www.weyadvocacia.com.br Open in urlscan Pro
191.252.134.192 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/
Effective URL:
https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1...
Submission: On July 17 via automatic, source openphish (July 17th 2022, 1:34:23 pm UTC) — Scanned from DE

Summary HTTP 15 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 15 HTTP transactions. The main IP is 191.252.134.192, located in Brazil and belongs to Locaweb Servicos de Internet SA, BR. The main domain is www.weyadvocacia.com.br.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 10th 2022. Valid for: 3 months.

This is the only time www.weyadvocacia.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BIGLOBE (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 4	191.252.134.192 191.252.134.192	27715 (Locaweb S...) (Locaweb Servicos de Internet SA)
8	2406:da14:5ff... 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
15	4

4 191.252.134.192 (Brazil) 1 redirects

ASN27715 (Locaweb Servicos de Internet SA, BR)

www.weyadvocacia.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac (Tokyo, Japan)

ASN16509 (AMAZON-02, US)

webmail.biglobe.ne.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	biglobe.ne.jp webmail.biglobe.ne.jp member4.sso.biglobe.ne.jp Failed	96 KB
4	weyadvocacia.com.br 1 redirects www.weyadvocacia.com.br	11 KB
1	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 411	17 KB
0	bcdn.jp Failed top.bcdn.jp Failed
15	4

	Domain	Requested by
8	webmail.biglobe.ne.jp	www.weyadvocacia.com.br
4	www.weyadvocacia.com.br	1 redirects www.weyadvocacia.com.br
1	ssl.google-analytics.com	www.weyadvocacia.com.br
0	member4.sso.biglobe.ne.jp Failed	www.weyadvocacia.com.br
0	top.bcdn.jp Failed	www.weyadvocacia.com.br
15	5

This site contains links to these domains. Also see Links.

Domain
www.biglobe.ne.jp
webmail.biglobe.ne.jp
support.biglobe.ne.jp
email.biglobe.ne.jp
office.biglobe.ne.jp
www.biglobe.co.jp

Subject Issuer	Validity	Valid
weyadvocacia.com.br cPanel, Inc. Certification Authority	`2022-07-10` - `2022-10-08`	3 months	crt.sh
webmail.biglobe.ne.jp Amazon	`2021-12-21` - `2023-01-19`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 5DCA4ADF73F234B0D0CA1F89524CA5F6
Requests: 13 HTTP requests in this frame

Frame: https://member4.sso.biglobe.ne.jp/heute
Frame ID: E4478F4ADA142682B139116688C1102A
Requests: 1 HTTP requests in this frame

Frame: https://member4.sso.biglobe.ne.jp/webmail/advanced/firstview/del_suppress.html
Frame ID: 631AD65829BE2F8818CE8F681041084E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BIGLOBEメール　ログイン

Page URL History Show full URLs

http://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/ HTTP 301
https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/ Page URL
https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

\.aspx?(?:$|\?)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

80 %
HTTPS

67 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

124 kB
Transfer

150 kB
Size

0
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: http://www.biglobe.ne.jp/

Search URL Search Domain Scan URL

URL: https://webmail.biglobe.ne.jp/

Search URL Search Domain Scan URL

URL: http://support.biglobe.ne.jp/settei/webmail/login.html
Title: 詳細

Search URL Search Domain Scan URL

URL: https://email.biglobe.ne.jp/campaign/tukaiwake/?utm_source=webmail&utm_campaign=tukaiwake-info&utm_medium=text
Title: 使い分けアドレス初月無料キャンペーン（2021/8/2(月)～2021/9/30(木)）

Search URL Search Domain Scan URL

URL: https://support.biglobe.ne.jp/menteap/service.html#300014031
Title: メールサービスメンテナンス（2021/8/25）

Search URL Search Domain Scan URL

URL: https://support.biglobe.ne.jp/news/news680.html
Title: 【重要】BIGLOBEメール（Webメール）への電話認証導入と電話番号登録のお願い

Search URL Search Domain Scan URL

URL: https://support.biglobe.ne.jp/news/news550.html#a_faq1
Title: Webメールにログインが出来ない場合はこちらをご確認ください。

Search URL Search Domain Scan URL

URL: http://support.biglobe.ne.jp/jimu/idpw/index.html
Title: ID・パスワードを忘れた（個人会員）

Search URL Search Domain Scan URL

URL: http://office.biglobe.ne.jp/kentou/office/faq.html
Title: ID・パスワードを忘れた（法人会員）

