clinicabernardo.com.br Open in urlscan Pro
192.185.216.88 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://mcbnv.com/
Effective URL:
https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746
Submission: On January 16 via manual (January 16th 2019, 12:19:31 am UTC) from AU

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 16 HTTP transactions. The main IP is 192.185.216.88, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is clinicabernardo.com.br.
TLS certificate: Issued by Let's Encrypt Authority X3 on December 10th 2018. Valid for: 3 months.

This is the only time clinicabernardo.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2001:4860:480... 2001:4860:4802:38::15	15169 (GOOGLE) (GOOGLE - Google LLC)
16	192.185.216.88 192.185.216.88	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
16	1

1 2001:4860:4802:38::15 (United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

mcbnv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 192.185.216.88 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: srv94-ip11.prodns.com.br

clinicabernardo.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	clinicabernardo.com.br clinicabernardo.com.br	1 MB
1	mcbnv.com 1 redirects mcbnv.com	251 B
16	2

	Domain	Requested by
16	clinicabernardo.com.br	clinicabernardo.com.br
1	mcbnv.com	1 redirects
16	2

This site contains no links.

Subject Issuer	Validity	Valid
clinicabernardo.com.br Let's Encrypt Authority X3	`2018-12-10` - `2019-03-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746
Frame ID: 0854DA736A90FA31C672D98509E439B6
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://mcbnv.com/ HTTP 302
https://clinicabernardo.com.br/myob/account/ Page URL
https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c1... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
env /^Modernizr$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

1146 kB
Transfer

1234 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mcbnv.com/ HTTP 302
https://clinicabernardo.com.br/myob/account/ Page URL
https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://mcbnv.com/ HTTP 302
https://clinicabernardo.com.br/myob/account/

