.interactivebrokers.com https://zingbot.bz https://m.zingbot.bz https://dev.futuresfirstacademy.com https://uat.futuresfirstacademy.com https://futuresfirstacademy.com http://stage.barchart.com http://www.barchart.com https://www.infinityfutures.com https://kilofutures.com https://m.cqg.com https://mdemo.cqg.com *.chicago.cme.com:7822 https://uatm.cqg.com https://local.zingbot.bz https://www.gulfbondsukuk.org www.kgieworld.sg https://www.propex24.wpcomstaging.com https://www.propex24.com *.straitsfinancial.gate39tech.com us.straitsfinancial.com https://*.kapcoclients.com https://kapcoclients.com https://*.wallstreetbound.org https://wallstreetbound.org https://cofcointl.plateau.com https://rise.articulate.com https://members.tradeday.com http://blf-django.herokuapp.com https://www.bluelinefutures.com https://www.bluelinefutures.live https://www.bluelinefutures.trade https://login.chicago.cme.com https://loginnr.chicago.cme.com https://logincert.chicago.cme.com https://login-ny.chicago.cme.com https://ampfutures.com https://cme.ampfutures.com https://*.advantagefutures.com https://*.e-futures.com https://*.etrade.com https://*.gffbrokers.com https://infinityfutures-cn.com https://sweetfutures.com https://*.tradovate.com https://home.saxo https://*.tickmill.co.uk https://*.directa.it https://big.pt https://*.tradestation-international.com https://*.stonex.com http://tradinglessons.com https://tradinglessons.com *.ibroker.it *.ibroker.es *.cornertrader.ch *.whselfinvest.com *.banxbroker.de *.ameritrade.com *.sweetfutures.com *.danielstrading.com *.gainfutures.com gainfutures.com *.futuresonline.com *.tdainc.com *.lsvp.com *.schwab.com *.schwab.co.uk *.us.global.schwab.com *.dev.schwab.com *.cmegroupfoundation.org news.cqg.com;
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
http://star-website.com
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Referrer-Policy
no-referrer-when-downgrade
Server
Apache
ServerID
w1
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
Content-Length
361992
Cache-Control
max-age=86400
Date
Mon, 14 Mar 2022 02:37:47 GMT
Connection
keep-alive
Content-Security-Policy
frame-ancestors 'self' *.cmegroup.com *.quikstrike.net commodex.co.il openexchange.community.cmegroup.com staging.tickertocker.com http://www.straitsfinancial.com www.straitsfinancial.com http://straitsfinancial.com https://www.home.saxo https://app.topsteptrader.com https://help.topsteptrader.com https://staging.topsteptrader.com https://blueeditsitecore.sys.dom https://bluesitecore.sys.dom https://sitecoredev.orange.saxobank.com https://sitecoredev-nocache.orange.saxobank.com https://sitecoredevedit.orange.tst2.dom http://star-website.com https://www.investing.com https://*.benzinga.com https://bz.zingbot.bz https://www.zingbot.bz https://gdcdyn.interactivebrokers.com https://www.interactivebrokers.com https://zingbot.bz https://m.zingbot.bz https://dev.futuresfirstacademy.com https://uat.futuresfirstacademy.com https://futuresfirstacademy.com http://stage.barchart.com http://www.barchart.com https://www.infinityfutures.com https://kilofutures.com https://m.cqg.com https://mdemo.cqg.com *.chicago.cme.com:7822 https://uatm.cqg.com https://local.zingbot.bz https://www.gulfbondsukuk.org www.kgieworld.sg https://www.propex24.wpcomstaging.com https://www.propex24.com *.straitsfinancial.gate39tech.com us.straitsfinancial.com https://*.kapcoclients.com https://kapcoclients.com https://*.wallstreetbound.org https://wallstreetbound.org https://cofcointl.plateau.com https://rise.articulate.com https://members.tradeday.com http://blf-django.herokuapp.com https://www.bluelinefutures.com https://www.bluelinefutures.live https://www.bluelinefutures.trade https://login.chicago.cme.com https://loginnr.chicago.cme.com https://logincert.chicago.cme.com https://login-ny.chicago.cme.com https://ampfutures.com https://cme.ampfutures.com https://*.advantagefutures.com https://*.e-futures.com https://*.etrade.com https://*.gffbrokers.com https://infinityfutures-cn.com https://sweetfutures.com https://*.tradovate.com https://home.saxo https://*.tickmill.co.uk https://*.directa.it https://big.pt https://*.tradestation-international.com https://*.stonex.com http://tradinglessons.com https://tradinglessons.com *.ibroker.it *.ibroker.es *.cornertrader.ch *.whselfinvest.com *.banxbroker.de *.ameritrade.com *.sweetfutures.com *.danielstrading.com *.gainfutures.com gainfutures.com *.futuresonline.com *.tdainc.com *.lsvp.com *.schwab.com *.schwab.co.uk *.us.global.schwab.com *.dev.schwab.com *.cmegroupfoundation.org news.cqg.com;
ws1.php
naoadiabetes.pt/
Redirect Chain
  • https://naoadiabetes.pt/);
  • https://naoadiabetes.pt/ws1.php
32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://naoadiabetes.pt/ws1.php
Requested by
Host: naoadiabetes.pt
URL: https://naoadiabetes.pt/ws1.php
Protocol
HTTP/1.1
Server
5.206.228.2 , Portugal, ASN47674 (NETSOLUTIONS, NL),
Reverse DNS
myserver.coded.pt
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://naoadiabetes.pt/ws1.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 14 Mar 2022 02:37:43 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 14 Mar 2022 02:37:43 GMT
Server
nginx
Content-Type
text/html; charset=UTF-8
Location
ws1.php
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored object| webpackJsonp boolean| __convergedlogin_pfetchsessionsprogress_3cdbaab1cf6d9b038234 boolean| __convergedlogin_pidpdisambiguation_76e0875415977704da38 boolean| __convergedlogin_ppassword_6f5648a25cfbe86f348c

