urlscan.io logo urlscan.io
SecurityTrails logo

web.nitronews.com.br Open in urlscan Pro
192.99.38.24  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://web.nitronews.com.br/
Effective URL: https://web.nitronews.com.br/login_landing.php
Submission Tags: phishingrod
Submission: On May 16 via api from DE — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 192.99.38.24, located in Canada and belongs to OVH, FR. The main domain is web.nitronews.com.br.
TLS certificate: Issued by R3 on March 13th 2023. Valid for: 3 months.
This is the only time web.nitronews.com.br was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 10 192.99.38.24 16276 (OVH)
1 2607:f8b0:400... 15169 (GOOGLE)
2 2607:f8b0:400... 15169 (GOOGLE)
12 3
Apex Domain
Subdomains		 Transfer
7 criaenvio.com
static.criaenvio.com
51 KB
3 nitronews.com.br
web.nitronews.com.br
3 KB
2 gstatic.com
fonts.gstatic.com
46 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 50
818 B
12 4
Domain Requested by
7 static.criaenvio.com web.nitronews.com.br
static.criaenvio.com
3 web.nitronews.com.br 1 redirects static.criaenvio.com
2 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com static.criaenvio.com
12 4

This site contains no links.

Subject Issuer Validity Valid
web.nitronews.com.br
R3		 2023-03-13 -
2023-06-11		 3 months crt.sh
static.criaenvio.com
R3		 2023-05-16 -
2023-08-14		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-04-24 -
2023-07-17		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-04-24 -
2023-07-17		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://web.nitronews.com.br/login_landing.php
Frame ID: C502BDF6BD381E3CDAFA21ED8C6CCC35
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login | E-mail Marketing

Page URL History Show full URLs

  1. https://web.nitronews.com.br/ HTTP 302
    https://web.nitronews.com.br/login_landing.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

100 kB
Transfer

202 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://web.nitronews.com.br/ HTTP 302
    https://web.nitronews.com.br/login_landing.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login_landing.php
web.nitronews.com.br/
Redirect Chain
  • https://web.nitronews.com.br/
  • https://web.nitronews.com.br/login_landing.php
7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://web.nitronews.com.br/login_landing.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.38.24 , Canada, ASN16276 (OVH, FR),
Reverse DNS
producao.nitronews.com.br
Software
Apache /
Resource Hash
ceccd7e754226b5ea7e84626c3005dba669a14ddfaaf3e4dcaae621432de8c97

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
post-check=0, pre-check=0
Connection
close
Content-Encoding
gzip
Content-Length
2207
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 16 May 2023 03:43:07 GMT
Expires
Sat, 01 Jan 2000 00:00:00 GMT
Last-Modified
Tue, 16 May 2023 03:43:07 GMT
Robots
Server
Apache
Vary
Accept-Encoding

Redirect headers

Cache-Control
post-check=0, pre-check=0
Connection
close
Content-Encoding
gzip
Content-Length
20
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 16 May 2023 03:43:07 GMT
Expires
Sat, 01 Jan 2000 00:00:00 GMT
Last-Modified
Tue, 16 May 2023 03:43:07 GMT
Location
https://web.nitronews.com.br/login_landing.php
Robots
Server
Apache
Vary
Accept-Encoding
login.css
static.criaenvio.com/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.criaenvio.com/login.css?v=1526651193
Requested by
Host: web.nitronews.com.br
URL: https://web.nitronews.com.br/login_landing.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.38.24 , Canada, ASN16276 (OVH, FR),
Reverse DNS
producao.nitronews.com.br
Software
Apache /
Resource Hash
84539cf84aec8e4ad19fdc085e99d1c73075f4ffe317b229a601da430e460c25

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://web.nitronews.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Tue, 16 May 2023 03:43:07 GMT
Content-Encoding
gzip
Last-Modified
Fri, 18 May 2018 13:46:33 GMT
Server
Apache
ETag
"63c1343-1671-56c7b2e0e0040"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=5076000, public
Connection
close
Accept-Ranges
bytes
Content-Length
1659
jquery-1.8.3.min.js
static.criaenvio.com/scripts/js/ 		91 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criaenvio.com/scripts/js/jquery-1.8.3.min.js
Requested by
Host: web.nitronews.com.br
URL: https://web.nitronews.com.br/login_landing.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.38.24 , Canada, ASN16276 (OVH, FR),
Reverse DNS
producao.nitronews.com.br
Software
Apache /
Resource Hash
ba6eda7945ab8d7e57b34cc5a3dd292fa2e4c60a5ced79236ecf1a9e0f0c2d32

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://web.nitronews.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Tue, 16 May 2023 03:43:07 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jan 2018 19:14:17 GMT
Server
Apache
ETag
"640186a-16dc5-56284f44fba55"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=5076000, public
Connection
close
Accept-Ranges
bytes
Content-Length
33433
jquery.validate.min.v1.js
static.criaenvio.com/scripts/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criaenvio.com/scripts/jquery.validate.min.v1.js
Requested by
Host: web.nitronews.com.br
URL: https://web.nitronews.com.br/login_landing.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.38.24 , Canada, ASN16276 (OVH, FR),
Reverse DNS
producao.nitronews.com.br
Software
Apache /
Resource Hash
26b8bfc91ee9aaa79f90714973bf5e53d1dd9a64991056dc1ac674e1541e4ffb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://web.nitronews.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Tue, 16 May 2023 03:43:07 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jan 2018 19:14:17 GMT
Server
Apache
ETag
"640183d-54ba-56284f44dc655"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=5076000, public
Connection
close
Accept-Ranges
bytes
Content-Length
6425
jquery.validate.methods.js
static.criaenvio.com/scripts/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criaenvio.com/scripts/jquery.validate.methods.js
Requested by
Host: web.nitronews.com.br
URL: https://web.nitronews.com.br/login_landing.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.38.24 , Canada, ASN16276 (OVH, FR),
Reverse DNS
producao.nitronews.com.br
Software
Apache /
Resource Hash
b3abe798aa9e010c7432fea74704143d2191dd94584da4e61c7e6a49ffbc3b88

