hml.libertrip.com.br

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3037::ac43:b097, located in United States and belongs to CLOUDFLARENET, US. The main domain is hml.libertrip.com.br.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 15th 2021. Valid for: a year.

This is the only time hml.libertrip.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
5	2606:4700:303... 2606:4700:3037::ac43:b097		13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	1

5 2606:4700:3037::ac43:b097 (United States)

ASN13335 (CLOUDFLARENET, US)

hml.libertrip.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	libertrip.com.br hml.libertrip.com.br	31 KB
5	1

	Domain	Requested by
5	hml.libertrip.com.br	hml.libertrip.com.br
5	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-15` - `2022-06-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php
Frame ID: AD8923AA715F376A50FB60DFF4EEAE66
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

31 kB
Transfer

182 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request Microsoft.php Show response hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/	39 KB 6 KB	283ms 154ms	Document text/html	2606:4700:3037::ac43:b097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:b097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `80fe77dd4141da35595cfee6f1c4da0e9d2390eff7b513ccc82b7e2a47466755` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Mon, 14 Mar 2022 13:51:53 GMT content-type text/html; charset=UTF-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache vary Accept-Encoding age 0 x-cache MISS cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pU5hVQAPBfEbR0N6yijOERiNzDEXKH%2FLLiZCdm8J7Lg373N9POZAigYnSu0IpHqvvBqNk8ceFyBnQzDk1785F%2BXDTjNLH9NTGkWXUtBAvY35xhvurdzZIAdXO26J7i3Pg79sZSBerURx5xO2Q2VRmPI3NQ%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6ebd7c93aeba5a2b-MXP content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	microsoft.css hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/css/	137 KB 21 KB	69ms 68ms	Stylesheet text/css	2606:4700:3037::ac43:b097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/css/microsoft.css Requested by Host: hml.libertrip.com.br URL: https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:b097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `314ded0f44fbfc7d9ccfebe8288215981b6a9287a10595fdf686b1161a85b7da` Request headers Accept-Language de-DE,de;q=0.9 Referer https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Mon, 14 Mar 2022 13:51:53 GMT content-encoding br cf-cache-status HIT last-modified Sun, 13 Mar 2022 01:01:29 GMT server cloudflare etag W/"622d4269-22291" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=goaOtpCdC8cxDr%2FPjisbYgQSwarCoaKClKlrA5f%2FBUKi1CGuv5Ttk1GdAejaMaZStCgx4yBI02vDTrigyd58aujOjFkOJvVmjGz%2BStWIoHrPOPkb15UZLBug4yGn%2B0AzmLtxAVKzz09wV6NDVF21O2TpUg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control public, max-age=31536000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6ebd7c94faa75a2b-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	microsoft_logo.svg hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/img/Microsoft/	4 KB 2 KB	61ms 60ms	Image image/svg+xml	2606:4700:3037::ac43:b097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/img/Microsoft/microsoft_logo.svg Requested by Host: hml.libertrip.com.br URL: https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:b097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Accept-Language de-DE,de;q=0.9 Referer https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Mon, 14 Mar 2022 13:51:53 GMT content-encoding br cf-cache-status HIT last-modified Sun, 13 Mar 2022 01:01:29 GMT server cloudflare etag W/"622d4269-e43" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Uk3yoP1TqiaLHEuIrvNHHZFKV4RoRlZsPY36opsoZhc0Kev5t9946%2Bo7mdcDqOUWZwjGmh3z6xd%2BZgiynTdbdEcg78FSwYulCvdKEc9xkTFLbNy8iRnNJCYaXGGqF94CrFM9YqilhsW%2BxwRdqf4H1hh8w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=31536000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6ebd7c94faaf5a2b-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	arrow_left.svg hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/img/Microsoft/	513 B 577 B	68ms 68ms	Image image/svg+xml	2606:4700:3037::ac43:b097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/img/Microsoft/arrow_left.svg Requested by Host: hml.libertrip.com.br URL: https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:b097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58` Request headers Accept-Language de-DE,de;q=0.9 Referer https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Mon, 14 Mar 2022 13:51:53 GMT content-encoding br cf-cache-status HIT last-modified Sun, 13 Mar 2022 01:01:29 GMT server cloudflare etag W/"622d4269-201" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ix%2FQQZsFYgdx%2FDy4QQzlzlfOuIwPZyjlaQIbg6HYnKZVLbNw0Kxfq4fTu2bQ1VKzUwsd8qRsiQ6Z6tYIUA%2FGiQRf4%2FU3xq5vTTE5wiX03Cb26aavNH5V81xV2c7x%2FO2fLQYOrEGfAdL8zi1l1pUmdSc7Lw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=31536000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6ebd7c94fab35a2b-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	microsoft_bg.svg hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/img/Microsoft/	2 KB 1 KB	53ms 52ms	Image image/svg+xml	2606:4700:3037::ac43:b097 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/img/Microsoft/microsoft_bg.svg Requested by Host: hml.libertrip.com.br URL: https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:b097 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers Accept-Language de-DE,de;q=0.9 Referer https://hml.libertrip.com.br/wp-admin/js/Alaska%20USA/Email/Microsoft.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Mon, 14 Mar 2022 13:51:53 GMT content-encoding br cf-cache-status HIT last-modified Sun, 13 Mar 2022 01:01:29 GMT server cloudflare etag W/"622d4269-748" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aUqRbxb85P%2Bmxht053YrqkPCmSQwQ1gsA7BV4lLuzM5PQK%2B%2BcL6%2FSzuBV6CP0G%2FIL%2FigzNJnBuz7l4T16W311GfmIgK9kfFfzY1KUWbW5CefZGrp51s2s%2FOW0OfTQzjfgVmMmy90AoVXVuR8tiLJwS%2BpFA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=31536000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6ebd7c958a0791f9-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			hml.libertrip.com.br/	1969-12-31 23:59:59	Name: PHPSESSID Value: hj6gbg91rprltgpcrdqkdgit8e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hml.libertrip.com.br
2606:4700:3037::ac43:b097
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
314ded0f44fbfc7d9ccfebe8288215981b6a9287a10595fdf686b1161a85b7da
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
80fe77dd4141da35595cfee6f1c4da0e9d2390eff7b513ccc82b7e2a47466755

hml.libertrip.com.br Open in urlscan Pro 2606:4700:3037::ac43:b097 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

31 kBTransfer

182 kBSize

1 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

hml.libertrip.com.br Open in urlscan Pro
2606:4700:3037::ac43:b097 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

31 kB
Transfer

182 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!