blog.adrifaralli.com.br Open in urlscan Pro
2001:129c:3000::7  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response blog.adrifaralli.com.br/AAd/	10 KB 4 KB	661ms 203ms	Document text/html	2001:129c:3000::7 Durand do Brasil ...
General Check archive.org Show headers Download Go to Full URL http://blog.adrifaralli.com.br/AAd/ Protocol HTTP/1.1 Server 2001:129c:3000::7 , Brazil, ASN22356 (Durand do Brasil Ltda, BR), Reverse DNS Software Protected by COMODO WAF / Resource Hash c158f754efa7cbf6cf18978e85b066d52b8178ab17a1e8550b13fc6dc3318244 Request headers Host blog.adrifaralli.com.br Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 02 Jul 2021 17:03:49 GMT Server Protected by COMODO WAF Last-Modified Tue, 15 Jun 2021 07:10:30 GMT ETag "2762-5c4c8ab4ce580-gzip" Accept-Ranges bytes Cache-Control max-age=600 Expires Fri, 02 Jul 2021 17:13:49 GMT Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 3598 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	pdf.js Show response excel567.oss-ap-southeast-3.aliyuncs.com/	181 KB 181 KB	794ms 180ms	Script text/javascript	47.254.218.18 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://excel567.oss-ap-southeast-3.aliyuncs.com/pdf.js Requested by Host: blog.adrifaralli.com.br URL: http://blog.adrifaralli.com.br/AAd/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 47.254.218.18 Kuala Lumpur, Malaysia, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software AliyunOSS / Resource Hash 6cab6302925da235ec5632832808c81778160083b10964f7dffe8208ea939f78 Request headers Referer http://blog.adrifaralli.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-oss-object-type Normal Date Fri, 02 Jul 2021 17:06:17 GMT x-oss-request-id 60DF4789F3A69537310B586C Last-Modified Wed, 26 Aug 2020 11:07:54 GMT Server AliyunOSS Content-MD5 o5OvPEma6FhwuNJjxH8Nmg== ETag "A393AF3C499AE85870B8D263C47F0D9A" Content-Type text/javascript x-oss-storage-class Standard Connection keep-alive Accept-Ranges bytes x-oss-hash-crc64ecma 135300777932460248 Content-Length 185310 x-oss-server-time 12
GET H/1.1	200 OK	a9bfcce0-422b-46e4-9074-3147cbc03390%2Fbg.jpg cdn.glitch.com/	115 KB 115 KB	85ms 28ms	Image image/jpeg	65.9.77.61 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.glitch.com/a9bfcce0-422b-46e4-9074-3147cbc03390%2Fbg.jpg?v=1600376573408 Requested by Host: blog.adrifaralli.com.br URL: http://blog.adrifaralli.com.br/AAd/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 65.9.77.61 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 2a8281ebaeee4dbc6452cbca892800ebae3b1159afe72ae30313b1c9262f0667 Request headers Referer http://blog.adrifaralli.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 26 Feb 2021 22:23:41 GMT Via 1.1 e10153740ff95eb4d0c9f3172baeb43e.cloudfront.net (CloudFront) Age 10867356 X-Cache Hit from cloudfront Connection keep-alive Content-Length 117459 Last-Modified Thu, 17 Sep 2020 21:02:53 GMT Server AmazonS3 ETag "6e5b76b6f1740d6d21c8d968a0364df6" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET, HEAD, POST Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=31536000 X-Amz-Cf-Pop AMS1-C1 X-Amz-Cf-Id 62w-QqQwEw3dWUEY_EyfBsRPsoy96aDcxuETEUyaman3W2Kp3rKGfg==
GET H/1.1	200 OK	a9bfcce0-422b-46e4-9074-3147cbc03390%2Ficon.ico cdn.glitch.com/	41 KB 41 KB	30ms 30ms	Image image/x-icon	65.9.77.61 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.glitch.com/a9bfcce0-422b-46e4-9074-3147cbc03390%2Ficon.ico?v=1600376585636 Requested by Host: blog.adrifaralli.com.br URL: http://blog.adrifaralli.com.br/AAd/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 65.9.77.61 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash d12161435ace47c6883360e08466508593325f134c1852b1d0e6e75d5f76adda Request headers Referer http://blog.adrifaralli.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 29 Jan 2021 10:37:56 GMT Via 1.1 e10153740ff95eb4d0c9f3172baeb43e.cloudfront.net (CloudFront) Age 13328902 X-Cache Hit from cloudfront Connection keep-alive Content-Length 41566 Last-Modified Thu, 17 Sep 2020 21:03:07 GMT Server AmazonS3 ETag "692e1c7339c359b6412f059c9c9a0474" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET, HEAD, POST Content-Type image/x-icon Access-Control-Allow-Origin * Cache-Control max-age=31536000 X-Amz-Cf-Pop AMS1-C1 X-Amz-Cf-Id Z8RSDPzxVL1Z42qSZ1ZRWf6GMBhZXujSr1Q0jIm1-ri_9hdNH1vBWw==
