jacksonengler.com.br
Open in
urlscan Pro
50.116.87.189
Malicious Activity!
Public Scan
Effective URL: https://jacksonengler.com.br/contas/tmp/index.php?q=suosq5g9suos-rm7m-suosrm7mrm7m-q00wrm7m&s=suosq5g9suos-rm7m-suosrm7mrm7m-...
Submission Tags: falconsandbox
Submission: On May 14 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 26th 2023. Valid for: 3 months.
This is the only time jacksonengler.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 191.6.209.198 191.6.209.198 | 28299 (Cyberweb ...) (Cyberweb Networks Ltda) | |
2 9 | 50.116.87.189 50.116.87.189 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:806::2003 | 15169 (GOOGLE) (GOOGLE) | |
11 | 3 |
ASN28299 (Cyberweb Networks Ltda, BR)
PTR: web192.kinghost.net
esbtechnology.com.br |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-116-87-189.unifiedlayer.com
jacksonengler.com.br |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
jacksonengler.com.br
2 redirects
jacksonengler.com.br |
402 KB |
3 |
gstatic.com
fonts.gstatic.com |
47 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 50 |
1 KB |
1 |
esbtechnology.com.br
1 redirects
esbtechnology.com.br |
385 B |
11 | 4 |
Domain | Requested by | |
---|---|---|
9 | jacksonengler.com.br |
2 redirects
jacksonengler.com.br
|
3 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
jacksonengler.com.br
|
1 | esbtechnology.com.br | 1 redirects |
11 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
autodiscover.jacksonengler.com.br R3 |
2023-03-26 - 2023-06-24 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://jacksonengler.com.br/contas/tmp/index.php?q=suosq5g9suos-rm7m-suosrm7mrm7m-q00wrm7m&s=suosq5g9suos-rm7m-suosrm7mrm7m-q00wrm7m&n=suosq5g9suos-rm7m-suosrm7mrm7m-q00wrm7m
Frame ID: 78497BE7CE9E1A1E7E4DFF13E4A55178
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
...................Page URL History Show full URLs
-
http://esbtechnology.com.br/Integrall/Despesa/
HTTP 302
https://jacksonengler.com.br/contas/tmp HTTP 301
https://jacksonengler.com.br/contas/tmp/ HTTP 302
https://jacksonengler.com.br/contas/tmp/index.php?q=suosq5g9suos-rm7m-suosrm7mrm7m-q00wrm7m&s=suosq5g9suo... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://esbtechnology.com.br/Integrall/Despesa/
HTTP 302
https://jacksonengler.com.br/contas/tmp HTTP 301
https://jacksonengler.com.br/contas/tmp/ HTTP 302
https://jacksonengler.com.br/contas/tmp/index.php?q=suosq5g9suos-rm7m-suosrm7mrm7m-q00wrm7m&s=suosq5g9suos-rm7m-suosrm7mrm7m-q00wrm7m&n=suosq5g9suos-rm7m-suosrm7mrm7m-q00wrm7m Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
jacksonengler.com.br/contas/tmp/ Redirect Chain
|
2 KB 922 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geral.css
jacksonengler.com.br/contas/tmp/estilos/ |
16 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
jacksonengler.com.br/contas/tmp/javascripts/ |
68 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
jacksonengler.com.br/contas/tmp/javascripts/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geral.js
jacksonengler.com.br/contas/tmp/javascripts/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
10 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
jacksonengler.com.br/contas/tmp/imagens/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
background_enter.jpg
jacksonengler.com.br/contas/tmp/imagens/ |
354 KB 355 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery function| snd_img1 function| snd_img2 function| snd_img3 function| check_cc_frente function| check_doc_frente function| check_doc_verso function| send_form_1 function| send_form_2 function| send_form_3 function| check_docs function| check_pscc function| check_enter_cc function| get_payment function| op_indisponivel function| check_login function| SomenteNumero function| checkCard function| validarCPF function| remove function| getCreditCardLabel2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
esbtechnology.com.br/Integrall/Despesa | Name: ipx Value: 185.213.155.157 |
|
jacksonengler.com.br/ | Name: PHPSESSID Value: 64c7f7746654a036a8bda48a2aab6465 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
esbtechnology.com.br
fonts.googleapis.com
fonts.gstatic.com
jacksonengler.com.br
191.6.209.198
2a00:1450:4001:806::2003
2a00:1450:4001:811::200a
50.116.87.189
3b775d6e0b0f5cff98aca4daaa7f27a7c3678f39d1f5186776bb14b63cc2f625
41ab379d006b5fc73e0ce4c19176577f326fc8e33c11b7cebd746c4786ff72f5
914fb25975ddb496633e4b53df26233946f8332754ca01f10bbbfac082544d6d
aedb0e12d88580acdff4e05415de915b7291191cf35f5966fe7ce9aa34c1449c
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b955ecfae598c62ddd4231f782ff35f5c5778a52e5d5aca86ba244bba1bc0f17
bbd133aaccc627dd11acf8545f051db9b1e00f4875ff6c7e89ab3509f9871ad3
d2b7c412dd38edb67d6f12575a6b9fd7e232f18d77be0c34b835e1579776dac9
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615