urlscan.io logo urlscan.io
SecurityTrails logo

autonortecorrientes.com.ar Open in urlscan Pro
200.68.125.222  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/signin.php
Submission: On April 25 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 200.68.125.222, located in Buenos Aires, Argentina and belongs to NSS S.A., AR. The main domain is autonortecorrientes.com.ar.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on March 9th 2021. Valid for: 3 months.
This is the only time autonortecorrientes.com.ar was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
5 200.68.125.222 16814 (NSS S.A.)
5 1
Apex Domain
Subdomains		 Transfer
5 autonortecorrientes.com.ar
autonortecorrientes.com.ar
173 KB
5 1
Domain Requested by
5 autonortecorrientes.com.ar autonortecorrientes.com.ar
5 1

This site contains no links.

Subject Issuer Validity Valid
www.autonortecorrientes.com.ar
ZeroSSL RSA Domain Secure Site CA		 2021-03-09 -
2021-06-07		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/signin.php
Frame ID: 7E5318778C61A70221236D7BD4859F99
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

173 kB
Transfer

247 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request signin.php
autonortecorrientes.com.ar/wp-content/languages/themes/tch/ 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/signin.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
200.68.125.222 Buenos Aires, Argentina, ASN16814 (NSS S.A., AR),
Reverse DNS
mail.imtech.com.ar
Software
Apache /
Resource Hash
c14cd3a63de4624b3ef00d6664b9ecb456bdffb098088a7ecc0e045db90eb2e6
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains

Request headers

Host
autonortecorrientes.com.ar
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 25 Apr 2021 13:28:28 GMT
Server
Apache
Strict-Transport-Security
max-age=0; includeSubDomains
Accept-Ranges
none
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1589
Connection
close
Content-Type
text/html; charset=UTF-8
css.css
autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/ 		84 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/css.css
Requested by
Host: autonortecorrientes.com.ar
URL: https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/signin.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
200.68.125.222 Buenos Aires, Argentina, ASN16814 (NSS S.A., AR),
Reverse DNS
mail.imtech.com.ar
Software
Apache /
Resource Hash
5aaab1b70e6a1a14a15d1b40c097895b464f0ae87f412da6e53dc9514e7bf83f
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
autonortecorrientes.com.ar
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/signin.php
Connection
keep-alive
Referer
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/signin.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 25 Apr 2021 13:28:28 GMT
Content-Encoding
gzip
Last-Modified
Sat, 24 Apr 2021 00:02:29 GMT
Server
Apache
Vary
Accept-Encoding
Strict-Transport-Security
max-age=0; includeSubDomains
Content-Type
text/css
Connection
close
Accept-Ranges
none
Content-Length
13224
FB-f-Logo__blue_57.png
autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/FB-f-Logo__blue_57.png
Requested by
Host: autonortecorrientes.com.ar
URL: https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/signin.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
200.68.125.222 Buenos Aires, Argentina, ASN16814 (NSS S.A., AR),
Reverse DNS
mail.imtech.com.ar
Software
Apache /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
autonortecorrientes.com.ar
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/signin.php
Connection
keep-alive
Referer
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/signin.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 25 Apr 2021 13:28:29 GMT
Last-Modified
Sat, 24 Apr 2021 00:02:29 GMT
Server
Apache
ETag
"5af-5c0aca0dc6c0e"
Strict-Transport-Security
max-age=0; includeSubDomains
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
1455
login-the-crown_2-1500x1000.jpg
autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/ 		84 KB
84 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/login-the-crown_2-1500x1000.jpg
Requested by
Host: autonortecorrientes.com.ar
URL: https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/css.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
200.68.125.222 Buenos Aires, Argentina, ASN16814 (NSS S.A., AR),
Reverse DNS
mail.imtech.com.ar
Software
Apache /
Resource Hash
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
autonortecorrientes.com.ar
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/css.css
Connection
keep-alive
Referer
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/css.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 25 Apr 2021 13:28:29 GMT
Last-Modified
Sat, 24 Apr 2021 00:02:29 GMT
Server
Apache
ETag
"150d2-5c0aca0dc8b4e"
Strict-Transport-Security
max-age=0; includeSubDomains
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
86226
nf-icon-v1-93.woff
autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/fonts/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/fonts/nf-icon-v1-93.woff
Requested by
Host: autonortecorrientes.com.ar
URL: https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/css.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
200.68.125.222 Buenos Aires, Argentina, ASN16814 (NSS S.A., AR),
Reverse DNS
mail.imtech.com.ar
Software
Apache /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Origin
https://autonortecorrientes.com.ar
Accept-Encoding
gzip, deflate, br
Host
autonortecorrientes.com.ar
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
font
Referer
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/css.css
Connection
keep-alive
Origin
https://autonortecorrientes.com.ar
Referer
https://autonortecorrientes.com.ar/wp-content/languages/themes/tch/img/css.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 25 Apr 2021 13:28:28 GMT
Last-Modified
Sat, 24 Apr 2021 00:02:29 GMT
Server
Apache
ETag
"11f64-5c0aca0dc8b4e"
Strict-Transport-Security
max-age=0; includeSubDomains
Content-Type
application/font-woff
Connection
close
Accept-Ranges
bytes
Content-Length
73572

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0; includeSubDomains