ssll.com.br Open in urlscan Pro
186.233.90.10  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/K0rjr2RVJY?amp=1?275318532020185327531853202018532753185320201853272753185320201853275318532020185327531853202018532727531853202018532753185320201853275318532020185327 Page URL
2. https://www.islamic-faith.com/wp-admin/js/up/com.php?zzc9 Page URL
3. http://ssll.com.br/wp-content/upgrade/red/KeLast/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	K0rjr2RVJY Show response t.co/	329 B 439 B	165ms 164ms	Document text/html	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/K0rjr2RVJY?amp=1?275318532020185327531853202018532753185320201853272753185320201853275318532020185327531853202018532727531853202018532753185320201853275318532020185327 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash 7f779715afa6789f73fc1c540164174a16d57a6daa06f36d8757009368fc5233 Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers :method GET :authority t.co :scheme https :path /K0rjr2RVJY?amp=1?275318532020185327531853202018532753185320201853272753185320201853275318532020185327531853202018532727531853202018532753185320201853275318532020185327 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cache-control private,max-age=300 content-encoding gzip content-length 210 content-type text/html; charset=utf-8 date Mon, 28 Dec 2020 14:38:02 GMT expires Mon, 28 Dec 2020 14:43:02 GMT server tsa_o set-cookie muc=f1812ab7-419a-4c79-bd7d-badbda2dd5e9; Max-Age=63072000; Expires=Wed, 28 Dec 2022 14:38:02 GMT; Domain=t.co; Secure; SameSite=None strict-transport-security max-age=0 vary Origin x-connection-hash f26dbac381b4cb3205b5a6ebca47707e x-response-time 122 x-xss-protection 0
GET H2	200	com.php Show response www.islamic-faith.com/wp-admin/js/up/	237 B 749 B	237ms 206ms	Document text/html	2606:4700:3034::681f:479d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.islamic-faith.com/wp-admin/js/up/com.php?zzc9 Requested by Host: t.co URL: https://t.co/K0rjr2RVJY?amp=1?275318532020185327531853202018532753185320201853272753185320201853275318532020185327531853202018532727531853202018532753185320201853275318532020185327 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::681f:479d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51489795d40f6e81ca1a297485b5eb3b9da3bfb5deb964e565b544c4050b6c42 Request headers :method GET :authority www.islamic-faith.com :scheme https :path /wp-admin/js/up/com.php?zzc9 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://t.co/K0rjr2RVJY?amp=1?275318532020185327531853202018532753185320201853272753185320201853275318532020185327531853202018532727531853202018532753185320201853275318532020185327 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://t.co/K0rjr2RVJY?amp=1?275318532020185327531853202018532753185320201853272753185320201853275318532020185327531853202018532727531853202018532753185320201853275318532020185327 Response headers date Mon, 28 Dec 2020 14:38:02 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d7044290f97815f8357303cb2ead1a0791609166282; expires=Wed, 27-Jan-21 14:38:02 GMT; path=/; domain=.islamic-faith.com; HttpOnly; SameSite=Lax vary Accept-Encoding access-control-allow-origin * cf-cache-status DYNAMIC cf-request-id 074b61f59a000005cce0a4a000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Q42kSAKmSg0Q0wC%2BU3BQeAiw0bkvZW0KYpECaSAbSG0xGdLNCfGv2AlM%2FKf1crN4uJsF3Zl7GzSsPqu1X70fBei7VmBsudTKk1h0Ju%2B7dmp%2BF20GHgeMHMsmajoI4b%2BRrzc%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 608c05cf5b0205cc-FRA content-encoding br
GET H/1.1	200 OK	Primary Request Cookie set / Show response ssll.com.br/wp-content/upgrade/red/KeLast/	389 B 751 B	1296ms 1072ms	Document text/html	186.233.90.10 IPHOTEL Hospedage...
