www.opmed.com.br - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 68.168.118.2, located in Saint-Quentin, Canada and belongs to GTCOMM - GloboTech Communications, CA. The main domain is www.opmed.com.br.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 3rd 2019. Valid for: 3 months.

This is the only time www.opmed.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 163.cn (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	68.168.118.2 68.168.118.2	36666 (GTCOMM) (GTCOMM - GloboTech Communications)
2	103.129.252.34 103.129.252.34	137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED)
4	2

2 68.168.118.2 (Saint-Quentin, Canada)

ASN36666 (GTCOMM - GloboTech Communications, CA)
PTR: server.provnet.com.br

www.opmed.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.129.252.34 (Hong Kong)

ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK)

mimg.127.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	127.net mimg.127.net	15 KB
2	opmed.com.br www.opmed.com.br	216 KB
4	2

	Domain	Requested by
2	mimg.127.net	www.opmed.com.br
2	www.opmed.com.br	www.opmed.com.br
4	2

This site contains links to these domains. Also see Links.

Domain
reg.163.com

Subject Issuer	Validity	Valid
opmed.com.br Let's Encrypt Authority X3	`2019-05-03` - `2019-08-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.opmed.com.br/components/163_dom/163_dom/index.php?email=mva
Frame ID: F8F5DB749BB1E50F82B426CCEA5A4DF4
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

231 kB
Transfer

230 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://reg.163.com/getpasswd/RetakePassword.jsp?from=mail163
Title: 忘记密码了?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response www.opmed.com.br/components/163_dom/163_dom/	30 KB 30 KB	1528ms 1306ms	Document text/html	68.168.118.2 GloboTech Communi...
General Check archive.org Show headers Download Go to Full URL https://www.opmed.com.br/components/163_dom/163_dom/index.php?email=mva Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 68.168.118.2 Saint-Quentin, Canada, ASN36666 (GTCOMM - GloboTech Communications, CA), Reverse DNS server.provnet.com.br Software Apache / PHP/5.4.45 Resource Hash `4a32c4150735a94e4984faa884f7ded8f805c68b892247610dba2dfb879f7857` Request headers Host www.opmed.com.br Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 28 May 2019 10:06:42 GMT Server Apache X-Powered-By PHP/5.4.45 Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	200 OK	163_bkg.jpg www.opmed.com.br/components/163_dom/163_dom/	186 KB 186 KB	117ms 116ms	Image image/jpeg	68.168.118.2 GloboTech Communi...
General Check archive.org Show headers Download Go to Show image Full URL https://www.opmed.com.br/components/163_dom/163_dom/163_bkg.jpg Requested by Host: www.opmed.com.br URL: https://www.opmed.com.br/components/163_dom/163_dom/index.php?email=mva Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 68.168.118.2 Saint-Quentin, Canada, ASN36666 (GTCOMM - GloboTech Communications, CA), Reverse DNS server.provnet.com.br Software Apache / Resource Hash `5b5c227969c41377ff4f6aef883b78775e82ff7d8c66f18bd3a832e44828d8b8` Request headers Referer https://www.opmed.com.br/components/163_dom/163_dom/index.php?email=mva User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 28 May 2019 10:06:43 GMT Last-Modified Tue, 06 Nov 2018 06:24:24 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 190206
GET H/1.1	200 OK	login_v5.png mimg.127.net/index/163/img/2013/	4 KB 4 KB	496ms 231ms	Image image/png	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/163/img/2013/login_v5.png Requested by Host: www.opmed.com.br URL: https://www.opmed.com.br/components/163_dom/163_dom/index.php?email=mva Protocol HTTP/1.1 Server 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `8af8b8de1ecad45ba55cb3824728f4124f0966be0877381b36ba0ef195707401` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 28 May 2019 10:06:44 GMT Last-Modified Wed, 17 Dec 2014 03:19:07 GMT Server nginx ETag "5490f62b-f6e" X-Cache HIT from HKGM Content-Type image/png Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 3950 Expires Tue, 28 May 2019 10:41:44 GMT
GET H/1.1	200 OK	bg_v3.png mimg.127.net/index/163/img/2013/	10 KB 11 KB	516ms 242ms	Image image/png	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/163/img/2013/bg_v3.png Requested by Host: www.opmed.com.br URL: https://www.opmed.com.br/components/163_dom/163_dom/index.php?email=mva Protocol HTTP/1.1 Server 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `dd8b4abb72cdfaa00427d235cfa1a0efe27f528db7b61669d7328404d49cb623` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 28 May 2019 10:06:44 GMT Last-Modified Wed, 06 Aug 2014 08:38:32 GMT Server nginx ETag "53e1e988-2920" X-Cache HIT from HKGM Content-Type image/png Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 10528 Expires Tue, 28 May 2019 10:51:48 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 163.cn (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mimg.127.net
www.opmed.com.br
103.129.252.34
68.168.118.2
4a32c4150735a94e4984faa884f7ded8f805c68b892247610dba2dfb879f7857
5b5c227969c41377ff4f6aef883b78775e82ff7d8c66f18bd3a832e44828d8b8
8af8b8de1ecad45ba55cb3824728f4124f0966be0877381b36ba0ef195707401
dd8b4abb72cdfaa00427d235cfa1a0efe27f528db7b61669d7328404d49cb623

www.opmed.com.br Open in urlscan Pro 68.168.118.2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

50 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

231 kBTransfer

230 kBSize

0 Cookies

1 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

www.opmed.com.br Open in urlscan Pro
68.168.118.2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

231 kB
Transfer

230 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!