alianca-rs.com.br Open in urlscan Pro
2804:10:8001::209:5 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://addsuppadmin.hosted.phplist.com/
Effective URL:
https://alianca-rs.com.br/aruba-it/
Submission Tags: phishing malicious Search All
Submission: On August 29 via api (August 29th 2024, 6:24:56 pm UTC) from NL — Scanned from NL

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 16 HTTP transactions. The main IP is 2804:10:8001::209:5, located in Brazil and belongs to Cyberweb Networks Ltda, BR. The main domain is alianca-rs.com.br.
TLS certificate: Issued by R10 on August 8th 2024. Valid for: 3 months.

This is the only time alianca-rs.com.br was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	45.33.29.14 45.33.29.14	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1	13.33.216.139 13.33.216.139	16509 (AMAZON-02) (AMAZON-02)
2	2804:10:8001:... 2804:10:8001::209:5	28299 (Cyberweb ...) (Cyberweb Networks Ltda)
16	4

3 45.33.29.14 (Richardson, United States) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: aspen.phplist.com

addsuppadmin.hosted.phplist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.216.139 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-216-139.fra60.r.cloudfront.net

d3u7tsw7cvar0t.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2804:10:8001::209:5 (Brazil)

ASN28299 (Cyberweb Networks Ltda, BR)

alianca-rs.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	phplist.com 1 redirects addsuppadmin.hosted.phplist.com	12 KB
2	alianca-rs.com.br alianca-rs.com.br	2 KB
1	cloudfront.net d3u7tsw7cvar0t.cloudfront.net	3 KB
0	telegram.org Failed api.telegram.org Failed
16	4

	Domain	Requested by
3	addsuppadmin.hosted.phplist.com	1 redirects
2	alianca-rs.com.br	alianca-rs.com.br
1	d3u7tsw7cvar0t.cloudfront.net	addsuppadmin.hosted.phplist.com
0	api.telegram.org Failed	addsuppadmin.hosted.phplist.com
16	4

This site contains no links.

Subject Issuer	Validity	Valid
*.hosted.phplist.com R10	`2024-06-22` - `2024-09-20`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
alianca-rs.com.br R10	`2024-08-08` - `2024-11-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://alianca-rs.com.br/aruba-it/
Frame ID: 6FA7CC301A51C8B303442A7DA031072F
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://addsuppadmin.hosted.phplist.com/ HTTP 301
https://addsuppadmin.hosted.phplist.com/lists/ Page URL
https://alianca-rs.com.br/aruba-it/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

16
Requests

31 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

16 kB
Transfer

47 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://addsuppadmin.hosted.phplist.com/ HTTP 301
https://addsuppadmin.hosted.phplist.com/lists/ Page URL
https://alianca-rs.com.br/aruba-it/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://addsuppadmin.hosted.phplist.com/ HTTP 301
https://addsuppadmin.hosted.phplist.com/lists/

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ addsuppadmin.hosted.phplist.com/lists/ Redirect Chain https://addsuppadmin.hosted.phplist.com/ https://addsuppadmin.hosted.phplist.com/lists/	2 KB 1 KB	253ms 253ms	Document text/html	45.33.29.14 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://addsuppadmin.hosted.phplist.com/lists/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.33.29.14 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS aspen.phplist.com Software Apache/2.4.38 (Debian) / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers access-control-allow-origin * cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 1005 content-type text/html; charset=UTF-8 date Thu, 29 Aug 2024 18:24:51 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache/2.4.38 (Debian) vary Accept-Encoding Redirect headers content-length 351 content-type text/html; charset=iso-8859-1 date Thu, 29 Aug 2024 18:24:50 GMT location https://addsuppadmin.hosted.phplist.com/lists/ server Apache/2.4.38 (Debian)
GET		sendMessage api.telegram.org/bot7252495422:AAFjl4xgRFG45UwlrQb5gu0tgccYsxS7w/	0 0

