canarananews.com.br Open in urlscan Pro
104.28.25.96 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/fin...
Submission: On June 14 via automatic, source openphish (June 14th 2018, 1:11:23 pm UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 11 HTTP transactions. The main IP is 104.28.25.96, located in San Francisco, United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is canarananews.com.br.

This is the only time canarananews.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Populaire (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	104.28.25.96 104.28.25.96	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	104.19.195.151 104.19.195.151	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	112.78.125.13 112.78.125.13	9371 (SAKURA-C ...) (SAKURA-C SAKURA Internet Inc.)
1	41.21.130.37 41.21.130.37	36994 (Vodacom-VB) (Vodacom-VB)
4	104.28.24.96 104.28.24.96	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
11	5

4 104.28.25.96 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

canarananews.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.195.151 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 112.78.125.13 (Osaka, Japan)

ASN9371 (SAKURA-C SAKURA Internet Inc., JP)
PTR: www513b.sakura.ne.jp

gb-one.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 41.21.130.37 (Johannesburg, South Africa)

ASN36994 (Vodacom-VB, ZA)

cyclelab.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.28.24.96 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

canarananews.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	canarananews.com.br canarananews.com.br	268 KB
1	cyclelab.com cyclelab.com	44 KB
1	gb-one.net gb-one.net	15 KB
1	cloudflare.com ajax.cloudflare.com	4 KB
11	4

	Domain	Requested by
8	canarananews.com.br	canarananews.com.br ajax.cloudflare.com
1	cyclelab.com	canarananews.com.br
1	gb-one.net	canarananews.com.br
1	ajax.cloudflare.com	canarananews.com.br
11	4

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Frame ID: A1887F117CE544F4DB92C0F177FC285A
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

11
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

331 kB
Transfer

356 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set final2.php Show response
canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/ 14 KB
5 KB 5771ms
5763ms Document
text/html 104.28.25.96
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Protocol: HTTP/1.1
Server: 104.28.25.96 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.6.36
Resource Hash: f8286b55d35ca33c09b9891771ad690fcec162c2a1e063c62ed8d1bcbebf3587

Request headers

Host: canarananews.com.br
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: A1887F117CE544F4DB92C0F177FC285A

Response headers

Date: Thu, 14 Jun 2018 13:11:09 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d495bd84ca4998ddc07fd65de08c7248b1528981864; expires=Fri, 14-Jun-19 13:11:04 GMT; path=/; domain=.canarananews.com.br; HttpOnly
X-Powered-By: PHP/5.6.36
Vary: Accept-Encoding
X-Turbo-Charged-By: LiteSpeed
Server: cloudflare
CF-RAY: 42ad0a6b61a726d8-FRA
Content-Encoding: gzip

GET
S 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/4f936b58/cloudflare-static/ 11 KB
4 KB 17ms
15ms Script
application/javascript 104.19.195.151
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/4f936b58/cloudflare-static/rocket-loader.min.js

Requested by

Host: canarananews.com.br
URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php

Protocol

SPDY

Server

104.19.195.151 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

e00af8e003e12778b595d257720107558eaac26548e31015711cb701e39c34b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 14 Jun 2018 13:11:09 GMT
content-encoding: gzip
last-modified: Thu, 07 Jun 2018 15:19:24 GMT
server: cloudflare-nginx
etag: W/"5b194cfc-2ba5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 42ad0a8f68f227aa-FRA
expires: Sat, 16 Jun 2018 13:11:09 GMT

GET
H/1.1 200
OK 1011px-Banquepopulaire_logo.svg.png
gb-one.net/wp-includes/images/ 15 KB
15 KB 819ms
279ms Image
image/png 112.78.125.13
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gb-one.net/wp-includes/images/1011px-Banquepopulaire_logo.svg.png
Requested by: Host: canarananews.com.br
URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Protocol: HTTP/1.1
Server: 112.78.125.13 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www513b.sakura.ne.jp
Software: nginx /
Resource Hash: 39036ed5148c614cdc0cc98ad981591d852dd96827743db932425284b011d162

Request headers

Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 13:11:10 GMT
Last-Modified: Fri, 30 Mar 2018 04:44:25 GMT
Server: nginx
ETag: "3a11-56899e502bc40"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14865

GET
H/1.1 200
OK 3dsecure_visa_mastercard.png
cyclelab.com/images/companies/1/ 44 KB
44 KB 936ms
372ms Image
image/png 41.21.130.37
Vodacom-VB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cyclelab.com/images/companies/1/3dsecure_visa_mastercard.png?1472109644109
Requested by: Host: canarananews.com.br
URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Protocol: HTTP/1.1
Server: 41.21.130.37 Johannesburg, South Africa, ASN36994 (Vodacom-VB, ZA),
Reverse DNS
Software: nginx /
Resource Hash: e9906b4f90bb169f837e13a3553129debb646b1d4dc8a1c7e8752f745fbd57d6

