panamericanlatino.com Open in urlscan Pro
92.204.145.206 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://maistechinfo.com/wp-admin/-ovo
Effective URL:
https://panamericanlatino.com/-pos/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJL...
Submission: On February 13 via automatic, source phishtank (February 13th 2023, 10:37:26 pm UTC) — Scanned from DE

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 92.204.145.206, located in Wolf Trap, United States and belongs to GO-DADDY-COM-LLC, US. The main domain is panamericanlatino.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 16th 2023. Valid for: a year.

This is the only time panamericanlatino.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Postale (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 2	149.18.50.22 149.18.50.22	53107 (EVEO Serv...) (EVEO Servicos de Internet Ltda.)
1 2	202.14.92.90 202.14.92.90	55680 (KSI-UAJY-...) (KSI-UAJY-AS-ID Kantor Sistem Informasi Universitas Atma Jaya Yogyakarta)
2 4	92.204.145.206 92.204.145.206	398108 (GO-DADDY-...) (GO-DADDY-COM-LLC)
4	4

2 149.18.50.22 (Goiânia, Brazil) 1 redirects

ASN53107 (EVEO Servicos de Internet Ltda., BR)
PTR: sd09.mellivoracode.com

maistechinfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 202.14.92.90 (Indonesia) 1 redirects

ASN55680 (KSI-UAJY-AS-ID Kantor Sistem Informasi Universitas Atma Jaya Yogyakarta, ID)
PTR: ip-90-92-net.uajy.ac.id

inisiasifti.uajy.ac.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 92.204.145.206 (Wolf Trap, United States) 2 redirects

ASN398108 (GO-DADDY-COM-LLC, US)
PTR: ns1016030.ip-92-204-145.us

panamericanlatino.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	panamericanlatino.com 2 redirects panamericanlatino.com	1 MB
2	uajy.ac.id 1 redirects inisiasifti.uajy.ac.id	675 B
2	maistechinfo.com 1 redirects maistechinfo.com	501 B
4	3

	Domain	Requested by
4	panamericanlatino.com	2 redirects panamericanlatino.com
2	inisiasifti.uajy.ac.id	1 redirects
2	maistechinfo.com	1 redirects
4	3

This site contains no links.

Subject Issuer	Validity	Valid
www.maistechinfo.com R3	`2023-01-14` - `2023-04-14`	3 months	crt.sh
*.uajy.ac.id Sectigo RSA Domain Validation Secure Server CA	`2022-11-02` - `2023-12-02`	a year	crt.sh
panamericanlatino.com Sectigo RSA Domain Validation Secure Server CA	`2023-01-16` - `2024-01-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://panamericanlatino.com/-pos/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjU0ODEuNzcgU2FmYXJpLzUzNy4zNjIxNy4xMTQuMjE4LjI4MjAyMzpGZWI6TW9u
Frame ID: F43C0C9BEFB7A818BEFE135D8B503078
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Espace client - La Banque Postale

Page URL History Show full URLs

https://maistechinfo.com/wp-admin/-ovo HTTP 301
https://maistechinfo.com/wp-admin/-ovo/ Page URL
https://inisiasifti.uajy.ac.id/-rudu HTTP 301
https://inisiasifti.uajy.ac.id/-rudu/ Page URL
https://panamericanlatino.com/-pos/pos HTTP 301
https://panamericanlatino.com/-pos/pos/ HTTP 302
https://panamericanlatino.com/-pos/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

1943 kB
Transfer

1962 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://maistechinfo.com/wp-admin/-ovo HTTP 301
https://maistechinfo.com/wp-admin/-ovo/ Page URL
https://inisiasifti.uajy.ac.id/-rudu HTTP 301
https://inisiasifti.uajy.ac.id/-rudu/ Page URL
https://panamericanlatino.com/-pos/pos HTTP 301
https://panamericanlatino.com/-pos/pos/ HTTP 302
https://panamericanlatino.com/-pos/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjU0ODEuNzcgU2FmYXJpLzUzNy4zNjIxNy4xMTQuMjE4LjI4MjAyMzpGZWI6TW9u Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://maistechinfo.com/wp-admin/-ovo HTTP 301
https://maistechinfo.com/wp-admin/-ovo/

Request Chain 1

https://inisiasifti.uajy.ac.id/-rudu HTTP 301
https://inisiasifti.uajy.ac.id/-rudu/

