episodiomenswear.com.br
Open in
urlscan Pro
162.214.55.83
Malicious Activity!
Public Scan
Submitted URL: https://episodiomenswear.com.br/las/
Effective URL: https://episodiomenswear.com.br/las/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=23&id=4700249574
Submission: On July 19 via api from US — Scanned from DE
Effective URL: https://episodiomenswear.com.br/las/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=23&id=4700249574
Submission: On July 19 via api from US — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 8 HTTP transactions.
The main IP is 162.214.55.83, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is episodiomenswear.com.br.
TLS certificate: Issued by R3 on June 25th 2022. Valid for: 3 months.
This is the only time episodiomenswear.com.br was scanned on urlscan.io!
TLS certificate: Issued by R3 on June 25th 2022. Valid for: 3 months.
This is the only time episodiomenswear.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DocuSign (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 7 | 162.214.55.83 162.214.55.83 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 2 | 2.16.186.34 2.16.186.34 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 8 | 2 |
7
162.214.55.83
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-4283563.alicercedoscriativos.com.br
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-4283563.alicercedoscriativos.com.br
| episodiomenswear.com.br |
2
2.16.186.34
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-34.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-34.deploy.static.akamaitechnologies.com
| docucdn-a.akamaihd.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
episodiomenswear.com.br
1 redirects
episodiomenswear.com.br |
59 KB |
| 2 |
akamaihd.net
docucdn-a.akamaihd.net — Cisco Umbrella Rank: 9510 |
80 KB |
| 8 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | episodiomenswear.com.br |
1 redirects
episodiomenswear.com.br
|
| 2 | docucdn-a.akamaihd.net |
episodiomenswear.com.br
|
| 8 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.episodiomenswear.com.br R3 |
2022-06-25 - 2022-09-23 |
3 months | crt.sh |
| a248.e.akamai.net DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-28 - 2023-06-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://episodiomenswear.com.br/las/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=23&id=4700249574
Frame ID: D8614DC4468C7BF10F6482F64DD238B2
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
DocuSignPage URL History Show full URLs
-
https://episodiomenswear.com.br/las/
HTTP 302
https://episodiomenswear.com.br/las/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=23&id=47002... Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://episodiomenswear.com.br/las/
HTTP 302
https://episodiomenswear.com.br/las/login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=23&id=4700249574 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
login.php
episodiomenswear.com.br/las/ Redirect Chain
|
31 KB 31 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-faces.css
episodiomenswear.com.br/las/data/ |
9 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
activate.css
episodiomenswear.com.br/las/data/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Framework.css
episodiomenswear.com.br/las/data/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo_docusign_new_white.png
episodiomenswear.com.br/las/data/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
btn_arrow_u.png
episodiomenswear.com.br/las/data/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
HelveticaNeue.ttf
docucdn-a.akamaihd.net/signing/1.9.0/fonts/helvetica-neue/ |
103 KB 48 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
MavenPro-Bold.ttf
docucdn-a.akamaihd.net/signing/1.9.0/fonts/maven-pro/ |
97 KB 33 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DocuSign (Online)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| episodiomenswear.com.br/ | Name: PHPSESSID Value: 1b8b9af0b5ef46415ce67b2b39fcd281 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
docucdn-a.akamaihd.net
episodiomenswear.com.br
162.214.55.83
2.16.186.34
121062cdebb2a08cd0d9479312c2d00e25a2cf29e11df3255b759f8fc5f3c711
2a5179b8851c8e3dfc77d7dcb33b3963afa037608336d6ae412acaa38ad59d22
57a64da125f941a47e9d2a040d9f1f6bf2b34930d4f4586cfb35124b4e8336bd
aa9645c18d5e178343ee48631a0c45ba1ec5c7b69af6eb0691afa16e3db629a3
d43a3ff967bf047dfe6ac8d72ae7dcb269ff98baf2c2e821de4f9cf27fc29473
d8f950f48e3ecababede8064265c1d3c66a80dd88db5ed9c404365e167282f12
e1b12e36c2e781fdbe301bc99c4638adf0747fb3dbda8df5add226acac0bcc73
edd5eb91a05ef65653a6e9c4ddb60482ee93ad2994c1925cd2b7a310e7bdcc73