ssll.com.br Open in urlscan Pro
186.233.90.10  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/mWYiE4xQw3?amp=1?264884820208482648848202084826488482020848262648848202084826488482020848264884820208482626488482020848264884820208482648848202084826 Page URL
2. https://www.islamic-faith.com/wp-admin/js/up/com.php?04554 Page URL
3. http://ssll.com.br/wp-content/upgrade/red/KeLast/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	mWYiE4xQw3 Show response t.co/	332 B 519 B	265ms 172ms	Document text/html	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/mWYiE4xQw3?amp=1?264884820208482648848202084826488482020848262648848202084826488482020848264884820208482626488482020848264884820208482648848202084826 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash 09fcb0af7ab97044baebd7294f47cf9c088f2c94544ca115db787a4af60f1da7 Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers :method GET :authority t.co :scheme https :path /mWYiE4xQw3?amp=1?264884820208482648848202084826488482020848262648848202084826488482020848264884820208482626488482020848264884820208482648848202084826 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cache-control private,max-age=300 content-encoding gzip content-length 211 content-type text/html; charset=utf-8 date Mon, 28 Dec 2020 13:59:12 GMT expires Mon, 28 Dec 2020 14:04:12 GMT server tsa_o set-cookie muc=b5ec5a5a-5744-42be-8250-f3447d1a4ebe; Max-Age=63072000; Expires=Wed, 28 Dec 2022 13:59:12 GMT; Domain=t.co; Secure; SameSite=None strict-transport-security max-age=0 vary Origin x-connection-hash e9b40d8b01f13d4599e417558d764fd2 x-response-time 128 x-xss-protection 0
GET H2	200	com.php Show response www.islamic-faith.com/wp-admin/js/up/	237 B 748 B	239ms 202ms	Document text/html	2606:4700:3035::681f:469d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.islamic-faith.com/wp-admin/js/up/com.php?04554 Requested by Host: t.co URL: https://t.co/mWYiE4xQw3?amp=1?264884820208482648848202084826488482020848262648848202084826488482020848264884820208482626488482020848264884820208482648848202084826 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681f:469d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51489795d40f6e81ca1a297485b5eb3b9da3bfb5deb964e565b544c4050b6c42 Request headers :method GET :authority www.islamic-faith.com :scheme https :path /wp-admin/js/up/com.php?04554 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://t.co/mWYiE4xQw3?amp=1?264884820208482648848202084826488482020848262648848202084826488482020848264884820208482626488482020848264884820208482648848202084826 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://t.co/mWYiE4xQw3?amp=1?264884820208482648848202084826488482020848262648848202084826488482020848264884820208482626488482020848264884820208482648848202084826 Response headers date Mon, 28 Dec 2020 13:59:12 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d246084b0cc552f418d4955cdc1a4536b1609163952; expires=Wed, 27-Jan-21 13:59:12 GMT; path=/; domain=.islamic-faith.com; HttpOnly; SameSite=Lax vary Accept-Encoding access-control-allow-origin * cf-cache-status DYNAMIC cf-request-id 074b3e6a2200000609ce1ce000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lNwvTQb3Qv6oLig3S4uZ5Hy0JvBSDM8ThDQ3WYb3kGv9iCzkaXIb%2BiO0nWyGlhF0MgfqqzZWYOFvQDWv4kLnBv3sXa3WqXTIuAKUcvY024en9CHDdpGnbK0Uy%2Fn%2BkMx2X3g%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 608bccf039900609-FRA content-encoding br
GET H/1.1	200 OK	Primary Request Cookie set / Show response ssll.com.br/wp-content/upgrade/red/KeLast/	389 B 751 B	1666ms 1644ms	Document text/html	186.233.90.10 IPHOTEL Hospedage...
General Check archive.org Show headers Download Go to Full URL http://ssll.com.br/wp-content/upgrade/red/KeLast/ Protocol HTTP/1.1 Server 186.233.90.10 , Brazil, ASN262787 (IPHOTEL Hospedagem de Sites Ltda, BR), Reverse DNS server9010.cloud.srv.br Software nginx / PHP/7.1.26 PleskLin Resource Hash ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793 Request headers Host ssll.com.br Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx Date Mon, 28 Dec 2020 13:59:13 GMT Content-Type text/html; charset=UTF-8 Content-Length 262 Connection keep-alive X-Powered-By PHP/7.1.26 PleskLin Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie cazanova=occ83h7egqtdgvko8pc5ujn8cn56nvqj; expires=Mon, 28-Dec-2020 15:59:13 GMT; Max-Age=7200; path=/; HttpOnly Vary Accept-Encoding Content-Encoding gzip
