ludicando.com.br Open in urlscan Pro
2606:4700:30::681b:a18a Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a...
Submission: On April 27 via automatic, source openphish (April 27th 2019, 5:09:12 pm UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2606:4700:30::681b:a18a, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is ludicando.com.br.

This is the only time ludicando.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ziggo (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:30:... 2606:4700:30::681b:a18a	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5	8.247.2.183 8.247.2.183	3356 (LEVEL3) (LEVEL3 - Level 3 Parent)
4	8.247.18.183 8.247.18.183	3356 (LEVEL3) (LEVEL3 - Level 3 Parent)
11	3

2 2606:4700:30::681b:a18a (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ludicando.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 8.247.2.183 (United States)

ASN3356 (LEVEL3 - Level 3 Parent, LLC, US)

www.ziggo.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 8.247.18.183 (United States)

ASN3356 (LEVEL3 - Level 3 Parent, LLC, US)

www.ziggo.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	ziggo.nl www.ziggo.nl	116 KB
2	ludicando.com.br ludicando.com.br	103 KB
11	2

	Domain	Requested by
9	www.ziggo.nl	ludicando.com.br
2	ludicando.com.br	ludicando.com.br
11	2

This site contains no links.

Subject Issuer	Validity	Valid
www.ziggo.nl QuoVadis Global SSL ICA G3	`2019-04-10` - `2021-04-10`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm
Frame ID: E7ECC50E1A6E6F037A4AAA6C4938640C
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<div class="[^"]*parbase/i
script /\/etc\/designs\//i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<div class="[^"]*parbase/i
script /\/etc\/designs\//i

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+foundation[^>"]+css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

11
Requests

82 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

220 kB
Transfer

470 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set vergoeding.htm Show response
ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/ 12 KB
3 KB 38ms
32ms Document
text/html 2606:4700:30::681b:a18a
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:a18a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / EasyEngine 3.7.4
Resource Hash: 3167ee7b090a0530aae5c5f51f23bb79ef250a04a801efdd4c074f602153cba1

Request headers

Host: ludicando.com.br
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 27 Apr 2019 17:08:54 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dd9db83af4fe81caa81172c694b2b63871556384934; expires=Sun, 26-Apr-20 17:08:54 GMT; path=/; domain=.ludicando.com.br; HttpOnly
Last-Modified: Sat, 27 Apr 2019 16:24:32 GMT
Vary: Accept-Encoding
X-Powered-By: EasyEngine 3.7.4
Server: cloudflare
CF-RAY: 4ce266b22c6e97aa-FRA
Content-Encoding: gzip

GET
H/1.1 200
OK main.min.6f170ad3506a512a7f64a063d89bad8c.css
www.ziggo.nl/etc/clientlibs/foundation/ 9 KB
2 KB 175ms
29ms Stylesheet
text/css 8.247.2.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/clientlibs/foundation/main.min.6f170ad3506a512a7f64a063d89bad8c.css

Requested by

Host: ludicando.com.br
URL: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.2.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

cb869f72761897c7acbce179ab01bf112396e95620a04443ee819ec87f66598b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
Content-Encoding: gzip
x-content-type-options: nosniff
p3p: CP="NON CUR OTPi OUR NOR UNI"
Connection: keep-alive
Content-Length: 1840
x-xss-protection: 1; mode=block
Last-Modified: Mon, 01 Apr 2019 04:37:52 GMT
Date: Sat, 27 Apr 2019 17:08:54 GMT
Vary: Accept-Encoding
strict-transport-security: max-age=31536000
Content-Type: text/css;charset=utf-8
access-control-allow-origin: *
Cache-Control: max-age=2592000
ETag: W/"2225-5857095614cbb"
Accept-Ranges: bytes
Expires: Wed, 01 May 2019 04:37:52 GMT

GET
H/1.1 200
OK main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
www.ziggo.nl/etc/designs/ziggo-nl/css/ 219 KB
30 KB 176ms
31ms Stylesheet
text/css 8.247.2.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.2.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

d75dc7ddc4ceea023b09a6afb66729113c01dab4ad080d36f0bdcc2ff3aff0eb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
Content-Encoding: gzip
x-content-type-options: nosniff
p3p: CP="NON CUR OTPi OUR NOR UNI"
Connection: keep-alive
Content-Length: 30210
x-xss-protection: 1; mode=block
Last-Modified: Mon, 01 Apr 2019 03:12:52 GMT
Date: Sat, 27 Apr 2019 17:08:54 GMT
Vary: Accept-Encoding
strict-transport-security: max-age=31536000
Content-Type: text/css;charset=utf-8
access-control-allow-origin: *
Cache-Control: max-age=2592000
ETag: W/"36c15-5856f656a2a6f"
Accept-Ranges: bytes
Expires: Wed, 01 May 2019 03:12:52 GMT

