promocaoincrivel.dns.army Open in urlscan Pro
157.230.2.21 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://97.74.91.240/home/
Effective URL:
https://promocaoincrivel.dns.army/br/login
Submission: On September 14 via manual (September 14th 2023, 7:29:11 pm UTC) from BR — Scanned from DE

Summary HTTP 8 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 157.230.2.21, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is promocaoincrivel.dns.army.
TLS certificate: Issued by R3 on September 7th 2023. Valid for: 3 months.

This is the only time promocaoincrivel.dns.army was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	97.74.91.240 97.74.91.240	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
8	157.230.2.21 157.230.2.21	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
8	2

1 97.74.91.240 (United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 240.91.74.97.host.secureserver.net

97.74.91.240	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 157.230.2.21 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

promocaoincrivel.dns.army	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	dns.army promocaoincrivel.dns.army	232 KB
8	1

	Domain	Requested by
8	promocaoincrivel.dns.army	promocaoincrivel.dns.army
8	1

This site contains links to these domains. Also see Links.

Domain
policies.google.com

Subject Issuer	Validity	Valid
promocaoincrivel.dns.army R3	`2023-09-07` - `2023-12-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://promocaoincrivel.dns.army/br/login
Frame ID: 3776F0249903C5D06A0C0FCEF88AC837
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Page URL History Show full URLs

http://97.74.91.240/home/ HTTP 302
https://promocaoincrivel.dns.army/ Page URL
https://promocaoincrivel.dns.army/br/login Page URL

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

232 kB
Transfer

249 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy
Title: Política de Privacidade

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Termos de Uso,

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://97.74.91.240/home/ HTTP 302
https://promocaoincrivel.dns.army/ Page URL
https://promocaoincrivel.dns.army/br/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://97.74.91.240/home/ HTTP 302
https://promocaoincrivel.dns.army/

