www.descontoplanopremium.com Open in urlscan Pro
2606:4700:3036::681c:b08 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://descontoplanopremium.com/
Effective URL:
http://www.descontoplanopremium.com/
Submission: On March 26 via api (March 26th 2020, 5:26:22 pm UTC) from BR

Summary HTTP 10 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3036::681c:b08, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.descontoplanopremium.com.

This is the only time www.descontoplanopremium.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2604:a880:400... 2604:a880:400:d0::17a8:2001	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	2606:4700:303... 2606:4700:3036::681c:b08	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
10	2

1 2604:a880:400:d0::17a8:2001 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

descontoplanopremium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:3036::681c:b08 (United States)

ASN13335 (CLOUDFLARENET, US)

www.descontoplanopremium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:86c0:2091::1 (United Kingdom)

ASN40027 (NETFLIX-ASN, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	nflxext.com codex.nflxext.com assets.nflxext.com	676 KB
4	descontoplanopremium.com 1 redirects descontoplanopremium.com www.descontoplanopremium.com	90 KB
10	2

	Domain	Requested by
4	codex.nflxext.com	www.descontoplanopremium.com
3	assets.nflxext.com	www.descontoplanopremium.com
3	www.descontoplanopremium.com	www.descontoplanopremium.com
1	descontoplanopremium.com	1 redirects
10	4

This site contains links to these domains. Also see Links.

Domain
help.netflix.com

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert SHA2 Secure Server CA	`2020-03-05` - `2020-04-08`	a month	crt.sh

This page contains 1 frames:

Primary Page: http://www.descontoplanopremium.com/
Frame ID: 88C42697A1011B5E485C02A2854C0FD1
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://descontoplanopremium.com/ HTTP 301
http://www.descontoplanopremium.com/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

10
Requests

70 %
HTTPS

100 %
IPv6

2
Domains

4
Subdomains

2
IPs

2
Countries

766 kB
Transfer

2394 kB
Size

1
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://help.netflix.com/support/412
Title: Perguntas frequentes

Search URL Search Domain Scan URL

URL: https://help.netflix.com/
Title: Centro de ajuda

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Termos de uso

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Privacidade

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy#cookies
Title: Preferências de cookies

Search URL Search Domain Scan URL

URL: https://help.netflix.com/pt/node/2101
Title: Informações corporativas

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://descontoplanopremium.com/ HTTP 301
http://www.descontoplanopremium.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set / Show response
www.descontoplanopremium.com/
Redirect Chain

http://descontoplanopremium.com/
http://www.descontoplanopremium.com/

416 KB
90 KB

1985ms
1810ms

Document
text/html

2606:4700:3036::681c:b08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.descontoplanopremium.com/
Protocol: HTTP/1.1
Server: 2606:4700:3036::681c:b08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa53743818d506fbdc526809f02e9d94ec240bd9dfc7c6e41a4b49f51caa8b3b

Request headers

Host: www.descontoplanopremium.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 26 Mar 2020 17:26:05 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dba295af59cece5ab39e54933d51190001585243564; expires=Sat, 25-Apr-20 17:26:04 GMT; path=/; domain=.descontoplanopremium.com; HttpOnly; SameSite=Lax
Cf-Railgun: direct (starting new WAN connection)
Last-Modified: Thu, 26 Mar 2020 00:17:17 GMT
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 57a293136e539730-FRA
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Thu, 26 Mar 2020 17:26:03 GMT
Content-Type: text/html
Content-Length: 162
Connection: close
Location: http://www.descontoplanopremium.com
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v74114b55/js/js/bootstrap.js,common%7Cbootstrap.js/2/4P034o4n4b4p474x4O070q004Q4s4h4z4q4J4d4y4l4B4f4e0b024L/bck/true/ 9 KB
4 KB 1180ms
1160ms Script
application/javascript 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v74114b55/js/js/bootstrap.js,common%7Cbootstrap.js/2/4P034o4n4b4p474x4O070q004Q4s4h4z4q4J4d4y4l4B4f4e0b024L/bck/true/none