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response clinicabernardo.com.br/myob/account/ Redirect Chain http://mcbnv.com/ https://clinicabernardo.com.br/myob/account/	357 B 359 B	364ms 363ms	Document text/html	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `b49b369406ef72288d987bc625ca2a31467a100316b01d6bf2dd964fe62e8b7c` Request headers :method GET :authority clinicabernardo.com.br :scheme https :path /myob/account/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 server nginx/1.14.1 date Wed, 16 Jan 2019 00:19:15 GMT content-type text/html content-encoding gzip Redirect headers Location https://clinicabernardo.com.br/myob/account/ Date Wed, 16 Jan 2019 00:19:15 GMT Content-Type text/html; charset=UTF-8 Server ghs Content-Length 241 X-XSS-Protection 1; mode=block X-Frame-Options SAMEORIGIN
POST H2	200	Primary Request AuthCTN.php Show response clinicabernardo.com.br/myob/account/	3 KB 2 KB	404ms 403ms	Document text/html	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `c4a12c7572e6a4ee7c74d9933ed321df21b08e5575e6a6086042265c0455d48b` Request headers :method POST :authority clinicabernardo.com.br :scheme https :path /myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 content-length 6 pragma no-cache cache-control no-cache origin https://clinicabernardo.com.br upgrade-insecure-requests 1 content-type application/x-www-form-urlencoded user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 referer https://clinicabernardo.com.br/myob/account/ accept-encoding gzip, deflate, br Origin https://clinicabernardo.com.br Upgrade-Insecure-Requests 1 Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://clinicabernardo.com.br/myob/account/ Response headers status 200 server nginx/1.14.1 date Wed, 16 Jan 2019 00:19:15 GMT content-type text/html content-encoding gzip
GET H2	200	modernizr.min.js Show response clinicabernardo.com.br/myob/account/source/	11 KB 5 KB	152ms 151ms	Script application/javascript	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/modernizr.min.js Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe` Request headers :path /myob/account/source/modernizr.min.js pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT content-encoding gzip last-modified Wed, 08 Aug 2018 22:31:14 GMT server nginx/1.14.1 content-type application/javascript
GET H2	200	normalize.min.css clinicabernardo.com.br/myob/account/source/	2 KB 1 KB	156ms 155ms	Stylesheet text/css	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/normalize.min.css Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `b76ffbb2665f82b493e054b50d3d1bb3f2a8b4233be1795ca9937956eef196bc` Request headers :path /myob/account/source/normalize.min.css pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT content-encoding gzip last-modified Wed, 08 Aug 2018 22:31:46 GMT server nginx/1.14.1 content-type text/css
GET H2	200	style.css clinicabernardo.com.br/myob/account/source/	4 KB 1 KB	160ms 159ms	Stylesheet text/css	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/style.css Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `b9381b9ce4117dbcf1e1bc7d19dbd142bb59db1d4b787301e20775f1c67a11d0` Request headers :path /myob/account/source/style.css pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT content-encoding gzip last-modified Mon, 27 Aug 2018 18:00:56 GMT server nginx/1.14.1 content-type text/css
GET H2	200	val.js Show response clinicabernardo.com.br/myob/account/source/	740 B 511 B	148ms 147ms	Script application/javascript	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/val.js Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `88663ce5f8395ff5f4b44ee90ab20049b9d3cda8947af7f56cddac812e071009` Request headers :path /myob/account/source/val.js pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT content-encoding gzip last-modified Wed, 22 Aug 2018 18:24:10 GMT server nginx/1.14.1 content-type application/javascript
GET H2	200	val2.js Show response clinicabernardo.com.br/myob/account/source/	856 B 536 B	155ms 154ms	Script application/javascript	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/val2.js Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `e35808b62166f8028f60b0099188e8b2f330a6b6e9f7d971c2ab268c088006dd` Request headers :path /myob/account/source/val2.js pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT content-encoding gzip last-modified Tue, 28 Aug 2018 22:58:52 GMT server nginx/1.14.1 content-type application/javascript
GET H2	200	logo.png clinicabernardo.com.br/myob/account/source/	29 KB 29 KB	161ms 160ms	Image image/png	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Show image Full URL https://clinicabernardo.com.br/myob/account/source/logo.png Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `00662d26972be730b6e4b540dbc39aabf4b38bfe0837e25e0035ec23325f67f9` Request headers :path /myob/account/source/logo.png pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT last-modified Wed, 22 Aug 2018 02:45:48 GMT server nginx/1.14.1 accept-ranges bytes content-length 29692 content-type image/png
GET H2	200	b2ZmaWNl.png clinicabernardo.com.br/myob/account/source/	60 KB 60 KB	154ms 154ms	Image image/png	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Show image Full URL https://clinicabernardo.com.br/myob/account/source/b2ZmaWNl.png Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `30e98fd6037c47ca5cee6044250d97a7586e6541fbb3658081da877a01b92973` Request headers :path /myob/account/source/b2ZmaWNl.png pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT last-modified Tue, 21 Aug 2018 16:02:24 GMT server nginx/1.14.1 accept-ranges bytes content-length 61260 content-type image/png
GET H2	200	jquery.min.js Show response clinicabernardo.com.br/myob/account/source/	82 KB 34 KB	503ms 503ms	Script application/javascript	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/jquery.min.js Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515` Request headers :path /myob/account/source/jquery.min.js pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT content-encoding gzip last-modified Wed, 08 Aug 2018 22:32:26 GMT server nginx/1.14.1 content-type application/javascript
GET H2	200	velocity.min.js Show response clinicabernardo.com.br/myob/account/source/	34 KB 14 KB	379ms 378ms	Script application/javascript	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/velocity.min.js Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `5ce92f10d0930e0b3dce3467b111db4228ec429e3944a01b6fcc2c311dd572c4` Request headers :path /myob/account/source/velocity.min.js pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT content-encoding gzip last-modified Wed, 08 Aug 2018 22:32:48 GMT server nginx/1.14.1 content-type application/javascript
GET H2	200	velocity.ui.min.js Show response clinicabernardo.com.br/myob/account/source/	13 KB 3 KB	167ms 166ms	Script application/javascript	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/velocity.ui.min.js Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `c03012ba89bab46d98f7b14426e654f0658b3a92ea791e168323ade367025fd8` Request headers :path /myob/account/source/velocity.ui.min.js pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT content-encoding gzip last-modified Wed, 08 Aug 2018 22:33:32 GMT server nginx/1.14.1 content-type application/javascript
GET H2	200	index.js Show response clinicabernardo.com.br/myob/account/source/	293 B 319 B	502ms 501ms	Script application/javascript	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/index.js Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `79d9291f4498e16d8b6ea546d68f00c3129e7977d7b0e128f74c7220a99f3b02` Request headers :path /myob/account/source/index.js pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT content-encoding gzip last-modified Wed, 08 Aug 2018 03:46:12 GMT server nginx/1.14.1 content-type application/javascript
GET H2	200	comodo-ssl-certificates.png clinicabernardo.com.br/myob/account/source/	154 KB 154 KB	179ms 179ms	Image image/png	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Show image Full URL https://clinicabernardo.com.br/myob/account/source/comodo-ssl-certificates.png Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `e654bca6c010271d98fd8d8dbab4a7dfe7dfeb5a5d1c9e37c40c21532d7eb778` Request headers :path /myob/account/source/comodo-ssl-certificates.png pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT last-modified Thu, 10 May 2018 23:16:20 GMT server nginx/1.14.1 accept-ranges bytes content-length 157639 content-type image/png
GET H2	200	572056.jpg clinicabernardo.com.br/myob/account/source/	342 KB 342 KB	404ms 404ms	Image image/jpeg	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Show image Full URL https://clinicabernardo.com.br/myob/account/source/572056.jpg Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `41b911e772a2a7e503a2dffbf1cd29cd1e118098b7e78d59cadddf9556dba417` Request headers :path /myob/account/source/572056.jpg pragma no-cache accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/source/style.css :scheme https :method GET Referer https://clinicabernardo.com.br/myob/account/source/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT last-modified Wed, 08 Aug 2018 13:41:04 GMT server nginx/1.14.1 accept-ranges bytes content-length 350003 content-type image/jpeg
GET H2	200	SEGOEUI.TTF clinicabernardo.com.br/myob/account/source/	498 KB 499 KB	499ms 499ms	Font application/x-font-ttf	192.185.216.88 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://clinicabernardo.com.br/myob/account/source/SEGOEUI.TTF Requested by Host: clinicabernardo.com.br URL: https://clinicabernardo.com.br/myob/account/AuthCTN.php?LOB=RBGLogon&_pageLabel=67ea49ef0a574b38d0530c669c12b746 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.216.88 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS srv94-ip11.prodns.com.br Software nginx/1.14.1 / Resource Hash `9f006360948fbdcf8535e650f3ece264432b1c515b5d1f688dbecfb03cd83155` Request headers :path /myob/account/source/SEGOEUI.TTF pragma no-cache origin https://clinicabernardo.com.br accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority clinicabernardo.com.br referer https://clinicabernardo.com.br/myob/account/source/style.css :scheme https :method GET User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://clinicabernardo.com.br/myob/account/source/style.css Origin https://clinicabernardo.com.br Response headers status 200 date Wed, 16 Jan 2019 00:19:16 GMT last-modified Sat, 17 Sep 2016 07:30:34 GMT server nginx/1.14.1 accept-ranges bytes content-length 509920 content-type application/x-font-ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

