158.197.95.34.bc.googleusercontent.com

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 34.95.197.158, located in United States and belongs to GOOGLE, US. The main domain is 158.197.95.34.bc.googleusercontent.com.

This is the only time 158.197.95.34.bc.googleusercontent.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 8	34.95.197.158 34.95.197.158		15169 (GOOGLE) (GOOGLE)
7	1

8 34.95.197.158 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 158.197.95.34.bc.googleusercontent.com

158.197.95.34.bc.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	googleusercontent.com 1 redirects 158.197.95.34.bc.googleusercontent.com	90 KB
7	1

	Domain	Requested by
8	158.197.95.34.bc.googleusercontent.com	1 redirects 158.197.95.34.bc.googleusercontent.com
7	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll
Frame ID: 43961D5622DFCE6C674533AD4DC4A0AF
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save4.php HTTP 302
http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

89 kB
Transfer

271 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save4.php HTTP 302
http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request router_finish.php Show response 158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/ Redirect Chain http://158.197.95.34.bc.googleusercontent.com/app.juridico/_functions/gravar/home/save4.php http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll	3 KB 1 KB	224ms 223ms	Document text/html	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll Protocol HTTP/1.1 Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `7fd6386516d11c73ccf9649b59b0edf76f541bfab3b4787f0474e8957e992e38` Request headers Host 158.197.95.34.bc.googleusercontent.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Cookie PHPSESSID=baal8t37p6iflvh87jcu51sa74 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 14 Feb 2020 18:56:57 GMT Server Apache/2.4.18 (Ubuntu) Vary Accept-Encoding Content-Encoding gzip Content-Length 1108 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Fri, 14 Feb 2020 18:56:57 GMT Server Apache/2.4.18 (Ubuntu) Set-Cookie PHPSESSID=baal8t37p6iflvh87jcu51sa74; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Location ../../../router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bootstrap.css 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/	196 KB 22 KB	230ms 229ms	Stylesheet text/css	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL http://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/bootstrap.css Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll Protocol HTTP/1.1 Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `9d7e36f365c1da17289b26706a8f996d1713ee5fd647f7be43fdcbd60f464d39` Request headers Referer http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 14 Feb 2020 18:56:57 GMT Content-Encoding gzip Last-Modified Tue, 25 Jul 2017 02:11:12 GMT Server Apache/2.4.18 (Ubuntu) ETag "31161-5551ad86bb000-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 22631
GET H/1.1	200 OK	_home.css 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/	10 KB 2 KB	447ms 434ms	Stylesheet text/css	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Full URL http://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_css/_home.css Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll Protocol HTTP/1.1 Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `450f0a54063643428ac021b8b70c0f1180dce15e46e87c73b48bf77151bf4bd5` Request headers Referer http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 14 Feb 2020 18:56:58 GMT Content-Encoding gzip Last-Modified Fri, 17 May 2019 18:03:36 GMT Server Apache/2.4.18 (Ubuntu) ETag "26b5-589193392ce00-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2083
GET H/1.1	200 OK	logo2.png 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/	41 KB 41 KB	446ms 433ms	Image image/png	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL http://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/logo2.png Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll Protocol HTTP/1.1 Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `bad8117c7b23f326216e85e630e3915ea1c73387a7b7d2da61e800e96fc8b8c6` Request headers Referer http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 14 Feb 2020 18:56:58 GMT Last-Modified Wed, 16 May 2018 10:33:22 GMT Server Apache/2.4.18 (Ubuntu) ETag "a45e-56c503f7ea080" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 42078
GET H/1.1	200 OK	30horas.png 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/	3 KB 3 KB	445ms 432ms	Image image/png	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL http://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/30horas.png Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll Protocol HTTP/1.1 Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `30bdac7863e281c4a40fd3486434041fafa2fa73ecc77c8efb6ea785bd2a0ba9` Request headers Referer http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 14 Feb 2020 18:56:58 GMT Last-Modified Tue, 18 Dec 2018 01:36:34 GMT Server Apache/2.4.18 (Ubuntu) ETag "c60-57d41ed788c80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3168
GET H/1.1	200 OK	empresa.png 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/	4 KB 4 KB	447ms 434ms	Image image/png	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL http://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/empresa.png Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll Protocol HTTP/1.1 Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `305548fd47969838632e728513aeaa10fa877cdc2760440163f8f0a0b001c179` Request headers Referer http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 14 Feb 2020 18:56:58 GMT Last-Modified Tue, 18 Dec 2018 01:25:52 GMT Server Apache/2.4.18 (Ubuntu) ETag "eb0-57d41c7346800" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3760
GET H/1.1	200 OK	loading.gif 158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/	14 KB 15 KB	446ms 433ms	Image image/gif	34.95.197.158 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL http://158.197.95.34.bc.googleusercontent.com/app.juridico/_assets/_img/home/loading.gif Requested by Host: 158.197.95.34.bc.googleusercontent.com URL: http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll Protocol HTTP/1.1 Server 34.95.197.158 , United States, ASN15169 (GOOGLE, US), Reverse DNS 158.197.95.34.bc.googleusercontent.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `4c421aab8d61e958d50547c91cef51de755fc37ef25b6fbf735b1fb3cfa14d93` Request headers Referer http://158.197.95.34.bc.googleusercontent.com/app.juridico/router-app/router_finish.php?secury=15,56,57,PM,44,2,02,000000,14,3,2020,Friday;.dll User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 14 Feb 2020 18:56:58 GMT Last-Modified Sun, 16 Dec 2018 15:16:18 GMT Server Apache/2.4.18 (Ubuntu) ETag "38f7-57d2525621480" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 14583

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| Cod function| SetNovo

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			158.197.95.34.bc.googleusercontent.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: baal8t37p6iflvh87jcu51sa74

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

158.197.95.34.bc.googleusercontent.com
34.95.197.158
305548fd47969838632e728513aeaa10fa877cdc2760440163f8f0a0b001c179
30bdac7863e281c4a40fd3486434041fafa2fa73ecc77c8efb6ea785bd2a0ba9
450f0a54063643428ac021b8b70c0f1180dce15e46e87c73b48bf77151bf4bd5
4c421aab8d61e958d50547c91cef51de755fc37ef25b6fbf735b1fb3cfa14d93
7fd6386516d11c73ccf9649b59b0edf76f541bfab3b4787f0474e8957e992e38
9d7e36f365c1da17289b26706a8f996d1713ee5fd647f7be43fdcbd60f464d39
bad8117c7b23f326216e85e630e3915ea1c73387a7b7d2da61e800e96fc8b8c6

158.197.95.34.bc.googleusercontent.com Open in urlscan Pro 34.95.197.158 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

89 kBTransfer

271 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

158.197.95.34.bc.googleusercontent.com Open in urlscan Pro
34.95.197.158 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

89 kB
Transfer

271 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!