urlscan.io logo urlscan.io
SecurityTrails logo

guestconnects-guestconnects-guestconnects.victorduarte.com.br Open in urlscan Pro
188.166.21.225  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=google.com.%2F%2F%2F%2Famp%2Fs%2F%E2%80%8Bma%C2%AD...
Effective URL: https://guestconnects-guestconnects-guestconnects.victorduarte.com.br/?777=c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%C3%A3%C2%80%C2%82
Submission Tags: falconsandbox
Submission: On September 04 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 4 countries across 5 domains to perform 3 HTTP transactions. The main IP is 188.166.21.225, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is guestconnects-guestconnects-guestconnects.victorduarte.com.br.
TLS certificate: Issued by E5 on August 30th 2024. Valid for: 3 months.
This is the only time guestconnects-guestconnects-guestconnects.victorduarte.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 2.19.126.82 20940 (AKAMAI-ASN1)
2 2 142.250.181.238 15169 (GOOGLE)
1 1 142.250.186.100 15169 (GOOGLE)
2 103.20.200.105 38719 (DREAMSCAP...)
1 188.166.21.225 14061 (DIGITALOC...)
3 3
1    2.19.126.82 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-19-126-82.deploy.static.akamaitechnologies.com
www.tiktok.com
2    142.250.181.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f14.1e100.net
google.com.
google.com
1    142.250.186.100 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f4.1e100.net
www.google.com
2    103.20.200.105 (Australia)

ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: server-2x-r65.ipv4.syd02.ds.network
magicknumbers.com.au
1    188.166.21.225 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
guestconnects-guestconnects-guestconnects.victorduarte.com.br
Apex Domain
Subdomains		 Transfer
2 magicknumbers.com.au
magicknumbers.com.au
204 B
2 google.com
google.com — Cisco Umbrella Rank: 1
www.google.com — Cisco Umbrella Rank: 10
47 B
1 victorduarte.com.br
guestconnects-guestconnects-guestconnects.victorduarte.com.br
109 KB
1 com.
google.com.
15 B
1 tiktok.com
www.tiktok.com — Cisco Umbrella Rank: 3787
3 KB
3 5
Domain Requested by
2 magicknumbers.com.au
1 guestconnects-guestconnects-guestconnects.victorduarte.com.br
1 www.google.com 1 redirects
1 google.com 1 redirects
1 google.com. 1 redirects
1 www.tiktok.com 1 redirects
3 6

This site contains no links.

Subject Issuer Validity Valid
magicknumbers.com.au
USERTrust RSA Domain Validation Secure Server CA		 2023-12-28 -
2025-01-27		 a year crt.sh
victorduarte.com.br
E5		 2024-08-30 -
2024-11-28		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://guestconnects-guestconnects-guestconnects.victorduarte.com.br/?777=c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%C3%A3%C2%80%C2%82
Frame ID: 16811D396E5964E3B2290F85F0E40C89
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

reCAPTCHA

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

3
IPs

4
Countries

109 kB
Transfer

269 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=google.com.%2F%2F%2F%2Famp%2Fs%2F%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu%2Fdayo%2Fffpxw%2Fc3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ%3D%3D%24%E3%80%82 HTTP 302
  • https://google.com.////amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82?safe=active HTTP 301
  • https://google.com/amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82?safe=active HTTP 301
  • https://www.google.com/amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82?safe=active HTTP 302
  • https://magicknumbers.com.au/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82
magicknumbers.com.au/dayo/ffpxw/
Redirect Chain
  • https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=google.com.%2F%2F%2F%2Famp%2Fs%2F%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu...
  • https://google.com.////amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82?safe=active
  • https://google.com/amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82?safe=active
  • https://www.google.com/amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82?safe=active
  • https://magicknumbers.com.au/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82
0
186 B 		Document
General
Check archive.org
Download Go to
Full URL
https://magicknumbers.com.au/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.20.200.105 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server-2x-r65.ipv4.syd02.ds.network
Software
Apache / PHP/5.6.40
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 04 Sep 2024 18:10:43 GMT
refresh
0;url=https://guestconnects-guestconnects-guestconnects.victorduarte.com.br/?777=c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$。
server
Apache
x-powered-by
PHP/5.6.40

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
302
content-security-policy
object-src 'none';base-uri 'self';script-src 'nonce-9W2tlti-ZJWJpAbC73jvUw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
content-type
text/html; charset=UTF-8
cross-origin-opener-policy
same-origin-allow-popups; report-to="gws"
date
Wed, 04 Sep 2024 18:10:42 GMT
location
https://​ma­gick­num­bers​.­c­o­m​.­a­u/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$。
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy
unload=()
report-to
{"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]}
server
gws
x-frame-options
SAMEORIGIN
x-robots-tag
noindex
x-xss-protection
0
Primary Request /
guestconnects-guestconnects-guestconnects.victorduarte.com.br/ 		229 KB
109 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://guestconnects-guestconnects-guestconnects.victorduarte.com.br/?777=c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%C3%A3%C2%80%C2%82
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
188.166.21.225 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
f7e76196c277465ea47e612485bf7a0076cfd5dde8f01770597c679aaf9edcc2

Request headers

Referer
https://magicknumbers.com.au/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 04 Sep 2024 18:10:43 GMT
server
nginx
vary
Accept-Encoding
favicon.ico
magicknumbers.com.au/ 		0
18 B 		Other
General
Check archive.org
Download Go to
Full URL
https://magicknumbers.com.au/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.20.200.105 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server-2x-r65.ipv4.syd02.ds.network
Software
Apache / PHP/5.6.40
Resource Hash

Request headers

Referer
https://magicknumbers.com.au/dayo/ffpxw/c3VwcG9ydEBkYXNoZmluYW5jaWFsLmNvbQ==$%E3%80%82
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 04 Sep 2024 18:10:43 GMT
server
Apache
x-powered-by
PHP/5.6.40
content-length
0
content-type
text/html; charset=UTF-8
truncated
/ 		858 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		40 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| a0k5 function| a0k4 function| onCheckBoxChange

1 Cookies

Domain/Path Name / Value
.google.com/ Name: __Secure-ENID
Value: 22.SE=IaOHOq9d_Yd3u3knPMfH2MxqJdS2isFiMHWIt7TfK1FTP2cxCO3oXqcc7QChvKMlzMqFai7-id_SkNz2sMmFnF88kH8i7HnUIgiQt_ebXctyTTI6R2JqJIefAP7JZRjaaRldv_C-Idw6li8m2Mgg12SxVnjB8rZx-2B6vGinw5FhLS5fN6AWKz7bJHCh