here.clinica-rra.com.br
Open in
urlscan Pro
108.167.171.66
Malicious Activity!
Public Scan
URL:
https://here.clinica-rra.com.br/shafy/98328GH/index.php?FGDD=1
Submission: On December 29 via api from US — Scanned from US
Submission: On December 29 via api from US — Scanned from US
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 22 HTTP transactions.
The main IP is 108.167.171.66, located in
United States and
belongs to NETWORK-SOLUTIONS-HOSTING, US.
The main domain is here.clinica-rra.com.br.
TLS certificate: Issued by R3 on November 18th 2023. Valid for: 3 months.
This is the only time here.clinica-rra.com.br was scanned on urlscan.io!
TLS certificate: Issued by R3 on November 18th 2023. Valid for: 3 months.
This is the only time here.clinica-rra.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 17 | 108.167.171.66 108.167.171.66 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
| 5 | 151.8.203.134 151.8.203.134 | 1267 (ASN-WINDT...) (ASN-WINDTRE IUNET) | |
| 22 | 2 |
17
108.167.171.66
(United States)
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 108-167-171-66.unifiedlayer.com
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 108-167-171-66.unifiedlayer.com
| here.clinica-rra.com.br |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 17 |
clinica-rra.com.br
here.clinica-rra.com.br |
986 KB |
| 5 |
inosavance.it
www.inosavance.it |
|
| 22 | 2 |
| Domain | Requested by | |
|---|---|---|
| 17 | here.clinica-rra.com.br |
here.clinica-rra.com.br
|
| 5 | www.inosavance.it |
here.clinica-rra.com.br
|
| 22 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.here.clinica-rra.com.br R3 |
2023-11-18 - 2024-02-16 |
3 months | crt.sh |
| www.inosavance.it R3 |
2023-11-19 - 2024-02-17 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://here.clinica-rra.com.br/shafy/98328GH/index.php?FGDD=1
Frame ID: 5AE8A68CA9FFBA6C9FCC340C6E6C639F
Requests: 16 HTTP requests in this frame
Frame:
https://here.clinica-rra.com.br/shafy/98328GH/X911/adrum-xd.99c2fcc5ccc30ea4d38a1a74eeb7a6a6.html
Frame ID: 0F21AAAD817CD34E2628AD0409CCC434
Requests: 6 HTTP requests in this frame
Screenshot
Page Title
| DHL |In transitIn transitIn transitIn transitIn transitIn transitDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
AppDynamics
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- adrum
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.php
here.clinica-rra.com.br/shafy/98328GH/ |
422 KB 162 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common-core_SHF.css
www.inosavance.it/styleDHL/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles.5b3e5351d5009950b08d.css
www.inosavance.it/styleDHL/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
X911.css
www.inosavance.it/styleDHL/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
font-awesome.min.css
www.inosavance.it/styleDHL/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
www.inosavance.it/styleDHL/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap-icons.css
here.clinica-rra.com.br/shafy/98328GH/X911/ |
64 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dhl-logo.svg
here.clinica-rra.com.br/shafy/98328GH/X911/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
LOGA.svg
here.clinica-rra.com.br/shafy/98328GH/X911/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
LOGAA.svg
here.clinica-rra.com.br/shafy/98328GH/X911/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
US.png
here.clinica-rra.com.br/shafy/98328GH/X911/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
adrum-xd.99c2fcc5ccc30ea4d38a1a74eeb7a6a6.html
here.clinica-rra.com.br/shafy/98328GH/X911/ Frame 0F21 |
2 KB 899 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.1.min.js
here.clinica-rra.com.br/shafy/98328GH/X911/ |
88 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.bundle.min.js
here.clinica-rra.com.br/shafy/98328GH/X911/ |
77 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.min.js
here.clinica-rra.com.br/shafy/98328GH/X911/ |
1 MB 627 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.mask.min.js
here.clinica-rra.com.br/shafy/98328GH/X911/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
here.clinica-rra.com.br/cgi-sys/css/ Frame 0F21 |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fonts.css
here.clinica-rra.com.br/cgi-sys/css/ Frame 0F21 |
3 KB 397 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
custom_404.css
here.clinica-rra.com.br/cgi-sys/css/ Frame 0F21 |
807 B 407 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo-hostgator.svg
here.clinica-rra.com.br/cgi-sys/images/ Frame 0F21 |
14 KB 14 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
illustration-404.svg
here.clinica-rra.com.br/cgi-sys/images/ Frame 0F21 |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap-icons.woff2
here.clinica-rra.com.br/shafy/98328GH/X911/ |
83 KB 83 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| documentPictureInPicture function| $ function| jQuery number| uidEvent object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| $jscomp1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| here.clinica-rra.com.br/ | Name: PHPSESSID Value: c8202e0e70a3c2cc191ab4ee86681204 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
here.clinica-rra.com.br
www.inosavance.it
108.167.171.66
151.8.203.134
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
304213033f2a03071409043919d5d27d9847e0fb96c8433871ddcd7ad93fcb39
32f0b6ccf8a5c85f6782d4a14797ad8671c384658735170551032d7a22d64046
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
3aff52960928bdcfaf23c033a61d686f4e5486f43f821ff8e97a5c8bb50560bd
3fbebbcc1ebf48ebe492e6080cf7c618c15b9a23d5ae6d771b0bce47ad5753eb
481e10a2f47cb0f567bb159ab5cd606282941b246ab980b3bd13dbb02fcfe203
49452f0e40a878f7b9a0ed87721f95843fbd953a2d373ccac53c911f51c929b3
6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e
75b33be75a492ae62981cc7b7a36803c1ef4ea5dcdc6db43c11071b200c7f78e
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
856b3f9e0df4f7061c8948021c7cc6e6263d96c48161e7fe9e4fbefd0c69a085
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
b08a2fa2b897efa1b9d4ea531eb28b1f9f216eadd299cb115a1121e266a4480b
c989a169a129121f006c8fcbf90ab305d9005d516ce72cc44b4949167eed39d5
db3bddf54dea690aa25839265e3ba48668aa86636da378edf0eba51fcd783daa
dccdb14ac87583eb8ed86fe6aa4e0d2053d83484883f58e804a0fcb57301fdcc