3 Cookies

Domain/Path Name / Value
naoadiabetes.pt/ Name: PHPSESSID
Value: ff8d17d1f36abcb5ddd4f81949159301
.login.live.com/ Name: uaid
Value: bc28462f53a841c78fe9816a97bcaa0c
.login.live.com/ Name: MSPRequ
Value: id=N&lt=1647225468&co=1

1 Console Messages

Source Level URL
Text
security error
Message:
Refused to frame 'https://www.cmegroup.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' *.cmegroup.com *.quikstrike.net commodex.co.il openexchange.community.cmegroup.com staging.tickertocker.com http://www.straitsfinancial.com www.straitsfinancial.com http://straitsfinancial.com https://www.home.saxo https://app.topsteptrader.com https://help.topsteptrader.com https://staging.topsteptrader.com https://blueeditsitecore.sys.dom https://bluesitecore.sys.dom https://sitecoredev.orange.saxobank.com https://sitecoredev-nocache.orange.saxobank.com https://sitecoredevedit.orange.tst2.dom http://star-website.com https://www.investing.com https://*.benzinga.com https://bz.zingbot.bz https://www.zingbot.bz https://gdcdyn.interactivebrokers.com https://www.interactivebrokers.com https://zingbot.bz https://m.zingbot.bz https://dev.futuresfirstacademy.com https://uat.futuresfirstacademy.com https://futuresfirstacademy.com http://stage.barchart.com http://www.barchart.com https://www.infinityfutures.com https://kilofutures.com https://m.cqg.com https://mdemo.cqg.com *.chicago.cme.com:7822 https://uatm.cqg.com https://local.zingbot.bz https://www.gulfbondsukuk.org www.kgieworld.sg https://www.propex24.wpcomstaging.com https://www.propex24.com *.straitsfinancial.gate39tech.com us.straitsfinancial.com https://*.kapcoclients.com https://kapcoclients.com https://*.wallstreetbound.org https://wallstreetbound.org https://cofcointl.plateau.com https://rise.articulate.com https://members.tradeday.com http://blf-django.herokuapp.com https://www.bluelinefutures.com https://www.bluelinefutures.live https://www.bluelinefutures.trade https://login.chicago.cme.com https://loginnr.chicago.cme.com https://logincert.chicago.cme.com https://login-ny.chicago.cme.com https://ampfutures.com https://cme.ampfutures.com https://*.advantagefutures.com https://*.e-futures.com https://*.etrade.com https://*.gffbrokers.com https://infinityfutures-cn.com https://sweetfutures.com https://*.tradovate.com https://home.saxo https://*.tickmill.co.uk https://*.directa.it https://big.pt https://*.tradestation-international.com https://*.stonex.com http://tradinglessons.com https://tradinglessons.com *.ibroker.it *.ibroker.es *.cornertrader.ch *.whselfinvest.com *.banxbroker.de *.ameritrade.com *.sweetfutures.com *.danielstrading.com *.gainfutures.com gainfutures.com *.futuresonline.com *.tdainc.com *.lsvp.com *.schwab.com *.schwab.co.uk *.us.global.schwab.com *.dev.schwab.com *.cmegroupfoundation.org news.cqg.com".