Request headers

Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 13:11:10 GMT
Last-Modified: Thu, 25 Aug 2016 07:20:40 GMT
Server: nginx
ETag: "57be9c48-b09e"
Content-Type: image/png
Cache-Control: max-age=2592000, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 45214
Expires: Sat, 14 Jul 2018 13:11:10 GMT

GET
H/1.1 200
OK cp.png
canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/ 56 KB
56 KB 12ms
10ms Image
image/png 104.28.25.96
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/cp.png
Requested by: Host: canarananews.com.br
URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Protocol: HTTP/1.1
Server: 104.28.25.96 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: adc948c51bf75746584855ba175e7b36dc7d1e3edd835a179c3b1ab0ae3567e3

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: canarananews.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Cookie: __cfduid=d495bd84ca4998ddc07fd65de08c7248b1528981864
Connection: keep-alive
Cache-Control: no-cache
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 13:11:10 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 14 Jun 2018 10:22:23 GMT
Server: cloudflare
ETag: "deca-5b2241df-4454031027e41edd;;;"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
X-Turbo-Charged-By: LiteSpeed
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 42ad0a8fb16a26d8-FRA
Content-Length: 57034
Expires: Thu, 21 Jun 2018 13:11:10 GMT

GET
H/1.1 200
OK btn_ok_off.png
canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/ 15 KB
16 KB 36ms
16ms Image
image/png 104.28.24.96
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/btn_ok_off.png
Requested by: Host: canarananews.com.br
URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Protocol: HTTP/1.1
Server: 104.28.24.96 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b32e9e5bded1d86d15d942353312058b422b205640ed915f29b526da95f3b42

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: canarananews.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Cookie: __cfduid=d495bd84ca4998ddc07fd65de08c7248b1528981864
Connection: keep-alive
Cache-Control: no-cache
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 13:11:10 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 14 Jun 2018 10:22:23 GMT
Server: cloudflare
ETag: "3dd4-5b2241df-8efe8afd0d3b51da;;;"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
X-Turbo-Charged-By: LiteSpeed
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 42ad0a8fe0692756-FRA
Content-Length: 15828
Expires: Thu, 21 Jun 2018 13:11:10 GMT

GET
H/1.1 200
OK authentication.js Show response
canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/js/ 14 KB
3 KB 10ms
9ms Script
application/javascript 104.28.25.96
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/js/authentication.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/4f936b58/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Server: 104.28.25.96 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d516d65690d60a90b68185c85c29b71aeb30dbebf34ef62262e7976c12a1df1c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: canarananews.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Cookie: __cfduid=d495bd84ca4998ddc07fd65de08c7248b1528981864
Connection: keep-alive
Cache-Control: no-cache
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 13:11:10 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Cf-Polished: origSize=20338
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 14 Jun 2018 10:22:23 GMT
Server: cloudflare
ETag: W/"4f72-5b2241df-758311eb0ad8755;gz"
Vary: Accept-Encoding
Content-Type: application/javascript
Expires: Thu, 21 Jun 2018 13:11:10 GMT
Cache-Control: public, max-age=604800
X-Turbo-Charged-By: LiteSpeed
CF-RAY: 42ad0a8f915e26d8-FRA
Cf-Bgj: minify

GET
H/1.1 200
OK back.png
canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/ 5 KB
6 KB 35ms
15ms Image
image/png 104.28.24.96
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/back.png
Requested by: Host: canarananews.com.br
URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Protocol: HTTP/1.1
Server: 104.28.24.96 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 043a0c99fa0e981429b5b56526dd47c79700ecef8deaf7a24ad27b0eff8d2417

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: canarananews.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Cookie: __cfduid=d495bd84ca4998ddc07fd65de08c7248b1528981864
Connection: keep-alive
Cache-Control: no-cache
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 13:11:10 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 14 Jun 2018 10:22:23 GMT
Server: cloudflare
ETag: "1576-5b2241df-f1e9e69a33b76c9b;;;"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
X-Turbo-Charged-By: LiteSpeed
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 42ad0a8fd09626fc-FRA
Content-Length: 5494
Expires: Thu, 21 Jun 2018 13:11:10 GMT

GET
H/1.1 404
Not Found fl_b.png
canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/imgs/imagesTemplates/ 61 KB
61 KB 3035ms
3014ms Image
text/html 104.28.24.96
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/imgs/imagesTemplates/fl_b.png
Requested by: Host: canarananews.com.br
URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Protocol: HTTP/1.1
Server: 104.28.24.96 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.6.36
Resource Hash: 1aa440064b65d2bad10e50647bce375e8ad2dba6e4f6ab529f9a89821c319910