Requested by

Host: www.descontoplanopremium.com
URL: http://www.descontoplanopremium.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

70d5d608b8972594714692ca2babb9d7816a12b34a9d1e74c741d7fc7476755d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.descontoplanopremium.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 26 Mar 2020 17:26:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 7f41f95f-6ff4-43ae-9ae3-dc874b0a4828
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Mon, 28 Sep 2020 17:26:06 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v74114b55/js/js/signup%7Csimplicity%7CsimpleSignupClient.js/2/4P034o4n4b4p474x4O070q004Q4s4h4z4q4J4d4y4l4B4f4e0b024L/l/true/ 1 MB
448 KB 2517ms
2497ms Script
application/javascript 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v74114b55/js/js/signup%7Csimplicity%7CsimpleSignupClient.js/2/4P034o4n4b4p474x4O070q004Q4s4h4z4q4J4d4y4l4B4f4e0b024L/l/true/none

Requested by

Host: www.descontoplanopremium.com
URL: http://www.descontoplanopremium.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

9befeb58c6bd9ac8d9c70bba5108a61af4bdc188c5b76b3764403fd163940465

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.descontoplanopremium.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 26 Mar 2020 17:26:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 5567c8ee-e23f-41e3-bc0b-a80af2ad6692
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Mon, 28 Sep 2020 17:26:08 GMT

GET
H/1.1 404
Not Found WebsiteDetect
www.descontoplanopremium.com/personalization/cl2/freeform/ 0
0 695ms
615ms Stylesheet
text/html 2606:4700:3036::681c:b08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.descontoplanopremium.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=signupSimplicity-planSelection
Requested by: Host: www.descontoplanopremium.com
URL: http://www.descontoplanopremium.com/
Protocol: HTTP/1.1
Server: 2606:4700:3036::681c:b08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: http://www.descontoplanopremium.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 26 Mar 2020 17:26:06 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
Connection: keep-alive
CF-RAY: 57a2931f3a019abc-FRA
Cf-Railgun: direct (starting new WAN connection)

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v74114b55/css/css/less%7Ccore%7Cerror-page.less/1/wGyP3uxKi9FMO/none/true/ 19 KB
5 KB 27ms
8ms Stylesheet
text/css 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v74114b55/css/css/less%7Ccore%7Cerror-page.less/1/wGyP3uxKi9FMO/none/true/none

Requested by

Host: www.descontoplanopremium.com
URL: http://www.descontoplanopremium.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

8e0d535dad44182d2d9c92ccd747f283d653610c755be90b79ed9c5f13ab3175

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.descontoplanopremium.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Thu, 26 Mar 2020 17:26:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: c758ba2b-b1b9-4737-bdfc-716e0b3551ba
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 4618
Expires: Fri, 25 Sep 2020 16:46:09 GMT

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v74114b55/css/css/less%7Cpages%7Csignup%7Csimplicity%7Csimplicity.less/1/wGyP3uxKi9FMO/none/true/ 254 KB
41 KB 572ms
553ms Stylesheet
text/css 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v74114b55/css/css/less%7Cpages%7Csignup%7Csimplicity%7Csimplicity.less/1/wGyP3uxKi9FMO/none/true/none

Requested by

Host: www.descontoplanopremium.com
URL: http://www.descontoplanopremium.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

f0c6c7a6675db22888ca3aa711fe07cd52b171e74abdde00eafead1317ef8b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.descontoplanopremium.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Thu, 26 Mar 2020 17:26:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 13aaf044-fbf0-46f4-b5c0-c3cd131489fc
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Mon, 28 Sep 2020 17:26:06 GMT

