smithbrothers.com.br Open in urlscan Pro
108.179.252.154 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://smithbrothers.com.br/wp-includes/apple/adminnew
Effective URL:
http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php
Submission: On February 24 via manual (February 24th 2022, 7:09:33 pm UTC) from AT — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 16 HTTP transactions. The main IP is 108.179.252.154, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is smithbrothers.com.br.

This is the only time smithbrothers.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 3	108.179.252.154 108.179.252.154	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
13	52.216.145.203 52.216.145.203	16509 (AMAZON-02) (AMAZON-02)
2	2a06:98c1:312... 2a06:98c1:3121::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	4

3 108.179.252.154 (United States) 2 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: br528-ip05.hostgator.com.br

smithbrothers.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 52.216.145.203 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

g0t.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3121::7 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	amazonaws.com g0t.s3.amazonaws.com	743 KB
3	smithbrothers.com.br 2 redirects smithbrothers.com.br	115 KB
2	fontawesome.com ka-f.fontawesome.com — Cisco Umbrella Rank: 2933	18 KB
16	3

	Domain	Requested by
13	g0t.s3.amazonaws.com	smithbrothers.com.br
3	smithbrothers.com.br	2 redirects
2	ka-f.fontawesome.com	g0t.s3.amazonaws.com
16	3

This site contains no links.

Subject Issuer	Validity	Valid
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-12-13` - `2022-12-13`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-12` - `2022-09-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php
Frame ID: BB3932EA1325C0A0FA1289EF6F3EC884
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

http://smithbrothers.com.br/wp-includes/apple/adminnew HTTP 301
http://smithbrothers.com.br/wp-includes/apple/adminnew/ HTTP 302
http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

