urlscan.io logo urlscan.io
SecurityTrails logo

guestconnects-guestconnects-guestconnects.victorduarte.com.br Open in urlscan Pro
188.166.21.225  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=google.com.////amp/s/%e2%80%8bma%c2%adgick%c2%adnu...
Effective URL: https://guestconnects-guestconnects-guestconnects.victorduarte.com.br/?777=aw5mb0bhy3muymg=$%C3%A3%C2%80%C2%82
Submission: On September 06 via manual from BH — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 5 domains to perform 3 HTTP transactions. The main IP is 188.166.21.225, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is guestconnects-guestconnects-guestconnects.victorduarte.com.br.
TLS certificate: Issued by E5 on August 30th 2024. Valid for: 3 months.
This is the only time guestconnects-guestconnects-guestconnects.victorduarte.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 2.21.20.146 20940 (AKAMAI-ASN1)
2 2 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
2 103.20.200.105 38719 (DREAMSCAP...)
1 188.166.21.225 14061 (DIGITALOC...)
3 3
1    2.21.20.146 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-21-20-146.deploy.static.akamaitechnologies.com
www.tiktok.com
2    2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
google.com.
google.com
1    2a00:1450:4001:81d::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    103.20.200.105 (Australia)

ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: server-2x-r65.ipv4.syd02.ds.network
magicknumbers.com.au
1    188.166.21.225 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
guestconnects-guestconnects-guestconnects.victorduarte.com.br
Apex Domain
Subdomains		 Transfer
2 magicknumbers.com.au
magicknumbers.com.au
534 B
2 google.com
google.com — Cisco Umbrella Rank: 1
www.google.com — Cisco Umbrella Rank: 10
47 B
1 victorduarte.com.br
guestconnects-guestconnects-guestconnects.victorduarte.com.br
107 KB
1 com.
google.com.
15 B
1 tiktok.com
www.tiktok.com — Cisco Umbrella Rank: 3787
3 KB
3 5
Domain Requested by
2 magicknumbers.com.au
1 guestconnects-guestconnects-guestconnects.victorduarte.com.br
1 www.google.com 1 redirects
1 google.com 1 redirects
1 google.com. 1 redirects
1 www.tiktok.com 1 redirects
3 6

This site contains no links.

Subject Issuer Validity Valid
magicknumbers.com.au
USERTrust RSA Domain Validation Secure Server CA		 2023-12-28 -
2025-01-27		 a year crt.sh
victorduarte.com.br
E5		 2024-08-30 -
2024-11-28		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://guestconnects-guestconnects-guestconnects.victorduarte.com.br/?777=aw5mb0bhy3muymg=$%C3%A3%C2%80%C2%82
Frame ID: 23C03B62D37C0C4A6DBB43F27448EEFF
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

reCAPTCHA

Page Statistics

3
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

3
IPs

3
Countries

108 kB
Transfer

267 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=google.com.////amp/s/%e2%80%8bma%c2%adgick%c2%adnum%c2%adbers%e2%80%8b.%c2%adc%c2%ado%c2%adm%e2%80%8b.%c2%ada%c2%adu/dayo/z6nhj/aw5mb0bhy3muymg=$%e3%80%82 HTTP 302
  • https://google.com.////amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82?safe=active HTTP 301
  • https://google.com/amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82?safe=active HTTP 301
  • https://www.google.com/amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82?safe=active HTTP 302
  • https://magicknumbers.com.au/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
aw5mb0bhy3muymg=$%E3%80%82
magicknumbers.com.au/dayo/z6nhj/
Redirect Chain
  • https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=google.com.////amp/s/%e2%80%8bma%c2%adgick%c2%adnum%c2%adbers%e2%80%8b.%c2%adc%c2%ado%c2%adm%e2%80%8b.%c2%ada%c2%adu/dayo/z6nhj/...
  • https://google.com.////amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82?safe=active
  • https://google.com/amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82?safe=active
  • https://www.google.com/amp/s/%E2%80%8Bma%C2%ADgick%C2%ADnum%C2%ADbers%E2%80%8B.%C2%ADc%C2%ADo%C2%ADm%E2%80%8B.%C2%ADa%C2%ADu/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82?safe=active
  • https://magicknumbers.com.au/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82
0
169 B 		Document
General
Check archive.org
Download Go to
Full URL
https://magicknumbers.com.au/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.20.200.105 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server-2x-r65.ipv4.syd02.ds.network
Software
Apache / PHP/5.6.40
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-length
0
content-type
text/html; charset=UTF-8
date
Fri, 06 Sep 2024 02:36:29 GMT
refresh
0;url=https://guestconnects-guestconnects-guestconnects.victorduarte.com.br/?777=aw5mb0bhy3muymg=$。
server
Apache
x-powered-by
PHP/5.6.40

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
282
content-security-policy
object-src 'none';base-uri 'self';script-src 'nonce-N9m7pAZajccyAi8Qts7Wtg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
content-type
text/html; charset=UTF-8
cross-origin-opener-policy
same-origin-allow-popups; report-to="gws"
date
Fri, 06 Sep 2024 02:36:28 GMT
location
https://​ma­gick­num­bers​.­c­o­m​.­a­u/dayo/z6nhj/aw5mb0bhy3muymg=$。
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy
unload=()
report-to
{"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]}
server
gws
x-frame-options
SAMEORIGIN
x-robots-tag
noindex
x-xss-protection
0
Primary Request /
guestconnects-guestconnects-guestconnects.victorduarte.com.br/ 		226 KB
107 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://guestconnects-guestconnects-guestconnects.victorduarte.com.br/?777=aw5mb0bhy3muymg=$%C3%A3%C2%80%C2%82
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
188.166.21.225 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
f320bcaa08c0a3cb0672b1baf0a2367bce6c57cf8cddfba84799c6c5a05c1690

Request headers

Referer
https://magicknumbers.com.au/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 06 Sep 2024 02:36:30 GMT
server
nginx
vary
Accept-Encoding
favicon.ico
magicknumbers.com.au/ 		315 B
365 B 		Other
General
Check archive.org
Download Go to
Full URL
https://magicknumbers.com.au/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.20.200.105 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
server-2x-r65.ipv4.syd02.ds.network
Software
Apache /
Resource Hash

Request headers

Referer
https://magicknumbers.com.au/dayo/z6nhj/aw5mb0bhy3muymg=$%E3%80%82
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 06 Sep 2024 02:36:29 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1
truncated
/ 		858 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		40 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| a0r5 function| a0r4 function| onCheckBoxChange

1 Cookies

Domain/Path Name / Value
.google.com/ Name: __Secure-ENID
Value: 22.SE=X6nyjDwaEhalFM_Cvw2Kzv5WR4EWeE4GoMPgnVGjCOmv6pytFgaolMCqR9nymtbUympalYlBjVPRV4-89va_unXtLbOFHCG-l2-DKZvAcfI9ZCZWCHhEQoIhGUyfTPO1ZDPGW1Qg1Zx_9FJ9yK-SPJDcgp8PNKBjl50jExRDhSo7wo5H-SwhFryn7_k9

1 Console Messages

Source Level URL
Text
network error URL: https://magicknumbers.com.au/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()