4 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response maistechinfo.com/wp-admin/-ovo/ Redirect Chain https://maistechinfo.com/wp-admin/-ovo https://maistechinfo.com/wp-admin/-ovo/	174 B 260 B	273ms 272ms	Document text/html	149.18.50.22 EVEO Servicos de ...
General Check archive.org Show headers Download Go to Full URL https://maistechinfo.com/wp-admin/-ovo/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 149.18.50.22 Goiânia, Brazil, ASN53107 (EVEO Servicos de Internet Ltda., BR), Reverse DNS sd09.mellivoracode.com Software LiteSpeed / Resource Hash `019abca1b6b268c8f458991b4066a7e90f2ed6c5ba9c3a3d8fd6bce303f60cb1` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes content-length 174 content-type text/html date Mon, 13 Feb 2023 18:01:48 GMT etag "ae-63d319e0-9fec2f4f8637f37b;;;" last-modified Fri, 27 Jan 2023 00:25:04 GMT server LiteSpeed vary User-Agent Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 707 content-type text/html date Mon, 13 Feb 2023 18:01:48 GMT location https://maistechinfo.com/wp-admin/-ovo/ server LiteSpeed vary User-Agent
GET H/1.1	200 OK	/ Show response inisiasifti.uajy.ac.id/-rudu/ Redirect Chain https://inisiasifti.uajy.ac.id/-rudu https://inisiasifti.uajy.ac.id/-rudu/	176 B 417 B	202ms 202ms	Document text/html	202.14.92.90 KSI-UAJY-AS-ID Ka...
General Check archive.org Show headers Download Go to Full URL https://inisiasifti.uajy.ac.id/-rudu/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 202.14.92.90 , Indonesia, ASN55680 (KSI-UAJY-AS-ID Kantor Sistem Informasi Universitas Atma Jaya Yogyakarta, ID), Reverse DNS ip-90-92-net.uajy.ac.id Software Apache / Resource Hash `8db3bb19c64b6b8b47819bed005d054add2a27a6599374aa1bbd801625cc20f7` Request headers Referer https://maistechinfo.com/wp-admin/-ovo/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 176 Content-Type text/html Date Mon, 13 Feb 2023 22:37:22 GMT Keep-Alive timeout=5, max=99 Last-Modified Mon, 13 Feb 2023 05:08:21 GMT Server Apache Redirect headers Connection Keep-Alive Content-Length 245 Content-Type text/html; charset=iso-8859-1 Date Mon, 13 Feb 2023 22:37:22 GMT Keep-Alive timeout=5, max=100 Location https://inisiasifti.uajy.ac.id/-rudu/ Server Apache
GET H/1.1	200 OK	Primary Request pstl-log.php Show response panamericanlatino.com/-pos/pos/ Redirect Chain https://panamericanlatino.com/-pos/pos https://panamericanlatino.com/-pos/pos/ https://panamericanlatino.com/-pos/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjU0ODEuNzcgU2F...	1 MB 1 MB	301ms 301ms	Document text/html	92.204.145.206 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Full URL https://panamericanlatino.com/-pos/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjU0ODEuNzcgU2FmYXJpLzUzNy4zNjIxNy4xMTQuMjE4LjI4MjAyMzpGZWI6TW9u Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.204.145.206 Wolf Trap, United States, ASN398108 (GO-DADDY-COM-LLC, US), Reverse DNS ns1016030.ip-92-204-145.us Software Apache / Resource Hash `44e99f9662f85f07842d6a4a08c6ae911cb34a2bab352fa381b1c975a0bcc7b1` Request headers Referer https://inisiasifti.uajy.ac.id/-rudu/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 13 Feb 2023 22:37:24 GMT Keep-Alive timeout=5, max=98 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 13 Feb 2023 22:37:23 GMT Keep-Alive timeout=5, max=99 Server Apache Transfer-Encoding chunked location pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjU0ODEuNzcgU2FmYXJpLzUzNy4zNjIxNy4xMTQuMjE4LjI4MjAyMzpGZWI6TW9u
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6153992e4fe15daa0a730f0295eb2cebfe6f97d671fcbc7b4aae635d8f17a63a` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	302 KB 302 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e` Request headers Referer Origin https://panamericanlatino.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	302 KB 302 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e` Request headers Referer Origin https://panamericanlatino.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	336 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1a5627a97aa8d55f0866a282ca1d226bf320f6f4aed2aeb76936f84460760318` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	10 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a079710e67a906296308d3f4e23f6e8a1bfb326e926af1cf4feeec723c8d4674` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	jquery.min.js Show response panamericanlatino.com/-pos/pos/Pstl_files/	86 KB 86 KB	110ms 110ms	Script application/javascript	92.204.145.206 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Full URL https://panamericanlatino.com/-pos/pos/Pstl_files/jquery.min.js Requested by Host: panamericanlatino.com URL: https://panamericanlatino.com/-pos/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjU0ODEuNzcgU2FmYXJpLzUzNy4zNjIxNy4xMTQuMjE4LjI4MjAyMzpGZWI6TW9u Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.204.145.206 Wolf Trap, United States, ASN398108 (GO-DADDY-COM-LLC, US), Reverse DNS ns1016030.ip-92-204-145.us Software Apache / Resource Hash `2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a` Request headers accept-language de-DE,de;q=0.9 Referer https://panamericanlatino.com/-pos/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjU0ODEuNzcgU2FmYXJpLzUzNy4zNjIxNy4xMTQuMjE4LjI4MjAyMzpGZWI6TW9u User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36 Response headers Date Mon, 13 Feb 2023 22:37:25 GMT Last-Modified Sun, 12 Feb 2023 14:16:38 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 88145

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Postale (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

inisiasifti.uajy.ac.id
maistechinfo.com
panamericanlatino.com
149.18.50.22
202.14.92.90
92.204.145.206
019abca1b6b268c8f458991b4066a7e90f2ed6c5ba9c3a3d8fd6bce303f60cb1
0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e
1a5627a97aa8d55f0866a282ca1d226bf320f6f4aed2aeb76936f84460760318
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
44e99f9662f85f07842d6a4a08c6ae911cb34a2bab352fa381b1c975a0bcc7b1
5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e
6153992e4fe15daa0a730f0295eb2cebfe6f97d671fcbc7b4aae635d8f17a63a
6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a
8db3bb19c64b6b8b47819bed005d054add2a27a6599374aa1bbd801625cc20f7
a079710e67a906296308d3f4e23f6e8a1bfb326e926af1cf4feeec723c8d4674

panamericanlatino.com Open in urlscan Pro 92.204.145.206 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

1943 kBTransfer

1962 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

panamericanlatino.com Open in urlscan Pro
92.204.145.206 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

1943 kB
Transfer

1962 kB
Size

0
Cookies

4 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!