GET
H/1.1 200
OK form.min.4e81c809efab4b0034dc79eed4223a6f.css
www.ziggo.nl/etc/designs/ziggo-nl/css/components/ 60 KB
9 KB 175ms
30ms Stylesheet
text/css 8.247.2.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/ziggo-nl/css/components/form.min.4e81c809efab4b0034dc79eed4223a6f.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.2.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

c38ec34dba518aefe32de1ecadddbfbf2f1ec42bd7aa4a5870f285552cc4037e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
Content-Encoding: gzip
X-Content-Type-Options: nosniff
p3p: CP="NON CUR OTPi OUR NOR UNI"
Connection: keep-alive
Content-Length: 9021
X-XSS-Protection: 1; mode=block
Last-Modified: Mon, 01 Apr 2019 08:57:15 GMT
Date: Sat, 27 Apr 2019 17:08:54 GMT
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
Content-Type: text/css;charset=utf-8
access-control-allow-origin: *
Cache-Control: max-age=2592000
ETag: W/"ef72-5857434fc5696"
Accept-Ranges: bytes
Expires: Wed, 01 May 2019 08:57:15 GMT

GET
H/1.1 200
OK ziggo_logo.png
www.ziggo.nl/etc/designs/ziggo-nl/media/logos/ 8 KB
8 KB 175ms
30ms Image
image/png 8.247.2.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ziggo.nl/etc/designs/ziggo-nl/media/logos/ziggo_logo.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.2.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

0626b1f8ba03d1e775fcec7d968c8779cb9c39c00df453184cf31b5d96f2feaf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Last-Modified: Sat, 27 Apr 2019 14:00:08 GMT
ETag: "1e6f-58783780b9c6c"
Strict-Transport-Security: max-age=31536000
p3p: CP="NON CUR OTPi OUR NOR UNI"
Cache-Control: max-age=2592000
Date: Sat, 27 Apr 2019 17:08:54 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 7791
X-XSS-Protection: 1; mode=block
Expires: Mon, 27 May 2019 14:17:59 GMT

GET
H/1.1 200
OK loadingindicator.min.e2b09fbd802ac3f34bfd356b0d641626.e2b09fbd802ac3f34bfd356b0d641626.js Show response
www.ziggo.nl/etc/designs/ziggo-nl/js/components/ 766 B
959 B 176ms
31ms Script
application/x-javascript 8.247.2.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/ziggo-nl/js/components/loadingindicator.min.e2b09fbd802ac3f34bfd356b0d641626.e2b09fbd802ac3f34bfd356b0d641626.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.2.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

12ce49917126abd96b1c8e512e22b7a33be24a2be99ef591ce91fc51450206b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
Content-Encoding: gzip
x-content-type-options: nosniff
p3p: CP="NON CUR OTPi OUR NOR UNI"
Connection: keep-alive
Content-Length: 392
x-xss-protection: 1; mode=block
Last-Modified: Mon, 01 Apr 2019 15:02:29 GMT
Date: Sat, 27 Apr 2019 17:08:54 GMT
Vary: Accept-Encoding
strict-transport-security: max-age=31536000
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=2592000
ETag: W/"2fe-585794f291ad8"
Accept-Ranges: bytes
Expires: Wed, 01 May 2019 15:02:29 GMT

GET
H/1.1 200
OK puub.png
ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/ 99 KB
100 KB 14ms
10ms Image
image/png 2606:4700:30::681b:a18a
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/puub.png
Requested by: Host: ludicando.com.br
URL: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:a18a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f249add9b41b2ad5463c65832f80d1005ddcfff59a839d12d29dc2a9f43a7ce

Request headers

Referer: http://ludicando.com.br/wp-admin/img/www.ziggo.nl/login/e2451eb88e0d153587e7ab6acc89d8423f5cd5cc40610f061ffe635d7ea46d3a14bfcbb74de652baa9bbc32b0e322f51/vergoeding.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 27 Apr 2019 17:08:54 GMT
CF-Cache-Status: HIT
Last-Modified: Sat, 27 Apr 2019 16:24:32 GMT
Server: cloudflare
ETag: "5cc48240-18dec"
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 4ce266b26d0a97aa-FRA
Content-Length: 101868
Expires: Tue, 24 Apr 2029 17:08:54 GMT

GET
H/1.1 200
OK museosans_900-webfont.woff2
www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/ 17 KB
17 KB 195ms
21ms Font
application/font-woff2 8.247.18.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/museosans_900-webfont.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.18.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

43ef2963ba6db6f7edf6d5f0e0cf6d91a8d2fc663d8bcf1cee98b916cc6eb7bf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
Origin: http://ludicando.com.br

Response headers

content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
Last-Modified: Wed, 10 Apr 2019 05:30:03 GMT
ETag: "438c-586265ca3489b:dtagent10131171206150117F2lW"
strict-transport-security: max-age=31536000
p3p: CP="NON CUR OTPi OUR NOR UNI"
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Date: Sat, 27 Apr 2019 17:08:55 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/font-woff2
Content-Length: 17292
x-xss-protection: 1; mode=block
Expires: Fri, 10 May 2019 05:43:51 GMT

