madeireirafarias.com.br

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 201.76.0.44, located in Ararangua, Brazil and belongs to Contato Internet EIRELI, BR. The main domain is madeireirafarias.com.br.

This is the only time madeireirafarias.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	201.76.0.44 201.76.0.44	28642 (Contato I...) (Contato Internet EIRELI)
2	207.99.43.42 207.99.43.42	8001 (NET-ACCES...) (NET-ACCESS-CORP - Net Access Corporation)
1	2.20.23.219 2.20.23.219	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	3

1 201.76.0.44 (Ararangua, Brazil)

ASN28642 (Contato Internet EIRELI, BR)
PTR: server.sispace.com.br

madeireirafarias.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 207.99.43.42 (Randolph, United States)

ASN8001 (NET-ACCESS-CORP - Net Access Corporation, US)

fs.afrcorp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.20.23.219 (European Union)

ASN20940 (AKAMAI-ASN1, US)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	afrcorp.com fs.afrcorp.com	205 KB
1	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	5 KB
1	madeireirafarias.com.br madeireirafarias.com.br	15 KB
4	3

	Domain	Requested by
2	fs.afrcorp.com	madeireirafarias.com.br
1	secure.aadcdn.microsoftonline-p.com	madeireirafarias.com.br
1	madeireirafarias.com.br
4	3

This site contains links to these domains. Also see Links.

Domain
www.afrcorp.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://madeireirafarias.com.br/engine/warwick.ac.uk.htm
Frame ID: DBA62D4A90EA175AC20F08FD9BECCF86
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

225 kB
Transfer

224 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.afrcorp.com/
Title: Home

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request warwick.ac.uk.htm Show response
madeireirafarias.com.br/engine/ 15 KB
15 KB 478ms
239ms Document
text/html 201.76.0.44
Contato Internet ...

General

Check archive.org

Show headers Download Go to

Full URL: http://madeireirafarias.com.br/engine/warwick.ac.uk.htm
Protocol: HTTP/1.1
Server: 201.76.0.44 Ararangua, Brazil, ASN28642 (Contato Internet EIRELI, BR),
Reverse DNS: server.sispace.com.br
Software: Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: ed6215761753d9b45dd8fa92a6cf704ec35d99009d2757efc6d3f4d96214679f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: madeireirafarias.com.br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 26 Apr 2018 18:13:00 GMT
Last-Modified: Thu, 26 Apr 2018 16:40:07 GMT
Server: Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "521a69-3a82-56ac30a457b3e"
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 14978

GET
H/1.1 200
OK style.css
fs.afrcorp.com/adfs/portal/css/ 8 KB
8 KB 117ms
116ms Stylesheet
text/css 207.99.43.42
Net Access Corpor...

General

Check archive.org

Show headers Download Go to

Full URL: https://fs.afrcorp.com/adfs/portal/css/style.css?id=D74D4D6943F32AE6F7F11D14D601DBB0E1A58919176EE512150366B6279AAF99
Requested by: Host: madeireirafarias.com.br
URL: http://madeireirafarias.com.br/engine/warwick.ac.uk.htm
Protocol: HTTP/1.1
Server: 207.99.43.42 Randolph, United States, ASN8001 (NET-ACCESS-CORP - Net Access Corporation, US),
Reverse DNS
Software: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: d74d4d6943f32ae6f7f11d14d601dbb0e1a58919176ee512150366b6279aaf99

Request headers

Referer: http://madeireirafarias.com.br/engine/warwick.ac.uk.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 26 Apr 2018 18:12:38 GMT
Expires: Sat, 26 May 2018 18:12:30 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: D74D4D6943F32AE6F7F11D14D601DBB0E1A58919176EE512150366B6279AAF99
Content-Length: 7812
Content-Type: text/css

GET
H/1.1 200
OK bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ 4 KB
5 KB 7ms
6ms Image
image/png 2.20.23.219
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/bannerlogo?ts=635974776182591704

Requested by

Host: madeireirafarias.com.br
URL: http://madeireirafarias.com.br/engine/warwick.ac.uk.htm

Protocol

HTTP/1.1

Server

2.20.23.219 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

/

Resource Hash

fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://madeireirafarias.com.br/engine/warwick.ac.uk.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 26 Apr 2018 18:13:03 GMT
Last-Modified: Thu, 26 Apr 2018 08:03:20 GMT
Content-MD5: nwmifU9ps1V8dDNXSinXJg==
Strict-Transport-Security: max-age=31536000
Content-Type: image\jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=52614
Connection: keep-alive
Content-Length: 4585

GET
H/1.1 200
OK illustration.jpg
fs.afrcorp.com/adfs/portal/illustration/ 197 KB
197 KB 124ms
123ms Image
image/jpg 207.99.43.42
Net Access Corpor...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fs.afrcorp.com/adfs/portal/illustration/illustration.jpg?id=6DD45E435A50E9B5F0D64D47B8CE299C5FD2856B646FD0D4F76C87518CC3D73B
Protocol: HTTP/1.1
Server: 207.99.43.42 Randolph, United States, ASN8001 (NET-ACCESS-CORP - Net Access Corporation, US),
Reverse DNS
Software: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 6dd45e435a50e9b5f0d64d47b8ce299c5fd2856b646fd0d4f76c87518cc3d73b

Request headers

Referer: http://madeireirafarias.com.br/engine/warwick.ac.uk.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 26 Apr 2018 18:12:38 GMT
Expires: Sat, 26 May 2018 18:12:30 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 6DD45E435A50E9B5F0D64D47B8CE299C5FD2856B646FD0D4F76C87518CC3D73B
Content-Length: 201636
Content-Type: image/jpg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fs.afrcorp.com
madeireirafarias.com.br
secure.aadcdn.microsoftonline-p.com
2.20.23.219
201.76.0.44
207.99.43.42
6dd45e435a50e9b5f0d64d47b8ce299c5fd2856b646fd0d4f76c87518cc3d73b
d74d4d6943f32ae6f7f11d14d601dbb0e1a58919176ee512150366b6279aaf99
ed6215761753d9b45dd8fa92a6cf704ec35d99009d2757efc6d3f4d96214679f
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

madeireirafarias.com.br Open in urlscan Pro 201.76.0.44 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

0 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

225 kBTransfer

224 kBSize

0 Cookies

1 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

madeireirafarias.com.br Open in urlscan Pro
201.76.0.44 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

225 kB
Transfer

224 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!