GET H/1.1	200 OK	power-phplist.png d3u7tsw7cvar0t.cloudfront.net/images/3.6.12-hosted/	2 KB 3 KB	248ms 66ms	Image image/png	13.33.216.139 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d3u7tsw7cvar0t.cloudfront.net/images/3.6.12-hosted/power-phplist.png Requested by Host: addsuppadmin.hosted.phplist.com URL: https://addsuppadmin.hosted.phplist.com/lists/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.33.216.139 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-33-216-139.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Referer https://addsuppadmin.hosted.phplist.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Thu, 29 Aug 2024 07:40:22 GMT Via 1.1 ebf31a208b1563522327c20ddd946a5c.cloudfront.net (CloudFront) Last-Modified Sat, 24 Feb 2024 15:36:05 GMT Server AmazonS3 x-amz-meta-s3cmd-attrs atime:1675980402/ctime:1675980386/gid:123/gname:docker/md5:5021a64cdd02552a3eb08de5a9254fd6/mode:33188/mtime:1675980256/uid:1001/uname:runner X-Amz-Cf-Pop FRA60-P10 Age 38670 x-amz-server-side-encryption AES256 ETag "5021a64cdd02552a3eb08de5a9254fd6" X-Cache Hit from cloudfront Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 2135 X-Amz-Cf-Id AAqrVnfvQCCQOgOUJJsetdJWOHa7grD6r0vrS0TXgrJgqdGlH8OdkQ==
GET H2	200	Primary Request / Show response alianca-rs.com.br/aruba-it/	11 KB 2 KB	1519ms 205ms	Document text/html	2804:10:8001::209:5 Cyberweb Networks...
General Check archive.org Show headers Download Go to Full URL https://alianca-rs.com.br/aruba-it/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2804:10:8001::209:5 , Brazil, ASN28299 (Cyberweb Networks Ltda, BR), Reverse DNS Software Apache / Resource Hash `2c3ac04c5acd1caf07d1d725a30fa477f7de42413b82f3fb1fa5f42608d19c59` Request headers Referer https://addsuppadmin.hosted.phplist.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 max-age=1296000, public content-encoding gzip content-type text/html; charset=UTF-8 date Thu, 29 Aug 2024 18:24:53 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache securitas_enable_typing_info server Apache vary Accept-Encoding
GET H/1.1	200 OK	phplist.ico addsuppadmin.hosted.phplist.com/lists/images/	10 KB 10 KB	323ms 322ms	Other image/vnd.microsoft.icon	45.33.29.14 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://addsuppadmin.hosted.phplist.com/lists/images/phplist.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.33.29.14 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS aspen.phplist.com Software Apache/2.4.38 (Debian) / Resource Hash Request headers Referer https://addsuppadmin.hosted.phplist.com/lists/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Thu, 29 Aug 2024 18:24:51 GMT last-modified Wed, 15 Apr 2020 21:04:52 GMT server Apache/2.4.38 (Debian) accept-ranges bytes etag "27a1-5a35aaae3af1c" content-length 10145 content-type image/vnd.microsoft.icon
GET H2	200	bootstrap.min.css alianca-rs.com.br/aruba-it/assets/css/	22 KB 0	1045ms 1044ms	Stylesheet text/css	2804:10:8001::209:5 Cyberweb Networks...
General Check archive.org Show headers Download Go to Full URL https://alianca-rs.com.br/aruba-it/assets/css/bootstrap.min.css Requested by Host: alianca-rs.com.br URL: https://alianca-rs.com.br/aruba-it/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2804:10:8001::209:5 , Brazil, ASN28299 (Cyberweb Networks Ltda, BR), Reverse DNS Software Apache / Resource Hash Request headers Referer https://alianca-rs.com.br/aruba-it/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Thu, 29 Aug 2024 18:24:53 GMT last-modified Mon, 17 Jul 2023 16:42:12 GMT server Apache etag "260c5-600b17aefa100" content-type text/css cache-control max-age=1800 accept-ranges bytes content-length 155845 securitas_enable_typing_info
GET		style.css alianca-rs.com.br/aruba-it/assets/css/	0 0

GET		aruba_logo.svg alianca-rs.com.br/aruba-it/assets/images/	0 0

GET		logo.svg alianca-rs.com.br/aruba-it/assets/images/	0 0

GET		language_italian.svg alianca-rs.com.br/aruba-it/assets/images/	0 0

GET		icon_arrowhead_progressBar_next.svg alianca-rs.com.br/aruba-it/assets/images/	0 0

GET		icon_arrowhead_progressBar_now.svg alianca-rs.com.br/aruba-it/assets/images/	0 0

GET		icon_arrowhead_progressBar_finished.svg alianca-rs.com.br/aruba-it/assets/images/	0 0

GET		bootstrap.bundle.min.js alianca-rs.com.br/aruba-it/assets/js/	0 0

GET		jquery.js alianca-rs.com.br/aruba-it/assets/js/	0 0

GET		index.js alianca-rs.com.br/aruba-it/assets/js/pages/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.telegram.org
URL: https://api.telegram.org/bot7252495422:AAFjl4xgRFG45UwlrQb5gu0tgccYsxS7w/sendMessage?chat_id=-4520099893&text=%E2%9A%A1%EF%B8%8F(LOKA%20|

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/css/style.css

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/images/aruba_logo.svg

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/images/logo.svg

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/images/language_italian.svg

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/images/icon_arrowhead_progressBar_next.svg

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/images/icon_arrowhead_progressBar_now.svg

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/images/icon_arrowhead_progressBar_finished.svg

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/js/bootstrap.bundle.min.js

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/js/jquery.js

Domain: alianca-rs.com.br
URL: https://alianca-rs.com.br/aruba-it/assets/js/pages/index.js

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
addsuppadmin.hosted.phplist.com/	1969-12-31 23:59:59	Name: SERVERID Value: pqserver1\|ZtC89\|ZtC89
.phplist.com/	1969-12-31 23:59:59	Name: WebblerSession Value: cfh4prid0r6lt7lu807ar9mpvg
alianca-rs.com.br/	1969-12-31 23:59:59	Name: PHPSESSID Value: ecc4b24566256ee4b4e37a88a14eb294

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

addsuppadmin.hosted.phplist.com
alianca-rs.com.br
api.telegram.org
d3u7tsw7cvar0t.cloudfront.net
alianca-rs.com.br
api.telegram.org
13.33.216.139
2804:10:8001::209:5
45.33.29.14
2c3ac04c5acd1caf07d1d725a30fa477f7de42413b82f3fb1fa5f42608d19c59

alianca-rs.com.br Open in urlscan Pro 2804:10:8001::209:5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

31 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

16 kBTransfer

47 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

3 Cookies

Indicators

alianca-rs.com.br Open in urlscan Pro
2804:10:8001::209:5 Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

31 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

16 kB
Transfer

47 kB
Size

3
Cookies

16 HTTP transactions
0 data transactions