riscosnapaisagem.ptservidor.net

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 185.32.190.38, located in Portugal and belongs to PTSERVIDOR, PT. The main domain is riscosnapaisagem.ptservidor.net.

This is the only time riscosnapaisagem.ptservidor.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::ac43:1e1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	185.32.190.38 185.32.190.38	62416 (PTSERVIDOR) (PTSERVIDOR)
2 4	79.170.40.67 79.170.40.67	20738 (GD-EMEA-D...) (GD-EMEA-DC-LD5)
4	2

1 2606:4700:10::ac43:1e1 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.32.190.38 (Portugal)

ASN62416 (PTSERVIDOR, PT)
PTR: enterprise2.ptservidor.net

riscosnapaisagem.ptservidor.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 79.170.40.67 (Leeds, United Kingdom) 2 redirects

ASN20738 (GD-EMEA-DC-LD5, DE)
PTR: www.outitgoes.com

www.outitgoes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	outitgoes.com 2 redirects www.outitgoes.com	18 KB
2	ptservidor.net riscosnapaisagem.ptservidor.net	2 KB
1	tinyurl.com 1 redirects tinyurl.com — Cisco Umbrella Rank: 18346	451 B
4	3

	Domain	Requested by
4	www.outitgoes.com	2 redirects riscosnapaisagem.ptservidor.net
2	riscosnapaisagem.ptservidor.net	riscosnapaisagem.ptservidor.net
1	tinyurl.com	1 redirects
4	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/mail.htm?cmd=LOB=RBGLogon&_pageLabel=page_logonform&secured_page
Frame ID: A47B27944DD6A5949D8C33197F518A28
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Upgrade Your Mailbox

Page URL History Show full URLs

https://tinyurl.com/yc64dh9n HTTP 301
http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/ Page URL
http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/mail.htm?cmd=LOB=RBGLogon&_pageLabel=pag... Page URL

Page Statistics

4
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

20 kB
Transfer

19 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/yc64dh9n HTTP 301
http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/ Page URL
http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/mail.htm?cmd=LOB=RBGLogon&_pageLabel=page_logonform&secured_page Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tinyurl.com/yc64dh9n HTTP 301
http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/

Request Chain 1

http://www.outitgoes.com/default.css HTTP 301
https://www.outitgoes.com/default.css

Request Chain 2

http://www.outitgoes.com/login_panel_gradient.jpg HTTP 301
https://www.outitgoes.com/login_panel_gradient.jpg