94 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

875 kB
Transfer

1111 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://smithbrothers.com.br/wp-includes/apple/adminnew HTTP 301
http://smithbrothers.com.br/wp-includes/apple/adminnew/ HTTP 302
http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request ind3x.php Show response smithbrothers.com.br/wp-includes/apple/adminnew/ Redirect Chain http://smithbrothers.com.br/wp-includes/apple/adminnew http://smithbrothers.com.br/wp-includes/apple/adminnew/ http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php	279 KB 114 KB	481ms 480ms	Document text/html	108.179.252.154 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Server 108.179.252.154 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS br528-ip05.hostgator.com.br Software nginx/1.19.10 / Resource Hash `61bb74cd5180e81d9942b35dbdd129c5a1ef45a60324b0b0ee41dc2f94c694fa` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Thu, 24 Feb 2022 19:09:26 GMT Server nginx/1.19.10 Content-Type text/html; charset=UTF-8 Vary Accept-Encoding Content-Encoding gzip X-Server-Cache false Transfer-Encoding chunked Redirect headers Date Thu, 24 Feb 2022 19:09:26 GMT Server nginx/1.19.10 Content-Type text/html; charset=UTF-8 Content-Length 0 Location ind3x.php#authoriz3?cli3nt_k3y=aiq3c-svzys-h24ce1645729766d7c20a79a5937b26a8b4d589687c4e56d7c20a79a5937b26a8b4d589687c4e56d7c20a79a5937b26a8b4d589687c4e56d7c20a79a5937b26a8b4d589687c4e56d7c20a79a5937b26a8b4d589687c4e56ryx41-mtmar-408hs X-Server-Cache false
GET H/1.1	200 OK	jquery.min.js Show response g0t.s3.amazonaws.com/g1t/	84 KB 84 KB	422ms 115ms	Script application/javascript	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/jquery.min.js Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `e302f49181251a403177480c80f677dd129c566e693443453e2bc14db47c51ea` Request headers Referer http://smithbrothers.com.br/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Thu, 24 Feb 2022 19:09:28 GMT Last-Modified Thu, 17 Feb 2022 10:10:46 GMT Server AmazonS3 x-amz-request-id T69J7XJGRHWNNFVA ETag "ae32e3a8b23b3c22e9954018a8f50771" Content-Type application/javascript Accept-Ranges bytes Content-Length 85628 x-amz-id-2 s1QTrTKmLZWt1wqIcFNy6HLpwpFUrcnuWBHP1MiaAZ8MQLjrTHIXp3GHYKQfL4K8YVQ4Ui2a/XY=
GET H/1.1	200 OK	jquery-3.1.1.min.js Show response g0t.s3.amazonaws.com/g1t/	85 KB 85 KB	426ms 120ms	Script application/javascript	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/jquery-3.1.1.min.js Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `17c6f5cb588cf68e1d846863b21ccd1261b61a955d28c40caa3cee6f4942935b` Request headers Referer http://smithbrothers.com.br/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Thu, 24 Feb 2022 19:09:28 GMT Last-Modified Thu, 17 Feb 2022 10:10:48 GMT Server AmazonS3 x-amz-request-id T69MYFXJ72HP1M39 ETag "d72b3148cc9e1ad1e428aea9d7a03565" Content-Type application/javascript Accept-Ranges bytes Content-Length 86759 x-amz-id-2 EjX5RMPDU/Dy2l7w+nXrP0Jozu6qsvBHvwAY2Q8UDjRBm/lk4Bk7QqEh6IiJ4yJcPKBdYNNX5FE=
GET H/1.1	200 OK	jquery-3.3.1.js Show response g0t.s3.amazonaws.com/g1t/	276 KB 276 KB	423ms 116ms	Script application/javascript	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/jquery-3.3.1.js Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `53847ae03a6d9bceb4f438cf1b50a7a37d7105130835208cd0b887d90ba46def` Request headers Referer http://smithbrothers.com.br/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Thu, 24 Feb 2022 19:09:28 GMT Last-Modified Thu, 17 Feb 2022 10:10:51 GMT Server AmazonS3 x-amz-request-id T69VM94B9GYK1Y5K ETag "e445669af64b8a010cd0cb09c1e0c1d0" Content-Type application/javascript Accept-Ranges bytes Content-Length 282165 x-amz-id-2 Kfvguv7ilyFEt2Wd/CdD0l7PtMTzme45PoAJ6wX1YBIgyktbXKt0ikXjrWCa1zr4N5ipVa3nx7Y=
GET H/1.1	200 OK	bootstrap.min.css g0t.s3.amazonaws.com/g1t/	142 KB 142 KB	427ms 122ms	Stylesheet text/css	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/bootstrap.min.css Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `efaf2cabafd973e92f54e8b8ba760018ffa02bcdb63cdab01c219b570c21a2fc` Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Thu, 24 Feb 2022 19:09:28 GMT Last-Modified Thu, 17 Feb 2022 10:10:41 GMT Server AmazonS3 x-amz-request-id T69TFWNNQKYFZRBF ETag "1e5b180ea96b35ab0a33865ab541cfee" Content-Type text/css Accept-Ranges bytes Content-Length 144934 x-amz-id-2 LqX25fncjaqDJjLuoocr209KxyUVUWXj+eWdG+dNMpTQDvhjJPYxw3amMlE1WN1jpEjoeAp/jN0=
GET H/1.1	403 Forbidden	family=Archivo+Narrow&display=swap.css g0t.s3.amazonaws.com/g1t/	0 0	418ms 113ms	Stylesheet application/xml	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/family=Archivo+Narrow&display=swap.css Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers
GET H/1.1	200 OK	main.style.css g0t.s3.amazonaws.com/g1t/	4 KB 5 KB	419ms 114ms	Stylesheet text/css	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/main.style.css Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `069419606cf2a60084b3bf525add7def06b0836d8da2611ba656be99c726422e` Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Thu, 24 Feb 2022 19:09:28 GMT Last-Modified Thu, 17 Feb 2022 10:10:52 GMT Server AmazonS3 x-amz-request-id T69KY6A9BSNDN4EF ETag "c4b81fdd0b09399dcda44ccf864bce39" Content-Type text/css Accept-Ranges bytes Content-Length 4409 x-amz-id-2 KUBO05H3Xyf49g5PCXbbpIFRAkVAl0OjMHKK/zMYoL7CwmjqGiJZ2+y7CRcTfq11SVkCFcGFyC4=
GET H/1.1	200 OK	5051251.js Show response g0t.s3.amazonaws.com/g1t/	11 KB 11 KB	530ms 110ms	Script application/javascript	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/5051251.js Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `450fca8a717252e0b5820af945aa199405db752bde94a452e6612441768d44f4` Request headers Referer http://smithbrothers.com.br/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Thu, 24 Feb 2022 19:09:28 GMT Last-Modified Thu, 17 Feb 2022 10:10:37 GMT Server AmazonS3 x-amz-request-id T69YTTCZNGBSG4MV ETag "ecc21637437ade8afa1bf3cea287e18a" Content-Type application/javascript Accept-Ranges bytes Content-Length 10914 x-amz-id-2 XfBwmmjDCzXDe5YHejvWT+ECdsziQ/EQ5FzNmwCqXfKlKfkTTohz4bDCLfgqu31cFZvlyTTpnuo=