Search URL Search Domain Scan URL

URL: https://webmail.biglobe.ne.jp/help.html
Title: ヘルプ

Search URL Search Domain Scan URL

URL: https://webmail.biglobe.ne.jp/faq.html
Title: よくあるお問い合わせ

Search URL Search Domain Scan URL

URL: http://email.biglobe.ne.jp/
Title: メールサービス

Search URL Search Domain Scan URL

URL: http://support.biglobe.ne.jp/shogaiap/service.html
Title: 障害情報

Search URL Search Domain Scan URL

URL: https://www.biglobe.co.jp/
Title: 会社概要

Search URL Search Domain Scan URL

URL: https://www.biglobe.ne.jp/privacy.html
Title: 個人情報保護ポリシー

Search URL Search Domain Scan URL

URL: https://www.biglobe.ne.jp/cookie.html
Title: Cookieポリシー

Search URL Search Domain Scan URL

URL: https://support.biglobe.ne.jp/safesecurity/
Title: 安心・安全

Search URL Search Domain Scan URL

URL: https://www.biglobe.ne.jp/
Title: BIGLOBEトップ

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/ HTTP 301
https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/ Page URL
https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/ HTTP 301
https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/
Redirect Chain

http://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/
https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/

395 B
609 B

1572ms
1085ms

Document
text/html

191.252.134.192
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 191.252.134.192 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS
Software: Apache /
Resource Hash: b06a13974a96850f6b3d473bfd42cae4dada20b781908aff56ddb739f07aa2df

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Sun, 17 Jul 2022 13:34:18 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

Redirect headers

Connection: Keep-Alive
Content-Length: 283
Content-Type: text/html; charset=iso-8859-1
Date: Sun, 17 Jul 2022 13:34:17 GMT
Keep-Alive: timeout=5, max=100
Location: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/
Server: Apache

GET
H/1.1 200
OK Primary Request wk4qz9cfvj1ya6mkqgee20kg.php Show response
www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/ 10 KB
10 KB 613ms
613ms Document
text/html 191.252.134.192
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 191.252.134.192 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS
Software: Apache /
Resource Hash: 34139c7ee5bf4f652ebf32f7b2d286f8d28e4d6c1506e4fa3de68c7b4db36b63

Request headers

Referer: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Sun, 17 Jul 2022 13:34:19 GMT
Keep-Alive: timeout=5, max=99
Server: Apache
Transfer-Encoding: chunked

GET
H2 200 base02_and.css
webmail.biglobe.ne.jp/mobile/css/ 15 KB
15 KB 1104ms
243ms Stylesheet
text/css 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://webmail.biglobe.ne.jp/mobile/css/base02_and.css
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: e1838e972a0860eeabe922ad57f89189df0ecc21e8def514bdad616e7daa9e26

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 17 Jul 2022 13:34:21 GMT
cache-control: no-store
last-modified: Fri, 11 Nov 2011 08:41:44 GMT
server: Apache
accept-ranges: bytes
content-length: 15026
content-type: text/css

GET
H2 200 global_and.css
webmail.biglobe.ne.jp/mobile/css/ 18 KB
18 KB 1345ms
485ms Stylesheet
text/css 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://webmail.biglobe.ne.jp/mobile/css/global_and.css
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: a66313d478d9a89bae72f3b66740bb5cc54716dd56ffce4d0fed631f60461394

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 17 Jul 2022 13:34:21 GMT
cache-control: no-store
last-modified: Mon, 01 Jun 2015 02:19:22 GMT
server: Apache
accept-ranges: bytes
content-length: 18049
content-type: text/css

GET
H2 200 info.css
webmail.biglobe.ne.jp/mobile/css/ 102 B
248 B 1825ms
966ms Stylesheet
text/css 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://webmail.biglobe.ne.jp/mobile/css/info.css
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: 1be62ee1373b2feb21b1459288cd92754d29d7c3ccb008134b8538890bb98285

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 17 Jul 2022 13:34:21 GMT
cache-control: no-store
last-modified: Fri, 11 Nov 2011 08:41:44 GMT
server: Apache
accept-ranges: bytes
content-length: 102
content-type: text/css

GET
H2 200 jquery.js Show response
webmail.biglobe.ne.jp/mobile/js/ 54 KB
55 KB 1345ms
485ms Script
application/javascript 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://webmail.biglobe.ne.jp/mobile/js/jquery.js
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: d548530775a6286f49ba66e0715876b4ec5985966b0291c21568fecfc4178e8d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 17 Jul 2022 13:34:21 GMT
cache-control: no-store
last-modified: Fri, 11 Nov 2011 08:41:44 GMT
server: Apache
accept-ranges: bytes
content-length: 55774
content-type: application/javascript

GET
H2 200 change_page.js Show response
webmail.biglobe.ne.jp/mobile/js/ 987 B
1 KB 1825ms
966ms Script
application/javascript 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://webmail.biglobe.ne.jp/mobile/js/change_page.js
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: 17e2209013efcb0ba23e308fc97195b4fc2bda818447de16e90bd1fc05364498

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 17 Jul 2022 13:34:21 GMT
cache-control: no-store
last-modified: Fri, 11 Nov 2011 08:41:44 GMT
server: Apache
accept-ranges: bytes
content-length: 987
content-type: application/javascript