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/ Redirect Chain https://tinyurl.com/yc64dh9n http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/	127 B 395 B	103ms 52ms	Document text/html	185.32.190.38 PTSERVIDOR
General Check archive.org Show headers Download Go to Full URL http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/ Protocol HTTP/1.1 Server 185.32.190.38 , Portugal, ASN62416 (PTSERVIDOR, PT), Reverse DNS enterprise2.ptservidor.net Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Upgrade, Keep-Alive Content-Length 127 Content-Type text/html Date Thu, 12 May 2022 11:20:56 GMT Keep-Alive timeout=5, max=100 Last-Modified Sun, 08 May 2022 03:13:20 GMT Server Apache Upgrade h2,h2c Redirect headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=0, public, s-max-age=900, stale-if-error: 86400 cf-cache-status DYNAMIC cf-ray 70a2c49f7bf801fc-ZRH content-type text/html; charset=UTF-8 date Thu, 12 May 2022 11:20:58 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" location http://riscosnapaisagem.ptservidor.net/webmail-admin/Überprüfung/ referrer-policy unsafe-url server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-powered-by PHP/7.4.28 x-xss-protection 1; mode=block
GET H/1.1	200 OK	Primary Request mail.htm Show response riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/	2 KB 2 KB	47ms 47ms	Document text/html	185.32.190.38 PTSERVIDOR
General Check archive.org Show headers Download Go to Full URL http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/mail.htm?cmd=LOB=RBGLogon&_pageLabel=page_logonform&secured_page Requested by Host: riscosnapaisagem.ptservidor.net URL: http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/ Protocol HTTP/1.1 Server 185.32.190.38 , Portugal, ASN62416 (PTSERVIDOR, PT), Reverse DNS enterprise2.ptservidor.net Software Apache / Resource Hash `e9879bd001e0cffec22d2fd09af6b994f6cc60f973df3cc44de265cdfd1d4d32` Request headers Referer http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 1668 Content-Type text/html Date Thu, 12 May 2022 11:20:56 GMT Keep-Alive timeout=5, max=99 Last-Modified Wed, 11 May 2022 11:07:39 GMT Server Apache
GET H/1.1	200 OK	default.css www.outitgoes.com/ Redirect Chain http://www.outitgoes.com/default.css https://www.outitgoes.com/default.css	5 KB 5 KB	105ms 24ms	Stylesheet text/css	79.170.40.67 GD-EMEA-DC-LD5
General Check archive.org Show headers Download Go to Full URL https://www.outitgoes.com/default.css Requested by Host: riscosnapaisagem.ptservidor.net URL: http://riscosnapaisagem.ptservidor.net/webmail-admin/%C3%9Cberpr%C3%BCfung/mail.htm?cmd=LOB=RBGLogon&_pageLabel=page_logonform&secured_page Protocol HTTP/1.1 Server 79.170.40.67 Leeds, United Kingdom, ASN20738 (GD-EMEA-DC-LD5, DE), Reverse DNS www.outitgoes.com Software Apache/2.2.34 (Red Hat) / Resource Hash `9995407957e06b460ebdef847f2966698845231a2887aadc3ac1706193464002` Request headers accept-language de-DE,de;q=0.9 Referer http://riscosnapaisagem.ptservidor.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 12 May 2022 11:20:58 GMT last-modified Wed, 29 Oct 2008 11:04:00 GMT server Apache/2.2.34 (Red Hat) accept-ranges bytes etag "4b00b49-122a-45a62523f0800" content-length 4650 content-type text/css Redirect headers location https://www.outitgoes.com/default.css content-length 0
GET H/1.1	200 OK	login_panel_gradient.jpg www.outitgoes.com/ Redirect Chain http://www.outitgoes.com/login_panel_gradient.jpg https://www.outitgoes.com/login_panel_gradient.jpg	12 KB 13 KB	24ms 23ms	Image image/jpeg	79.170.40.67 GD-EMEA-DC-LD5
General Check archive.org Show headers Download Go to Show image Full URL https://www.outitgoes.com/login_panel_gradient.jpg Protocol HTTP/1.1 Server 79.170.40.67 Leeds, United Kingdom, ASN20738 (GD-EMEA-DC-LD5, DE), Reverse DNS www.outitgoes.com Software Apache/2.2.34 (Red Hat) / Resource Hash `f3297b1306f3704663aff9483c7e6e983a27eaf9f0567d58995128a11b75f2c3` Request headers accept-language de-DE,de;q=0.9 Referer http://riscosnapaisagem.ptservidor.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 12 May 2022 11:20:58 GMT last-modified Wed, 29 Oct 2008 11:04:00 GMT server Apache/2.2.34 (Red Hat) accept-ranges bytes etag "4b00b53-31ba-45a62523f0800" content-length 12730 content-type image/jpeg Redirect headers location https://www.outitgoes.com/login_panel_gradient.jpg content-length 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

riscosnapaisagem.ptservidor.net
tinyurl.com
www.outitgoes.com
185.32.190.38
2606:4700:10::ac43:1e1
79.170.40.67
9995407957e06b460ebdef847f2966698845231a2887aadc3ac1706193464002
e9879bd001e0cffec22d2fd09af6b994f6cc60f973df3cc44de265cdfd1d4d32
f3297b1306f3704663aff9483c7e6e983a27eaf9f0567d58995128a11b75f2c3

riscosnapaisagem.ptservidor.net Open in urlscan Pro 185.32.190.38 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

0 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

20 kBTransfer

19 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

riscosnapaisagem.ptservidor.net Open in urlscan Pro
185.32.190.38 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

20 kB
Transfer

19 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!