GET H/1.1	403 Forbidden	family=Archivo+Narrow&display=swap.css g0t.s3.amazonaws.com/g1t/	0 0	121ms 120ms	Stylesheet application/xml	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/family=Archivo+Narrow&display=swap.css Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers
GET H/1.1	403 Forbidden	family=Archivo+Narrow&display=swap.css g0t.s3.amazonaws.com/g1t/	0 0	128ms 128ms	Stylesheet application/xml	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/family=Archivo+Narrow&display=swap.css Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.2/css/	59 KB 13 KB	122ms 82ms	Fetch text/css	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.2/css/free.min.css?token=585b051251 Requested by Host: g0t.s3.amazonaws.com URL: https://g0t.s3.amazonaws.com/g1t/5051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94` Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 19:09:27 GMT via 1.1 c60d08323363c4861c206b74cb68eeb0.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-C1 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 13 Jan 2021 18:32:18 GMT server cloudflare etag W/"4ecc071b77d6b1790fa9fb8a5173f972" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zCb4bvx9awFhPJQlPrNzRRfFkfdsx0124Aztu1sNl6yeg4qB0l6m54t0r6q3Nz87dXUuRVana4a1a16Bfvuybg9f7HvNoQdfcc%2B3AU6fmZF1Op8kn49r9GKgru4KlpWeVWL8wW8c%2BlESgqFaM4uVpdSC%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 cf-ray 6e2afd089b5a5a01-MXP access-control-allow-headers fa-kit-token x-amz-cf-id aEQ1yguY4VMv0DU9iFDHXm6bA-FU3aYd_Dul8gUSuJ0E7XlNfjrBvA==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.2/css/	26 KB 5 KB	148ms 109ms	Fetch text/css	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.2/css/free-v4-shims.min.css?token=585b051251 Requested by Host: g0t.s3.amazonaws.com URL: https://g0t.s3.amazonaws.com/g1t/5051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101` Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 24 Feb 2022 19:09:27 GMT via 1.1 a492d514787de63e7daf0f07b0c799fe.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop MXP64-C1 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 13 Jan 2021 18:32:17 GMT server cloudflare etag W/"1848e71668f42835079e5fa2af6cf4a8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zxbG6afqeIK03dDx6PRUVFbJ4Fvx687ZsgBGsAVnyNbOEd8bOES8Q%2FPG3YoFKd%2FnCPcPs%2FgoXGQX93jYXv%2FgpadAqLz35l8loRrd4NfNBgKoceOnFpFiA3hXxJbVO7%2FqXM5lvOzpR6Xhu0sfTktCZUcVIg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 cf-ray 6e2afd089b6c5a01-MXP access-control-allow-headers fa-kit-token x-amz-cf-id COZd3RBIEnzU4ZeEvXkxI0e69Y8_FJVKYszyEN_VA-OhLeAoEcAA0w==
GET H/1.1	200 OK	jquery-3.2.1.slim.min.js Show response g0t.s3.amazonaws.com/g1t/	68 KB 68 KB	117ms 117ms	Script application/javascript	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/jquery-3.2.1.slim.min.js Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `ba19c068b1fa0a891da87472bb85e4da56b9b36d935908ecda075aee04991204` Request headers Referer http://smithbrothers.com.br/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Thu, 24 Feb 2022 19:09:29 GMT Last-Modified Thu, 17 Feb 2022 10:10:49 GMT Server AmazonS3 x-amz-request-id CNC9YNNT1WT313H3 ETag "50d7eb415683330006cf8e7eb71b4e4c" Content-Type application/javascript Accept-Ranges bytes Content-Length 69647 x-amz-id-2 weN9hbuTYToX3XyWDiZ87LIgW11QJedjxnCHZ4xsXDwuYLws/TQoNywh61CHbjFsKxTaLwL8gjM=
GET H/1.1	200 OK	popper.min.js Show response g0t.s3.amazonaws.com/g1t/	19 KB 19 KB	110ms 110ms	Script application/javascript	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/popper.min.js Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `7fe4cb65ec5651dd7c64a8118ce631fdbbd62bdd6fb16b8e54faed836c55b122` Request headers Referer http://smithbrothers.com.br/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Thu, 24 Feb 2022 19:09:29 GMT Last-Modified Thu, 17 Feb 2022 10:10:55 GMT Server AmazonS3 x-amz-request-id CNC271K35X7YJ850 ETag "577d614cc3e2a9ed0c9114da411d2fa0" Content-Type application/javascript Accept-Ranges bytes Content-Length 19243 x-amz-id-2 qeqcFrpFy/sOoQSZEQKbBLmmXyG70AX9p/Af3S+Pimuzd590vPiTORHFleNaYwlym/1IoRViZ6c=
GET H/1.1	200 OK	bootstrap.min.js Show response g0t.s3.amazonaws.com/g1t/	48 KB 48 KB	112ms 112ms	Script application/javascript	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g0t.s3.amazonaws.com/g1t/bootstrap.min.js Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `29db8702986257883443c8772092f6e9e6e33e6e180093f939c6c86b54039f25` Request headers Referer http://smithbrothers.com.br/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Thu, 24 Feb 2022 19:09:29 GMT Last-Modified Thu, 17 Feb 2022 10:10:43 GMT Server AmazonS3 x-amz-request-id CNC6HMPDNGKYNGE9 ETag "917feccddd1f412fcda6516ee248ee1b" Content-Type application/javascript Accept-Ranges bytes Content-Length 48998 x-amz-id-2 SntVB8151nRHY158YuF0KNiWyiutmNP/oRRK4WbFwG75wg/9zjQFtlBhrs9mH/k6mivkwpM48+A=
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `69c909fe1bb2265be6baafd48b548612b4823d8efed4684ef827f88c0009cdeb` Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `83bdf1f84107e5c6566a807ca5a5b67b00342c4e568ac55ec8ee7de912499a39` Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	4_bc3d32a696895f78c19df6c717586a5d.svg g0t.s3.amazonaws.com/g1t/	4 KB 4 KB	118ms 117ms	Image image/svg+xml	52.216.145.203 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://g0t.s3.amazonaws.com/g1t/4_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: smithbrothers.com.br URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.203 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `7d70276551807a2cfa69300e260fff2ffd634ac0c4b92db78d1cb82a0b0e1021` Request headers Accept-Language de-DE,de;q=0.9 Referer http://smithbrothers.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Thu, 24 Feb 2022 19:09:29 GMT Last-Modified Thu, 17 Feb 2022 10:10:36 GMT Server AmazonS3 x-amz-request-id CNC25Y5BTCJY3HV0 ETag "795ec161c84ee970bae0142bbb940fff" Content-Type image/svg+xml Accept-Ranges bytes Content-Length 4041 x-amz-id-2 nJ2072uXKhpiHx+ZefCYMqvDgOUndd8yds7hpmPRZKmpH5pa0FX9Hn6yQdVvnRx8yqiHBVHX+qs=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