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: canarananews.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Cookie: __cfduid=d495bd84ca4998ddc07fd65de08c7248b1528981864
Connection: keep-alive
Cache-Control: no-cache
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 13:11:13 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Server: cloudflare
X-Powered-By: PHP/5.6.36
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Transfer-Encoding: chunked
X-Turbo-Charged-By: LiteSpeed
Connection: keep-alive
CF-RAY: 42ad0a8fd1c2272c-FRA
Link: <http://canarananews.com.br/wp-json/>; rel="https://api.w.org/"
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 404
Not Found ar_h.gif
canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/imgs/imagesTemplates/ 61 KB
61 KB 3100ms
3079ms Image
text/html 104.28.24.96
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/imgs/imagesTemplates/ar_h.gif
Requested by: Host: canarananews.com.br
URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Protocol: HTTP/1.1
Server: 104.28.24.96 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.6.36
Resource Hash: dd81555b6bd4558cb10a5f8182a0b5df29f924edffef19c056716feb178169f1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: canarananews.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Cookie: __cfduid=d495bd84ca4998ddc07fd65de08c7248b1528981864
Connection: keep-alive
Cache-Control: no-cache
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 13:11:13 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Server: cloudflare
X-Powered-By: PHP/5.6.36
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Transfer-Encoding: chunked
X-Turbo-Charged-By: LiteSpeed
Connection: keep-alive
CF-RAY: 42ad0a8fd6cb2690-FRA
Link: <http://canarananews.com.br/wp-json/>; rel="https://api.w.org/"
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 404
Not Found ar_b.gif
canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/imgs/imagesTemplates/ 61 KB
61 KB 2929ms
2908ms Image
text/html 104.28.25.96
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/imgs/imagesTemplates/ar_b.gif
Requested by: Host: canarananews.com.br
URL: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Protocol: HTTP/1.1
Server: 104.28.25.96 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.6.36
Resource Hash: 59819eefc9da8b9abfee536cbe15cdb3f2bf83a1c8b69d991b675dfd7d311f60

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: canarananews.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
Cookie: __cfduid=d495bd84ca4998ddc07fd65de08c7248b1528981864
Connection: keep-alive
Cache-Control: no-cache
Referer: http://canarananews.com.br/portailinternet/Pages/default.aspx_008731/WebSSO_BP=ID-labanquepopulaire1-WebSSO_BP=ID/e3b67/final2.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 13:11:12 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Server: cloudflare
X-Powered-By: PHP/5.6.36
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Transfer-Encoding: chunked
X-Turbo-Charged-By: LiteSpeed
Connection: keep-alive
CF-RAY: 42ad0a8fe16e26d8-FRA
Link: <http://canarananews.com.br/wp-json/>; rel="https://api.w.org/"
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Populaire (Banking)

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.canarananews.com.br/	1970-01-19 01:28:37	Name: __cfduid Value: d54a26d485adaa701d64f46c14c8d75ed1528981869

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
canarananews.com.br
cyclelab.com
gb-one.net
104.19.195.151
104.28.24.96
104.28.25.96
112.78.125.13
41.21.130.37
043a0c99fa0e981429b5b56526dd47c79700ecef8deaf7a24ad27b0eff8d2417
1aa440064b65d2bad10e50647bce375e8ad2dba6e4f6ab529f9a89821c319910
39036ed5148c614cdc0cc98ad981591d852dd96827743db932425284b011d162
59819eefc9da8b9abfee536cbe15cdb3f2bf83a1c8b69d991b675dfd7d311f60
5b32e9e5bded1d86d15d942353312058b422b205640ed915f29b526da95f3b42
adc948c51bf75746584855ba175e7b36dc7d1e3edd835a179c3b1ab0ae3567e3
d516d65690d60a90b68185c85c29b71aeb30dbebf34ef62262e7976c12a1df1c
dd81555b6bd4558cb10a5f8182a0b5df29f924edffef19c056716feb178169f1
e00af8e003e12778b595d257720107558eaac26548e31015711cb701e39c34b0
e9906b4f90bb169f837e13a3553129debb646b1d4dc8a1c7e8752f745fbd57d6
f8286b55d35ca33c09b9891771ad690fcec162c2a1e063c62ed8d1bcbebf3587

canarananews.com.br Open in urlscan Pro 104.28.25.96 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

0 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

5 IPs

3 Countries

331 kBTransfer

356 kBSize

1 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

45 JavaScript Global Variables

1 Cookies

Indicators

canarananews.com.br Open in urlscan Pro
104.28.25.96 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

331 kB
Transfer

356 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!