8 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response promocaoincrivel.dns.army/ Redirect Chain http://97.74.91.240/home/ https://promocaoincrivel.dns.army/	163 B 403 B	634ms 287ms	Document text/html	157.230.2.21 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://promocaoincrivel.dns.army/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.230.2.21 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `3d8f0dad5061e2f160556401212af64d72049a463696c7700d61398d711a43d8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Length 151 Content-Type text/html; charset=UTF-8 Date Thu, 14 Sep 2023 19:29:04 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.41 (Ubuntu) Vary Accept-Encoding Redirect headers Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Thu, 14 Sep 2023 19:29:03 GMT Keep-Alive timeout=5, max=100 Location https://promocaoincrivel.dns.army/ Server Apache/2.4.41 (Ubuntu)
GET H/1.1	200 OK	Primary Request login Show response promocaoincrivel.dns.army/br/	12 KB 4 KB	183ms 182ms	Document text/html	157.230.2.21 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://promocaoincrivel.dns.army/br/login Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.230.2.21 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `24dd7473826bec14b2d9a6e8fae7df81afd5ecd921b6ce3a4304ae888af6b95f` Request headers Referer https://promocaoincrivel.dns.army/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Length 3465 Content-Type text/html; charset=UTF-8 Date Thu, 14 Sep 2023 19:29:04 GMT Keep-Alive timeout=5, max=99 Server Apache/2.4.41 (Ubuntu) Vary Accept-Encoding
GET H/1.1	200 OK	login.css promocaoincrivel.dns.army/css/	11 KB 3 KB	95ms 94ms	Stylesheet text/css	157.230.2.21 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://promocaoincrivel.dns.army/css/login.css Requested by Host: promocaoincrivel.dns.army URL: https://promocaoincrivel.dns.army/br/login Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.230.2.21 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `0414bb3b10bd0d04e8ab61e44b687a2fce1a93811cdd3e85ac4499d95f542511` Request headers accept-language de-DE,de;q=0.9 Referer https://promocaoincrivel.dns.army/br/login User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Response headers Date Thu, 14 Sep 2023 19:29:05 GMT Content-Encoding gzip Last-Modified Wed, 13 Sep 2023 11:26:02 GMT Server Apache/2.4.41 (Ubuntu) ETag "2d5e-6053bd3082680-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 3155
GET H/1.1	200 OK	stylesheet.css promocaoincrivel.dns.army/css/fonts/	642 B 509 B	189ms 94ms	Stylesheet text/css	157.230.2.21 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://promocaoincrivel.dns.army/css/fonts/stylesheet.css Requested by Host: promocaoincrivel.dns.army URL: https://promocaoincrivel.dns.army/br/login Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.230.2.21 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `3052a6c59d80b279074b5eb209ce0d90c7b2dbf954fe33999466cc85fcc973fb` Request headers accept-language de-DE,de;q=0.9 Referer https://promocaoincrivel.dns.army/br/login User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Response headers Date Thu, 14 Sep 2023 19:29:05 GMT Content-Encoding gzip Last-Modified Wed, 13 Sep 2023 11:26:06 GMT Server Apache/2.4.41 (Ubuntu) ETag "282-6053bd3452f80-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 174
GET H/1.1	200 OK	login.js Show response promocaoincrivel.dns.army/br/	3 KB 1 KB	262ms 92ms	Script application/javascript	157.230.2.21 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://promocaoincrivel.dns.army/br/login.js Requested by Host: promocaoincrivel.dns.army URL: https://promocaoincrivel.dns.army/br/login Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.230.2.21 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `4dfe15a24ef5e5be3d37bd98d97cf7d5fe99a6f5a8d5fa14b4dbea7597b822ad` Request headers accept-language de-DE,de;q=0.9 Referer https://promocaoincrivel.dns.army/br/login User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Response headers Date Thu, 14 Sep 2023 19:29:05 GMT Content-Encoding gzip Last-Modified Wed, 13 Sep 2023 11:25:59 GMT Server Apache/2.4.41 (Ubuntu) ETag "c22-6053bd2da5fc0-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 995
GET H/1.1	200 OK	portada-netflix.jpg promocaoincrivel.dns.army/source/img/	116 KB 116 KB	94ms 94ms	Image image/jpeg	157.230.2.21 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://promocaoincrivel.dns.army/source/img/portada-netflix.jpg Requested by Host: promocaoincrivel.dns.army URL: https://promocaoincrivel.dns.army/css/login.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.230.2.21 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `305d939700ded80bb4faf199ca9b8887938e005bd3d79a37abb3761b647e41b6` Request headers accept-language de-DE,de;q=0.9 Referer https://promocaoincrivel.dns.army/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Response headers Date Thu, 14 Sep 2023 19:29:05 GMT Last-Modified Wed, 13 Sep 2023 11:26:25 GMT Server Apache/2.4.41 (Ubuntu) ETag "1cfae-6053bd4671a40" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 118702
GET H/1.1	200 OK	NetflixSans_W_Rg.woff2 promocaoincrivel.dns.army/css/fonts/	52 KB 52 KB	97ms 92ms	Font font/woff2	157.230.2.21 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://promocaoincrivel.dns.army/css/fonts/NetflixSans_W_Rg.woff2 Requested by Host: promocaoincrivel.dns.army URL: https://promocaoincrivel.dns.army/css/fonts/stylesheet.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.230.2.21 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167` Request headers Referer https://promocaoincrivel.dns.army/css/fonts/stylesheet.css Origin https://promocaoincrivel.dns.army accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Response headers Date Thu, 14 Sep 2023 19:29:05 GMT Last-Modified Wed, 13 Sep 2023 11:26:05 GMT Server Apache/2.4.41 (Ubuntu) ETag "d038-6053bd335ed40" Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 53304
GET DATA	200 OK	truncated /	206 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `62b61eb224c8f3d42e76c39e08e383685a352a29bd28ecd0279454320e345349` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	NetflixSans_W_Bd.woff2 promocaoincrivel.dns.army/css/fonts/	54 KB 54 KB	171ms 91ms	Font font/woff2	157.230.2.21 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://promocaoincrivel.dns.army/css/fonts/NetflixSans_W_Bd.woff2 Requested by Host: promocaoincrivel.dns.army URL: https://promocaoincrivel.dns.army/css/fonts/stylesheet.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.230.2.21 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `6cc71e5053b6599423f3ba402e6e50c04907b9ba93c3211a56dd32e3a2e6cf4d` Request headers Referer https://promocaoincrivel.dns.army/css/fonts/stylesheet.css Origin https://promocaoincrivel.dns.army accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36 Response headers Date Thu, 14 Sep 2023 19:29:05 GMT Last-Modified Wed, 13 Sep 2023 11:26:04 GMT Server Apache/2.4.41 (Ubuntu) ETag "d7bc-6053bd326ab00" Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 55228

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

promocaoincrivel.dns.army
157.230.2.21
97.74.91.240
0414bb3b10bd0d04e8ab61e44b687a2fce1a93811cdd3e85ac4499d95f542511
24dd7473826bec14b2d9a6e8fae7df81afd5ecd921b6ce3a4304ae888af6b95f
3052a6c59d80b279074b5eb209ce0d90c7b2dbf954fe33999466cc85fcc973fb
305d939700ded80bb4faf199ca9b8887938e005bd3d79a37abb3761b647e41b6
3d8f0dad5061e2f160556401212af64d72049a463696c7700d61398d711a43d8
4dfe15a24ef5e5be3d37bd98d97cf7d5fe99a6f5a8d5fa14b4dbea7597b822ad
62b61eb224c8f3d42e76c39e08e383685a352a29bd28ecd0279454320e345349
6cc71e5053b6599423f3ba402e6e50c04907b9ba93c3211a56dd32e3a2e6cf4d
c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167

promocaoincrivel.dns.army Open in urlscan Pro 157.230.2.21 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

232 kBTransfer

249 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

promocaoincrivel.dns.army Open in urlscan Pro
157.230.2.21 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

232 kB
Transfer

249 kB
Size

0
Cookies

8 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!