GET H/1.1	200 OK	captcha.js Show response ssll.com.br/wp-content/upgrade/red/KeLast/assets/js/	118 KB 118 KB	294ms 294ms	Script application/javascript	186.233.90.10 IPHOTEL Hospedage...
General Check archive.org Show headers Download Go to Full URL http://ssll.com.br/wp-content/upgrade/red/KeLast/assets/js/captcha.js Requested by Host: ssll.com.br URL: http://ssll.com.br/wp-content/upgrade/red/KeLast/ Protocol HTTP/1.1 Server 186.233.90.10 , Brazil, ASN262787 (IPHOTEL Hospedagem de Sites Ltda, BR), Reverse DNS server9010.cloud.srv.br Software nginx / PleskLin Resource Hash ffdb484c06702e7c2a79eb364ffe818f2c691286998fb52ab09c749eabd8fb72 Request headers Referer http://ssll.com.br/wp-content/upgrade/red/KeLast/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 28 Dec 2020 13:59:14 GMT Last-Modified Thu, 24 Dec 2020 00:43:03 GMT Server nginx X-Powered-By PleskLin ETag "5fe3e417-1d71c" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 120604
GET H/1.1	200 OK	captcha.png ssll.com.br/wp-content/upgrade/red/KeLast/	4 KB 5 KB	337ms 336ms	Image image/png	186.233.90.10 IPHOTEL Hospedage...
General Check archive.org Show headers Download Go to Show image Full URL http://ssll.com.br/wp-content/upgrade/red/KeLast/captcha.png?_1609163958371 Protocol HTTP/1.1 Server 186.233.90.10 , Brazil, ASN262787 (IPHOTEL Hospedagem de Sites Ltda, BR), Reverse DNS server9010.cloud.srv.br Software nginx / PHP/7.1.26, PleskLin Resource Hash 9dc25de1b7094652202d35b40bdc9b4dfae67803d7a78bd79748855d399bb6e1 Request headers Referer http://ssll.com.br/wp-content/upgrade/red/KeLast/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Mon, 28 Dec 2020 13:59:17 GMT Content-Encoding gzip Server nginx X-Powered-By PHP/7.1.26, PleskLin Vary Accept-Encoding Content-Type image/png Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 4487 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	Kee.png ssll.com.br/wp-content/upgrade/red/KeLast/	27 KB 27 KB	549ms 526ms	Image image/png	186.233.90.10 IPHOTEL Hospedage...
General Check archive.org Show headers Download Go to Show image Full URL http://ssll.com.br/wp-content/upgrade/red/KeLast/Kee.png Requested by Host: ssll.com.br URL: http://ssll.com.br/wp-content/upgrade/red/KeLast/ Protocol HTTP/1.1 Server 186.233.90.10 , Brazil, ASN262787 (IPHOTEL Hospedagem de Sites Ltda, BR), Reverse DNS server9010.cloud.srv.br Software nginx / PleskLin Resource Hash 241eca53a73b5954ae742575918848c979bfa80530c7381a8a4ab8979180af29 Request headers Referer http://ssll.com.br/wp-content/upgrade/red/KeLast/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 28 Dec 2020 13:59:17 GMT Last-Modified Thu, 24 Dec 2020 00:43:03 GMT Server nginx X-Powered-By PleskLin ETag "5fe3e417-6c62" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 27746

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: KeyBank (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| setImmediate function| clearImmediate function| Vue

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ssll.com.br/	1970-01-19 14:59:31	Name: cazanova Value: occ83h7egqtdgvko8pc5ujn8cn56nvqj

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ssll.com.br
t.co
www.islamic-faith.com
104.244.42.197
186.233.90.10
2606:4700:3035::681f:469d
09fcb0af7ab97044baebd7294f47cf9c088f2c94544ca115db787a4af60f1da7
241eca53a73b5954ae742575918848c979bfa80530c7381a8a4ab8979180af29
51489795d40f6e81ca1a297485b5eb3b9da3bfb5deb964e565b544c4050b6c42
9dc25de1b7094652202d35b40bdc9b4dfae67803d7a78bd79748855d399bb6e1
ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793
ffdb484c06702e7c2a79eb364ffe818f2c691286998fb52ab09c749eabd8fb72