piresecorazza.com.br Open in urlscan Pro
162.221.185.250  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://nikelebronshoescheap.com/redir.html Page URL
2. https://www.wholesalecheapjerseys-china.com/redir.html Page URL
3. http://piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/dep.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set redir.html Show response nikelebronshoescheap.com/	189 B 670 B	368ms 325ms	Document text/html	2606:4700:3033::6818:7834 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://nikelebronshoescheap.com/redir.html Protocol HTTP/1.1 Server 2606:4700:3033::6818:7834 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5dd44e934c2acfaba241f1d3dee2439a704ac6f366cd6a8fc312033fa60b9cdc Request headers Host nikelebronshoescheap.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Response headers Date Sun, 23 Feb 2020 05:04:25 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d12f57e91716c575a6ba40a5a99835a461582434264; expires=Tue, 24-Mar-20 05:04:24 GMT; path=/; domain=.nikelebronshoescheap.com; HttpOnly; SameSite=Lax Last-Modified Sun, 02 Feb 2020 23:43:08 GMT Vary Accept-Encoding CF-Cache-Status DYNAMIC Server cloudflare CF-RAY 5696a8ab3adcd6f1-FRA Content-Encoding gzip
GET H2	200	redir.html Show response www.wholesalecheapjerseys-china.com/	211 B 504 B	384ms 334ms	Document text/html	2606:4700:3036::6812:35b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.wholesalecheapjerseys-china.com/redir.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6812:35b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3b2111df77778128d3732b644afc854cc575521000710b88bd3a6c0ac9810d4a Request headers :method GET :authority www.wholesalecheapjerseys-china.com :scheme https :path /redir.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer http://nikelebronshoescheap.com/redir.html accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest document Referer http://nikelebronshoescheap.com/redir.html Response headers status 200 date Sun, 23 Feb 2020 05:04:25 GMT content-type text/html set-cookie __cfduid=d54b65168c56fc74dc8c7c8935d83285f1582434265; expires=Tue, 24-Mar-20 05:04:25 GMT; path=/; domain=.wholesalecheapjerseys-china.com; HttpOnly; SameSite=Lax last-modified Tue, 11 Feb 2020 12:30:08 GMT cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5696a8ae2ebd0ea7-FRA content-encoding br
GET H/1.1	200 OK	Primary Request dep.html Show response piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/	2 KB 1 KB	635ms 463ms	Document text/html	162.221.185.250 DIMENOC
General Check archive.org Show headers Download Go to Full URL http://piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/dep.html Protocol HTTP/1.1 Server 162.221.185.250 Orlando, United States, ASN33182 (DIMENOC, US), Reverse DNS server.dedicadomvf4.com Software nginx / Resource Hash dd5171d1928f8e05ffedf4a5318ca2f507df9aef2a67b0e008def943ed10cb58 Request headers Host piresecorazza.com.br Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Response headers Server nginx Date Sun, 23 Feb 2020 05:04:26 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Last-Modified Tue, 11 Feb 2020 12:03:29 GMT ETag W/"18402c9-6ae-59e4ba4d96640" Content-Encoding gzip
GET H/1.1	200 OK	image-dep.css piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/files/	2 KB 1 KB	179ms 122ms	Stylesheet text/css	162.221.185.250 DIMENOC
General Check archive.org Show headers Download Go to Full URL http://piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/files/image-dep.css Requested by Host: piresecorazza.com.br URL: http://piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/dep.html Protocol HTTP/1.1 Server 162.221.185.250 Orlando, United States, ASN33182 (DIMENOC, US), Reverse DNS server.dedicadomvf4.com Software nginx / Resource Hash 0cebb459543d10ef48c7b23df5f297e60994ea25687910ad16325e5d04c5038c Request headers Referer http://piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/dep.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Response headers Date Sun, 23 Feb 2020 05:04:26 GMT Content-Encoding gzip Last-Modified Tue, 11 Feb 2020 12:03:29 GMT Server nginx ETag W/"18402e3-9f3-59e4ba4df36ee" Transfer-Encoding chunked Content-Type text/css Connection keep-alive
GET H/1.1	200 OK	back-dep.PNG piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/files/	559 KB 559 KB	124ms 123ms	Image image/png	162.221.185.250 DIMENOC
General Check archive.org Show headers Download Go to Show image Full URL http://piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/files/back-dep.PNG Protocol HTTP/1.1 Server 162.221.185.250 Orlando, United States, ASN33182 (DIMENOC, US), Reverse DNS server.dedicadomvf4.com Software nginx / Resource Hash 22bbb26f8f5baa7b6ceb4b3dd3f5f36adbca9e7c2efa315f011c58ea1b891941 Request headers Referer http://piresecorazza.com.br/app/views/admin/SecuriPass/agri-mob/Dir/files/image-dep.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Response headers Date Sun, 23 Feb 2020 05:04:26 GMT Last-Modified Tue, 11 Feb 2020 12:03:29 GMT Server nginx ETag "18402d3-8bbe3-59e4ba4df003f" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 572387

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nikelebronshoescheap.com
piresecorazza.com.br
www.wholesalecheapjerseys-china.com
162.221.185.250
2606:4700:3033::6818:7834
2606:4700:3036::6812:35b8
0cebb459543d10ef48c7b23df5f297e60994ea25687910ad16325e5d04c5038c
22bbb26f8f5baa7b6ceb4b3dd3f5f36adbca9e7c2efa315f011c58ea1b891941
3b2111df77778128d3732b644afc854cc575521000710b88bd3a6c0ac9810d4a
5dd44e934c2acfaba241f1d3dee2439a704ac6f366cd6a8fc312033fa60b9cdc
dd5171d1928f8e05ffedf4a5318ca2f507df9aef2a67b0e008def943ed10cb58