GET H2	200	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	25ms 9ms	Script application/javascript	2001:4de0:ac18::1:a:1a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: blog.adrifaralli.com.br URL: http://blog.adrifaralli.com.br/AAd/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Request headers Origin http://blog.adrifaralli.com.br Referer http://blog.adrifaralli.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 02 Jul 2021 17:06:17 GMT content-encoding gzip last-modified Mon, 20 Mar 2017 19:01:15 GMT server nginx etag W/"58d026fb-10fdd" vary Accept-Encoding x-hw 1625245577.dop238.fr8.t,1625245577.cds277.fr8.hn,1625245577.cds257.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 23856
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 6 KB	20ms 20ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: blog.adrifaralli.com.br URL: http://blog.adrifaralli.com.br/AAd/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Origin http://blog.adrifaralli.com.br Referer http://blog.adrifaralli.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 02 Jul 2021 17:06:17 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3188428 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 6157 cf-request-id 0a4bbcf9fe00004a912714b000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gY4g1TScR1P4ecMUS8mbbk82DTmlkCcR3y9%2Fh7gEgDEOufmsu7yFo4gDsGEIssophu46Io5a6UZ8v%2F%2BT4EharEmouY%2BVbqhbYErf9h2GNRt5vOhZ3%2FJ2HHgOHj8oNdaP%2Fr8yWFFjkqP10VzDZg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 668976b85b462b89-FRA expires Wed, 22 Jun 2022 17:06:17 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 12 KB	265ms 263ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: blog.adrifaralli.com.br URL: http://blog.adrifaralli.com.br/AAd/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin http://blog.adrifaralli.com.br Referer http://blog.adrifaralli.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 02 Jul 2021 17:06:17 GMT content-encoding br x-content-type-options nosniff cf-cache-status MISS cdn-edgestorageid 752, 617, 617, 617 access-control-allow-origin * cdn-cachedat 2021-06-20 12:56:46 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 timing-allow-origin * last-modified Mon, 25 Jan 2021 22:04:04 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid b59749311a63f2f28aaffba2908aac10 cf-ray 668976b88e312bca-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 29 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:813::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: blog.adrifaralli.com.br URL: http://blog.adrifaralli.com.br/AAd/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://blog.adrifaralli.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 02 Jul 2021 16:14:42 GMT content-encoding gzip x-content-type-options nosniff age 3095 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 02 Jul 2022 16:14:42 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 13 KB	16ms 15ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: blog.adrifaralli.com.br URL: http://blog.adrifaralli.com.br/AAd/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://blog.adrifaralli.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 02 Jul 2021 17:06:17 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 723, 718 age 8798294 cdn-cachedat 2021-03-11 11:57:52 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 48f4598378fe1b699fcee6ac68d6cc25 cf-ray 668976ba4ebc2c3a-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| bootstrap object| modal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
blog.adrifaralli.com.br
cdn.glitch.com
cdnjs.cloudflare.com
code.jquery.com
excel567.oss-ap-southeast-3.aliyuncs.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
2001:129c:3000::7
2001:4de0:ac18::1:a:1a
2606:4700::6810:135e
2606:4700::6812:acf
2a00:1450:4001:813::200a
47.254.218.18
65.9.77.61
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2a8281ebaeee4dbc6452cbca892800ebae3b1159afe72ae30313b1c9262f0667
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6cab6302925da235ec5632832808c81778160083b10964f7dffe8208ea939f78
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
c158f754efa7cbf6cf18978e85b066d52b8178ab17a1e8550b13fc6dc3318244
d12161435ace47c6883360e08466508593325f134c1852b1d0e6e75d5f76adda
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b