clinicabernardo.com.br
mcbnv.com
192.185.216.88
2001:4860:4802:38::15
00662d26972be730b6e4b540dbc39aabf4b38bfe0837e25e0035ec23325f67f9
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
30e98fd6037c47ca5cee6044250d97a7586e6541fbb3658081da877a01b92973
41b911e772a2a7e503a2dffbf1cd29cd1e118098b7e78d59cadddf9556dba417
5ce92f10d0930e0b3dce3467b111db4228ec429e3944a01b6fcc2c311dd572c4
79d9291f4498e16d8b6ea546d68f00c3129e7977d7b0e128f74c7220a99f3b02
88663ce5f8395ff5f4b44ee90ab20049b9d3cda8947af7f56cddac812e071009
9f006360948fbdcf8535e650f3ece264432b1c515b5d1f688dbecfb03cd83155
b49b369406ef72288d987bc625ca2a31467a100316b01d6bf2dd964fe62e8b7c
b76ffbb2665f82b493e054b50d3d1bb3f2a8b4233be1795ca9937956eef196bc
b9381b9ce4117dbcf1e1bc7d19dbd142bb59db1d4b787301e20775f1c67a11d0
c03012ba89bab46d98f7b14426e654f0658b3a92ea791e168323ade367025fd8
c4a12c7572e6a4ee7c74d9933ed321df21b08e5575e6a6086042265c0455d48b
d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe
e35808b62166f8028f60b0099188e8b2f330a6b6e9f7d971c2ab268c088006dd
e654bca6c010271d98fd8d8dbab4a7dfe7dfeb5a5d1c9e37c40c21532d7eb778

clinicabernardo.com.br Open in urlscan Pro 192.185.216.88 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

1146 kBTransfer

1234 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

0 Cookies

Indicators

clinicabernardo.com.br Open in urlscan Pro
192.185.216.88 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

1146 kB
Transfer

1234 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!