General Check archive.org Show headers Download Go to Full URL http://ssll.com.br/wp-content/upgrade/red/KeLast/ Protocol HTTP/1.1 Server 186.233.90.10 , Brazil, ASN262787 (IPHOTEL Hospedagem de Sites Ltda, BR), Reverse DNS server9010.cloud.srv.br Software nginx / PHP/7.1.26 PleskLin Resource Hash ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793 Request headers Host ssll.com.br Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx Date Mon, 28 Dec 2020 14:38:02 GMT Content-Type text/html; charset=UTF-8 Content-Length 262 Connection keep-alive X-Powered-By PHP/7.1.26 PleskLin Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie cazanova=dcu5lnoa99r8rig6vcv07tuvhbbm4g71; expires=Mon, 28-Dec-2020 16:38:02 GMT; Max-Age=7200; path=/; HttpOnly Vary Accept-Encoding Content-Encoding gzip
GET H/1.1	200 OK	captcha.js Show response ssll.com.br/wp-content/upgrade/red/KeLast/assets/js/	118 KB 118 KB	254ms 253ms	Script application/javascript	186.233.90.10 IPHOTEL Hospedage...
General Check archive.org Show headers Download Go to Full URL http://ssll.com.br/wp-content/upgrade/red/KeLast/assets/js/captcha.js Requested by Host: ssll.com.br URL: http://ssll.com.br/wp-content/upgrade/red/KeLast/ Protocol HTTP/1.1 Server 186.233.90.10 , Brazil, ASN262787 (IPHOTEL Hospedagem de Sites Ltda, BR), Reverse DNS server9010.cloud.srv.br Software nginx / PleskLin Resource Hash ffdb484c06702e7c2a79eb364ffe818f2c691286998fb52ab09c749eabd8fb72 Request headers Referer http://ssll.com.br/wp-content/upgrade/red/KeLast/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 28 Dec 2020 14:38:02 GMT Last-Modified Thu, 24 Dec 2020 00:43:03 GMT Server nginx X-Powered-By PleskLin ETag "5fe3e417-1d71c" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 120604
GET H/1.1	200 OK	captcha.png ssll.com.br/wp-content/upgrade/red/KeLast/	6 KB 6 KB	304ms 303ms	Image image/png	186.233.90.10 IPHOTEL Hospedage...
General Check archive.org Show headers Download Go to Show image Full URL http://ssll.com.br/wp-content/upgrade/red/KeLast/captcha.png?_1609166286983 Protocol HTTP/1.1 Server 186.233.90.10 , Brazil, ASN262787 (IPHOTEL Hospedagem de Sites Ltda, BR), Reverse DNS server9010.cloud.srv.br Software nginx / PHP/7.1.26, PleskLin Resource Hash d78d73c4ade3db2cbc6171e281e64ccdeb6738ffcb79221faaf8d0b3aa5a8085 Request headers Referer http://ssll.com.br/wp-content/upgrade/red/KeLast/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Mon, 28 Dec 2020 14:38:06 GMT Content-Encoding gzip Server nginx X-Powered-By PHP/7.1.26, PleskLin Vary Accept-Encoding Content-Type image/png Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 5529 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	Kee.png ssll.com.br/wp-content/upgrade/red/KeLast/	27 KB 27 KB	475ms 457ms	Image image/png	186.233.90.10 IPHOTEL Hospedage...
General Check archive.org Show headers Download Go to Show image Full URL http://ssll.com.br/wp-content/upgrade/red/KeLast/Kee.png Requested by Host: ssll.com.br URL: http://ssll.com.br/wp-content/upgrade/red/KeLast/ Protocol HTTP/1.1 Server 186.233.90.10 , Brazil, ASN262787 (IPHOTEL Hospedagem de Sites Ltda, BR), Reverse DNS server9010.cloud.srv.br Software nginx / PleskLin Resource Hash 241eca53a73b5954ae742575918848c979bfa80530c7381a8a4ab8979180af29 Request headers Referer http://ssll.com.br/wp-content/upgrade/red/KeLast/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 28 Dec 2020 14:38:06 GMT Last-Modified Thu, 24 Dec 2020 00:43:03 GMT Server nginx X-Powered-By PleskLin ETag "5fe3e417-6c62" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 27746

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: KeyBank (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| setImmediate function| clearImmediate function| Vue

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ssll.com.br/	1970-01-19 14:59:33	Name: cazanova Value: dcu5lnoa99r8rig6vcv07tuvhbbm4g71

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ssll.com.br
t.co
www.islamic-faith.com
104.244.42.197
186.233.90.10
2606:4700:3034::681f:479d
241eca53a73b5954ae742575918848c979bfa80530c7381a8a4ab8979180af29
51489795d40f6e81ca1a297485b5eb3b9da3bfb5deb964e565b544c4050b6c42
7f779715afa6789f73fc1c540164174a16d57a6daa06f36d8757009368fc5233
d78d73c4ade3db2cbc6171e281e64ccdeb6738ffcb79221faaf8d0b3aa5a8085
ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793
ffdb484c06702e7c2a79eb364ffe818f2c691286998fb52ab09c749eabd8fb72