GET
H/1.1 404
Not Found WebsiteDetect Show response
www.descontoplanopremium.com/personalization/cl2/freeform/ 437 B
649 B 626ms
544ms XHR
text/html 2606:4700:3036::681c:b08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.descontoplanopremium.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=signupSimplicity-planSelection
Requested by: Host: www.descontoplanopremium.com
URL: http://www.descontoplanopremium.com/
Protocol: HTTP/1.1
Server: 2606:4700:3036::681c:b08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0e801b862cf57bbd27b38ac5e1dfe46c89cb507140ab2c15082c74e70089b81

Request headers

Referer: http://www.descontoplanopremium.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 26 Mar 2020 17:26:07 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
Connection: keep-alive
CF-RAY: 57a293239f35c2ae-FRA
Cf-Railgun: direct (waiting for pending WAN connection)

GET
H/1.1 200
OK NetflixSans_W_Rg.woff2
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/ 52 KB
52 KB 20ms
5ms Font
font/woff2 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Rg.woff2
Requested by: Host: www.descontoplanopremium.com
URL: http://www.descontoplanopremium.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167

Request headers

Referer: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v74114b55/css/css/less%7Ccore%7Cerror-page.less/1/wGyP3uxKi9FMO/none/true/none
Origin: http://www.descontoplanopremium.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 26 Mar 2020 17:26:06 GMT
Last-Modified: Thu, 17 Jan 2019 20:16:30 GMT
Server: nginx
Content-MD5: C/MXfx/tbZUxeCIfukPH6A==
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=4826893
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 53304
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK NetflixSans_W_Md.woff2
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/ 53 KB
53 KB 27ms
9ms Font
font/woff2 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Md.woff2
Requested by: Host: www.descontoplanopremium.com
URL: http://www.descontoplanopremium.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e

Request headers

Referer: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v74114b55/css/css/less%7Ccore%7Cerror-page.less/1/wGyP3uxKi9FMO/none/true/none
Origin: http://www.descontoplanopremium.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 26 Mar 2020 17:26:06 GMT
Last-Modified: Thu, 17 Jan 2019 20:16:30 GMT
Server: nginx
Content-MD5: 6naZIbDPpPxtTRouCx+l/w==
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=4891721
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 53940
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 25ms
7ms Font
font/woff 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: www.descontoplanopremium.com
URL: http://www.descontoplanopremium.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v74114b55/css/css/less%7Cpages%7Csignup%7Csimplicity%7Csimplicity.less/1/wGyP3uxKi9FMO/none/true/none
Origin: http://www.descontoplanopremium.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 26 Mar 2020 17:26:06 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=13767383
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Wed, 15 Apr 2020 20:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| netflix

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.descontoplanopremium.com/	1970-01-19 09:03:55	Name: __cfduid Value: dba295af59cece5ab39e54933d51190001585243564

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
codex.nflxext.com
descontoplanopremium.com
www.descontoplanopremium.com
2604:a880:400:d0::17a8:2001
2606:4700:3036::681c:b08
2a00:86c0:2091::1
70d5d608b8972594714692ca2babb9d7816a12b34a9d1e74c741d7fc7476755d
8e0d535dad44182d2d9c92ccd747f283d653610c755be90b79ed9c5f13ab3175
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e
9befeb58c6bd9ac8d9c70bba5108a61af4bdc188c5b76b3764403fd163940465
aa53743818d506fbdc526809f02e9d94ec240bd9dfc7c6e41a4b49f51caa8b3b
c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167
d0e801b862cf57bbd27b38ac5e1dfe46c89cb507140ab2c15082c74e70089b81
f0c6c7a6675db22888ca3aa711fe07cd52b171e74abdde00eafead1317ef8b54

www.descontoplanopremium.com Open in urlscan Pro 2606:4700:3036::681c:b08 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

70 %HTTPS

100 %IPv6

2 Domains

4 Subdomains

2 IPs

2 Countries

766 kBTransfer

2394 kBSize

1 Cookies

6 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

www.descontoplanopremium.com Open in urlscan Pro
2606:4700:3036::681c:b08 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

70 %
HTTPS

100 %
IPv6

2
Domains

4
Subdomains

2
IPs

2
Countries

766 kB
Transfer

2394 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!