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://web.nitronews.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Tue, 16 May 2023 03:43:07 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jan 2018 19:14:17 GMT
Server
Apache
ETag
"6401851-ee7-56284f44e1475"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=5076000, public
Connection
close
Accept-Ranges
bytes
Content-Length
1449
scripts.js
static.criaenvio.com/scripts/ 		660 B
698 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criaenvio.com/scripts/scripts.js
Requested by
Host: web.nitronews.com.br
URL: https://web.nitronews.com.br/login_landing.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.38.24 , Canada, ASN16276 (OVH, FR),
Reverse DNS
producao.nitronews.com.br
Software
Apache /
Resource Hash
92e93dc0f629ff9c2e66293f1a0513b7669968c1a6f7a0d9b1a7bbc8aaf08da4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://web.nitronews.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Tue, 16 May 2023 03:43:07 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jan 2018 19:14:17 GMT
Server
Apache
ETag
"6401845-294-56284f4503755"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=5076000, public
Connection
close
Accept-Ranges
bytes
Content-Length
365
rounded_corners_lite.inc.js
static.criaenvio.com/scripts/ 		24 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criaenvio.com/scripts/rounded_corners_lite.inc.js
Requested by
Host: web.nitronews.com.br
URL: https://web.nitronews.com.br/login_landing.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.38.24 , Canada, ASN16276 (OVH, FR),
Reverse DNS
producao.nitronews.com.br
Software
Apache /
Resource Hash
3128fac7ce057309b25c4763e647d49b502a1af0b969e1400844bbdfbfac78e3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://web.nitronews.com.br/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Tue, 16 May 2023 03:43:07 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jan 2018 19:14:17 GMT
Server
Apache
ETag
"64018d3-61fa-56284f450c3f5"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=5076000, public
Connection
close
Accept-Ranges
bytes
Content-Length
5487
css
fonts.googleapis.com/ 		1 KB
818 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lato:300,400
Requested by
Host: static.criaenvio.com
URL: https://static.criaenvio.com/login.css?v=1526651193
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:400c:c36::5f Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7025d911099800ec6b8d8acc5cc18669d61e86753097885cb7646f86b249c03d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://static.criaenvio.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 16 May 2023 03:40:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 16 May 2023 03:13:57 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 16 May 2023 03:40:07 GMT
icon_cadeado.gif
static.criaenvio.com/imgs/login/ 		699 B
979 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.criaenvio.com/imgs/login/icon_cadeado.gif
Requested by
Host: static.criaenvio.com
URL: https://static.criaenvio.com/login.css?v=1526651193
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.38.24 , Canada, ASN16276 (OVH, FR),
Reverse DNS
producao.nitronews.com.br
Software
Apache /
Resource Hash
f44b5adcc8a9e910e372eca0f9decad85107d2f95af52e2b3e06a1a5db7dc98e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://static.criaenvio.com/login.css?v=1526651193
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Tue, 16 May 2023 03:43:07 GMT
Last-Modified
Thu, 11 Jan 2018 19:13:49 GMT
Server
Apache
ETag
"64018eb-2bb-56284f2a76955"
Content-Type
image/gif
Cache-Control
max-age=5076000, public
Connection
close
Accept-Ranges
bytes
Content-Length
699
S6u9w4BMUTPHh7USSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
115f6a626ca115d4ad5581b59275327e0e860b30330a52b0f785561332dd2429
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://web.nitronews.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 09 May 2023 17:29:45 GMT
x-content-type-options
nosniff
age
555022
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23236
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:26 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 08 May 2024 17:29:45 GMT
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://web.nitronews.com.br
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 17:08:08 GMT
x-content-type-options
nosniff
age
383519
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23580
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:17:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 10 May 2024 17:08:08 GMT
isp.php
web.nitronews.com.br/ 		11 B
234 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://web.nitronews.com.br/isp.php
Requested by
Host: static.criaenvio.com
URL: https://static.criaenvio.com/scripts/js/jquery-1.8.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.38.24 , Canada, ASN16276 (OVH, FR),
Reverse DNS
producao.nitronews.com.br
Software
Apache /
Resource Hash
9b3205c0b079de52b821eafb1d50898525f5769d6fa79bd7c00a6ef96dbabe02

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://web.nitronews.com.br/login_landing.php
X-Requested-With
XMLHttpRequest
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Tue, 16 May 2023 03:43:07 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
31
Vary
Accept-Encoding
Content-Type
text/html; charset=ISO-8859-1

Verdicts & Comments Add Verdict or Comment

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery function| MM_openBrWindow function| CarregaAjax function| arredondaConteudo boolean| isIE function| isMoz boolean| isSafari function| curvyCorners function| curvyObject function| insertAfter function| BlendColour function| IntToHex function| MakeHex function| pixelFraction function| rgb2Hex function| rgb2Array function| setOpacity function| inArray function| inArrayKey function| addEvent function| removeEvent function| format_colour function| get_style function| getElementsByClass function| newCurvyError string| baseURL

1 Cookies

Domain/Path Name / Value
web.nitronews.com.br/ Name: PHPSESSID
Value: rvspaq06qfmj1plt17usadlpj3