GET
H/1.1 404
Not Found input_time_chk.js
www.weyadvocacia.com.br/api/js/ 0
0 832ms
831ms Script
text/html 191.252.134.192
Locaweb Servicos ...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.weyadvocacia.com.br/api/js/input_time_chk.js
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 191.252.134.192 , Brazil, ASN27715 (Locaweb Servicos de Internet SA, BR),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 17 Jul 2022 13:34:20 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 logo_email_mb.gif
webmail.biglobe.ne.jp/images2/common/ 2 KB
2 KB 245ms
245ms Image
image/gif 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://webmail.biglobe.ne.jp/images2/common/logo_email_mb.gif
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: a4529c44c823be47ebb2d35dc9d12f227c966a1401b7351379382e8a2262a026

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 17 Jul 2022 13:34:21 GMT
cache-control: no-store
last-modified: Thu, 21 Sep 2017 07:47:30 GMT
server: Apache
accept-ranges: bytes
content-length: 2223
content-type: image/gif

GET
H2 200 button_03.gif
webmail.biglobe.ne.jp/mobile/images/ 4 KB
4 KB 246ms
245ms Image
image/gif 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://webmail.biglobe.ne.jp/mobile/images/button_03.gif
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: 6f47d8cbeebfb58186a00fad67c829cb96e9b5a389850e08ef6a472ae3822521

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 17 Jul 2022 13:34:22 GMT
cache-control: no-store
last-modified: Fri, 11 Nov 2011 08:41:44 GMT
server: Apache
accept-ranges: bytes
content-length: 4059
content-type: image/gif

GET
H2 200 c31a2fc863.js Show response
webmail.biglobe.ne.jp/blog/ 342 B
498 B 247ms
247ms Script
application/javascript 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://webmail.biglobe.ne.jp/blog/c31a2fc863.js
Requested by: Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: 759b1b9e6dc66f114fe61e0a384327b6dfc7ccaa40dad73a474168ca644e1f61

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 17 Jul 2022 13:34:21 GMT
cache-control: no-store
last-modified: Mon, 21 May 2018 00:20:27 GMT
server: Apache
accept-ranges: bytes
content-length: 342
content-type: application/javascript

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 123ms
37ms Script
text/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.weyadvocacia.com.br
URL: https://www.weyadvocacia.com.br/cmd-login=e5252c7fc60f2701c2555c99694aca59/wk4qz9cfvj1ya6mkqgee20kg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.weyadvocacia.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 6197
date: Sun, 17 Jul 2022 11:51:04 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Sun, 17 Jul 2022 13:51:04 GMT

GET rtms.js
top.bcdn.jp/j/ft_rtms/ 0
0

GET heute
member4.sso.biglobe.ne.jp/ Frame E447 0
0

GET del_suppress.html
member4.sso.biglobe.ne.jp/webmail/advanced/firstview/ Frame 631A 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: top.bcdn.jp
URL: https://top.bcdn.jp/j/ft_rtms/rtms.js?19190

Domain: member4.sso.biglobe.ne.jp
URL: https://member4.sso.biglobe.ne.jp/heute

Domain: member4.sso.biglobe.ne.jp
URL: https://member4.sso.biglobe.ne.jp/webmail/advanced/firstview/del_suppress.html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BIGLOBE (Telecommunication)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.weyadvocacia.com.br/api/js/input_time_chk.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

member4.sso.biglobe.ne.jp
ssl.google-analytics.com
top.bcdn.jp
webmail.biglobe.ne.jp
www.weyadvocacia.com.br
member4.sso.biglobe.ne.jp
top.bcdn.jp
191.252.134.192
2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
2a00:1450:4001:806::2008
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
17e2209013efcb0ba23e308fc97195b4fc2bda818447de16e90bd1fc05364498
1be62ee1373b2feb21b1459288cd92754d29d7c3ccb008134b8538890bb98285
34139c7ee5bf4f652ebf32f7b2d286f8d28e4d6c1506e4fa3de68c7b4db36b63
6f47d8cbeebfb58186a00fad67c829cb96e9b5a389850e08ef6a472ae3822521
759b1b9e6dc66f114fe61e0a384327b6dfc7ccaa40dad73a474168ca644e1f61
a4529c44c823be47ebb2d35dc9d12f227c966a1401b7351379382e8a2262a026
a66313d478d9a89bae72f3b66740bb5cc54716dd56ffce4d0fed631f60461394
b06a13974a96850f6b3d473bfd42cae4dada20b781908aff56ddb739f07aa2df
d548530775a6286f49ba66e0715876b4ec5985966b0291c21568fecfc4178e8d
e1838e972a0860eeabe922ad57f89189df0ecc21e8def514bdad616e7daa9e26

www.weyadvocacia.com.br Open in urlscan Pro 191.252.134.192 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

80 %HTTPS

67 %IPv6

4 Domains

5 Subdomains

4 IPs

3 Countries

124 kBTransfer

150 kBSize

0 Cookies

18 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.weyadvocacia.com.br Open in urlscan Pro
191.252.134.192 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

80 %
HTTPS

67 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

124 kB
Transfer

150 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!