17 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 6) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 6) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 6) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery-3.3.1.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 6) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/5051251.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 6) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 6) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 6) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery-3.3.1.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 6) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/5051251.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://g0t.s3.amazonaws.com/g1t/family=Archivo+Narrow&display=swap.css Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: https://g0t.s3.amazonaws.com/g1t/family=Archivo+Narrow&display=swap.css Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: https://g0t.s3.amazonaws.com/g1t/family=Archivo+Narrow&display=swap.css Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 39) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 39) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 39) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 39) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 46) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://smithbrothers.com.br/wp-includes/apple/adminnew/ind3x.php(Line 46) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://g0t.s3.amazonaws.com/g1t/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

g0t.s3.amazonaws.com
ka-f.fontawesome.com
smithbrothers.com.br
108.179.252.154
2a06:98c1:3121::7
52.216.145.203
069419606cf2a60084b3bf525add7def06b0836d8da2611ba656be99c726422e
17c6f5cb588cf68e1d846863b21ccd1261b61a955d28c40caa3cee6f4942935b
29db8702986257883443c8772092f6e9e6e33e6e180093f939c6c86b54039f25
450fca8a717252e0b5820af945aa199405db752bde94a452e6612441768d44f4
53847ae03a6d9bceb4f438cf1b50a7a37d7105130835208cd0b887d90ba46def
61bb74cd5180e81d9942b35dbdd129c5a1ef45a60324b0b0ee41dc2f94c694fa
69c909fe1bb2265be6baafd48b548612b4823d8efed4684ef827f88c0009cdeb
7d70276551807a2cfa69300e260fff2ffd634ac0c4b92db78d1cb82a0b0e1021
7fe4cb65ec5651dd7c64a8118ce631fdbbd62bdd6fb16b8e54faed836c55b122
83bdf1f84107e5c6566a807ca5a5b67b00342c4e568ac55ec8ee7de912499a39
8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94
ba19c068b1fa0a891da87472bb85e4da56b9b36d935908ecda075aee04991204
d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101
e302f49181251a403177480c80f677dd129c566e693443453e2bc14db47c51ea
efaf2cabafd973e92f54e8b8ba760018ffa02bcdb63cdab01c219b570c21a2fc

smithbrothers.com.br Open in urlscan Pro 108.179.252.154 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

94 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

875 kBTransfer

1111 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

26 JavaScript Global Variables

0 Cookies

17 Console Messages

Indicators

smithbrothers.com.br Open in urlscan Pro
108.179.252.154 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

94 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

875 kB
Transfer

1111 kB
Size

0
Cookies

16 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!