GET
H/1.1 200
OK museosans_700-webfont.woff2
www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/ 17 KB
18 KB 196ms
22ms Font
application/octet-stream 8.247.18.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/museosans_700-webfont.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.18.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

2408e86e87c5df52e8160530980e94acf40b083adb5f330abd9ad21b5b5f65e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
Origin: http://ludicando.com.br

Response headers

content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
Last-Modified: Wed, 24 Apr 2019 05:45:21 GMT
ETag: W/"458c-58740351bea66:dtagent10131171206150117F2lW"
strict-transport-security: max-age=31536000
p3p: CP="NON CUR OTPi OUR NOR UNI"
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Date: Sat, 27 Apr 2019 17:08:55 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 17804
x-xss-protection: 1; mode=block
Expires: Wed, 01 May 2019 05:45:22 GMT

GET
H/1.1 200
OK museosans_500-webfont.woff2
www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/ 17 KB
18 KB 194ms
20ms Font
application/font-woff2 8.247.18.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/upc-generic/media/webfonts/museo/museosans_500-webfont.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.18.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

26d51505332c23d6cbda9334670d7311bbb034572931905ecd97e7783a15c3db

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
Origin: http://ludicando.com.br

Response headers

content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
Last-Modified: Wed, 10 Apr 2019 05:30:14 GMT
ETag: "44d4-586265d45214e:dtagent10131171206150117F2lW"
strict-transport-security: max-age=31536000
p3p: CP="NON CUR OTPi OUR NOR UNI"
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Date: Sat, 27 Apr 2019 17:08:55 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/font-woff2
Content-Length: 17620
x-xss-protection: 1; mode=block
Expires: Fri, 10 May 2019 05:44:04 GMT

GET
H/1.1 200
OK ziggonl.woff2
www.ziggo.nl/etc/designs/upc-generic/media/webfonts/glyphs/ 12 KB
12 KB 198ms
24ms Font
application/font-woff2 8.247.18.183
Level 3 Parent

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ziggo.nl/etc/designs/upc-generic/media/webfonts/glyphs/ziggonl.woff2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

8.247.18.183 , United States, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US),

Reverse DNS

Software

Resource Hash

69d3b9d8d69a8fbedeadc58f1864ddabf1ee0895210d6b7fa4b6749a22ae939d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.ziggo.nl/etc/designs/ziggo-nl/css/main.min.2f2c446e3fcf7cebcd25771a3bad2e62.css
Origin: http://ludicando.com.br

Response headers

content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
Last-Modified: Wed, 10 Apr 2019 05:00:02 GMT
ETag: "2f94-58625f14cb0d9:dtagent10131171206150117F2lW"
strict-transport-security: max-age=31536000
p3p: CP="NON CUR OTPi OUR NOR UNI"
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Date: Sat, 27 Apr 2019 17:08:55 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/font-woff2
Content-Length: 12180
x-xss-protection: 1; mode=block
Expires: Fri, 10 May 2019 06:08:05 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ziggo (Telecommunication)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| LGI

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ludicando.com.br/	1970-01-19 09:05:20	Name: __cfduid Value: dd9db83af4fe81caa81172c694b2b63871556384934

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ludicando.com.br
www.ziggo.nl
2606:4700:30::681b:a18a
8.247.18.183
8.247.2.183
0626b1f8ba03d1e775fcec7d968c8779cb9c39c00df453184cf31b5d96f2feaf
12ce49917126abd96b1c8e512e22b7a33be24a2be99ef591ce91fc51450206b8
1f249add9b41b2ad5463c65832f80d1005ddcfff59a839d12d29dc2a9f43a7ce
2408e86e87c5df52e8160530980e94acf40b083adb5f330abd9ad21b5b5f65e8
26d51505332c23d6cbda9334670d7311bbb034572931905ecd97e7783a15c3db
3167ee7b090a0530aae5c5f51f23bb79ef250a04a801efdd4c074f602153cba1
43ef2963ba6db6f7edf6d5f0e0cf6d91a8d2fc663d8bcf1cee98b916cc6eb7bf
69d3b9d8d69a8fbedeadc58f1864ddabf1ee0895210d6b7fa4b6749a22ae939d
c38ec34dba518aefe32de1ecadddbfbf2f1ec42bd7aa4a5870f285552cc4037e
cb869f72761897c7acbce179ab01bf112396e95620a04443ee819ec87f66598b
d75dc7ddc4ceea023b09a6afb66729113c01dab4ad080d36f0bdcc2ff3aff0eb

ludicando.com.br Open in urlscan Pro 2606:4700:30::681b:a18a Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

82 %HTTPS

33 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

220 kBTransfer

470 kBSize

1 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

ludicando.com.br Open in urlscan Pro
2606:4700:30::681b:a18a Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

220 kB
Transfer

470 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!