urlscan.io logo urlscan.io
SecurityTrails logo

pagamento.cf Open in urlscan Pro
2606:4700:30::6812:2fd3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3...
Submission: On July 15 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 2606:4700:30::6812:2fd3, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is pagamento.cf.
This is the only time pagamento.cf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
7 2606:4700:30:... 13335 (CLOUDFLAR...)
7 1
Apex Domain
Subdomains		 Transfer
7 pagamento.cf
pagamento.cf
86 KB
7 1
Domain Requested by
7 pagamento.cf pagamento.cf
7 1

This site contains no links.

Subject Issuer Validity Valid

1970-01-01 -
1970-01-01		 a few seconds crt.sh

This page contains 1 frames:

Primary Page: http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
Frame ID: D7DEB9759B68378F7D9B248BC1B8C386
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

7
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

86 kB
Transfer

91 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set index2.php
pagamento.cf/ 		7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
Protocol
HTTP/1.1
Server
2606:4700:30::6812:2fd3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c841ad8edd8c940a5bdbce8f35f54a2276daa4ee67fa9edb75d607dd7167f57

Request headers

Host
pagamento.cf
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 15 Jul 2019 11:04:50 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=da958c439a2ac66dd132fcca8374d88ee1563188689; expires=Tue, 14-Jul-20 11:04:49 GMT; path=/; domain=.pagamento.cf; HttpOnly
Vary
Accept-Encoding
Server
cloudflare
CF-RAY
4f6b42003833c2db-FRA
Content-Encoding
gzip
scripts.js
pagamento.cf/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pagamento.cf/scripts.js
Requested by
Host: pagamento.cf
URL: http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
Protocol
HTTP/1.1
Security
, ,
Server
2606:4700:30::6812:2fd3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1fe4aa08586c1d95ad0b9f4a1e980a7be19c7c3f654cda993a158b52966bf33

Request headers

Referer
http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 15 Jul 2019 11:04:50 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Sat, 14 Jan 2017 02:30:40 GMT
Server
cloudflare
Age
233
ETag
"f41-54604bc81f400-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
4f6b4200fb0ac2db-FRA
Content-Length
858
Expires
Mon, 15 Jul 2019 15:04:50 GMT
01.png
pagamento.cf/pictures/ 		31 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pagamento.cf/pictures/01.png
Requested by
Host: pagamento.cf
URL: http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
Protocol
HTTP/1.1
Security
, ,
Server
2606:4700:30::6812:2fd3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2e3f2c478b4bec41cf2f2dc9866643ffc7c314672ec00f71a241a38a944ac73

Request headers

Referer
http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 15 Jul 2019 11:04:50 GMT
CF-Cache-Status
HIT
Last-Modified
Sat, 14 Jan 2017 02:33:42 GMT
Server
cloudflare
Age
227
ETag
"7d1d-54604c75b0d80"
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
4f6b42011b67c2db-FRA
Content-Length
32029
Expires
Mon, 15 Jul 2019 15:04:50 GMT
02.png
pagamento.cf/pictures/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pagamento.cf/pictures/02.png
Requested by
Host: pagamento.cf
URL: http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
Protocol
HTTP/1.1
Security
, ,
Server
2606:4700:30::6812:2fd3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac012672fbde51005e33556de5ea06dc805a2065b7cbe91bd8f275c3cd995d67

Request headers

Referer
http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 15 Jul 2019 11:04:50 GMT
CF-Cache-Status
HIT
Last-Modified
Sat, 14 Jan 2017 02:33:38 GMT
Server
cloudflare
Age
178
ETag
"e65-54604c71e0480"
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
4f6b42011c4e96f2-FRA
Content-Length
3685
Expires
Mon, 15 Jul 2019 15:04:50 GMT
03.png
pagamento.cf/pictures/ 		496 B
900 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pagamento.cf/pictures/03.png
Requested by
Host: pagamento.cf
URL: http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
Protocol
HTTP/1.1
Security
, ,
Server
2606:4700:30::6812:2fd3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b68be0ce0f3911c70fe492eb16445c3f319eebb84b38131a4be8a383acf8f11d

Request headers

Referer
http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 15 Jul 2019 11:04:50 GMT
CF-Cache-Status
HIT
Last-Modified
Sat, 14 Jan 2017 02:33:25 GMT
Server
cloudflare
Age
178
ETag
"1f0-54604c657a740"
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
4f6b420128f2c2ef-FRA
Content-Length
496
Expires
Mon, 15 Jul 2019 15:04:50 GMT
06.png
pagamento.cf/pictures/ 		564 B
968 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pagamento.cf/pictures/06.png
Requested by
Host: pagamento.cf
URL: http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
Protocol
HTTP/1.1
Security
, ,
Server
2606:4700:30::6812:2fd3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
973576ba6483c6c75d1d55339c1cac5d742abef700ede0903341ab222a2ee7c2

Request headers

Referer
http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 15 Jul 2019 11:04:50 GMT
CF-Cache-Status
HIT
Last-Modified
Sat, 14 Jan 2017 02:32:59 GMT
Server
cloudflare
Age
225
ETag
"234-54604c4caecc0"
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
4f6b42012a27beab-FRA
Content-Length
564
Expires
Mon, 15 Jul 2019 15:04:50 GMT
04.png
pagamento.cf/pictures/ 		45 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pagamento.cf/pictures/04.png
Requested by
Host: pagamento.cf
URL: http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
Protocol
HTTP/1.1
Security
, ,
Server
2606:4700:30::6812:2fd3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b1ba27de53e11e2a80751ab9c56f7aaabf3279ee0c4b3e6208a29fd34b6c180

Request headers

Referer
http://pagamento.cf/index2.php?page=chorme.10,25,15KQHlG9hLlru2lk12FWzrHzgFslFzFK1HW94TfDTQEltWrjjT56yrywq1GRkgyygd3PPy5fuDSgE5FzWWQQWyFcd7uySB4R7lajsP
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 15 Jul 2019 11:04:50 GMT
CF-Cache-Status
HIT
Last-Modified
Sat, 14 Jan 2017 02:33:23 GMT
Server
cloudflare
Age
225
ETag
"b349-54604c63922c0"
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
4f6b42012d6e63a7-FRA
Content-Length
45897
Expires
Mon, 15 Jul 2019 15:04:50 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| validar_dados1 function| validar_dados2 function| validar_dados3 function| pulacampo function| SomenteNumero

1 Cookies

Domain/Path Name / Value
.pagamento.cf/ Name: __cfduid
Value: da958c439a2ac66dd132fcca8374d88ee1563188689