focusprimeservicos.com.br Open in urlscan Pro
192.185.216.139 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://focusprimeservicos.com.br/
Submission: On November 30 via automatic, source openphish (November 30th 2022, 1:07:44 pm UTC) — Scanned from DE

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 192.185.216.139, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is focusprimeservicos.com.br.
TLS certificate: Issued by R3 on November 15th 2022. Valid for: 3 months.

This is the only time focusprimeservicos.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
6	192.185.216.139 192.185.216.139	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
7	3

6 192.185.216.139 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: srv18-ip12.prodns.com.br

focusprimeservicos.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	focusprimeservicos.com.br focusprimeservicos.com.br	355 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 455	31 KB
7	2

	Domain	Requested by
6	focusprimeservicos.com.br	focusprimeservicos.com.br
1	ajax.googleapis.com	focusprimeservicos.com.br
7	2

This site contains no links.

Subject Issuer	Validity	Valid
*.focusprimeservicos.com.br R3	`2022-11-15` - `2023-02-13`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://focusprimeservicos.com.br/
Frame ID: DDBF58B6142C278790936D3F219A54D0
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

EDD CARD UNBL0CK - B0A

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

386 kB
Transfer

453 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
focusprimeservicos.com.br/ 23 KB
15 KB 586ms
165ms Document
text/html 192.185.216.139
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://focusprimeservicos.com.br/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.216.139 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv18-ip12.prodns.com.br
Software: Apache /
Resource Hash: 811c0c764bd8b11c928a763f5c99efa65f0b11e2f98f0e6761b7d3433406a16d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 30 Nov 2022 13:07:39 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 120ms
37ms Script
text/javascript 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: focusprimeservicos.com.br
URL: https://focusprimeservicos.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://focusprimeservicos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 08:31:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16543
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Nov 2023 08:31:56 GMT

GET
H2 200 style.css
focusprimeservicos.com.br/ 3 KB
1 KB 143ms
142ms Stylesheet
text/css 192.185.216.139
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://focusprimeservicos.com.br/style.css
Requested by: Host: focusprimeservicos.com.br
URL: https://focusprimeservicos.com.br/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.216.139 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv18-ip12.prodns.com.br
Software: Apache /
Resource Hash: 248b49fa23de5dea97b2f57332f7fd8af2291675bd36f6fa55df643bd9e29530

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://focusprimeservicos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 13:07:39 GMT
content-encoding: gzip
last-modified: Thu, 23 Jun 2022 16:24:54 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 986

GET
H2 200 boahead.JPG
focusprimeservicos.com.br/img/ 25 KB
25 KB 157ms
156ms Image
image/jpeg 192.185.216.139
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://focusprimeservicos.com.br/img/boahead.JPG
Requested by: Host: focusprimeservicos.com.br
URL: https://focusprimeservicos.com.br/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.216.139 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv18-ip12.prodns.com.br
Software: Apache /
Resource Hash: 98850f349bbeebea3362ebc66c4317250bec0bec7378e6c8e1ed6ac6772af88e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://focusprimeservicos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 13:07:39 GMT
last-modified: Wed, 22 Jun 2022 23:41:30 GMT
server: Apache
accept-ranges: bytes
content-length: 25771
content-type: image/jpeg

GET
H2 200 boafoot.JPG
focusprimeservicos.com.br/img/ 175 KB
177 KB 150ms
150ms Image
image/jpeg 192.185.216.139
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://focusprimeservicos.com.br/img/boafoot.JPG
Requested by: Host: focusprimeservicos.com.br
URL: https://focusprimeservicos.com.br/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.216.139 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv18-ip12.prodns.com.br
Software: Apache /
Resource Hash: 79fb5a5de80ed598a94d3104507b7658b24127278d59f14bffb04398ddab3131

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://focusprimeservicos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 13:07:39 GMT
last-modified: Thu, 23 Jun 2022 02:05:00 GMT
server: Apache
accept-ranges: bytes
content-length: 179524
content-type: image/jpeg

GET
H2 200 boamob-foot.JPG
focusprimeservicos.com.br/img/ 134 KB
135 KB 150ms
149ms Image
image/jpeg 192.185.216.139
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://focusprimeservicos.com.br/img/boamob-foot.JPG
Requested by: Host: focusprimeservicos.com.br
URL: https://focusprimeservicos.com.br/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.216.139 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv18-ip12.prodns.com.br
Software: Apache /
Resource Hash: 4ef1af1a486c12106c53cd3eaf7ad1a82af738d845f707bd83fc431cb7a0b08c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://focusprimeservicos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 13:07:39 GMT
last-modified: Thu, 23 Jun 2022 02:17:04 GMT
server: Apache
accept-ranges: bytes
content-length: 137008
content-type: image/jpeg

GET
H2 200 logscript.js Show response
focusprimeservicos.com.br/ 6 KB
2 KB 147ms
147ms Script
application/javascript 192.185.216.139
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://focusprimeservicos.com.br/logscript.js
Requested by: Host: focusprimeservicos.com.br
URL: https://focusprimeservicos.com.br/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.216.139 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: srv18-ip12.prodns.com.br
Software: Apache /
Resource Hash: 92bfdea12f0b81f1c9f6433025cf960f2fd371af15c88a799d49bf78954c166d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://focusprimeservicos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 13:07:39 GMT
content-encoding: gzip
last-modified: Fri, 24 Jun 2022 14:26:12 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1592

GET
DATA 200
OK truncated
/ 266 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			focusprimeservicos.com.br/	1969-12-31 23:59:59	Name: PHPSESSID Value: d831bb9d9bf41adbfd69bc111dbd351c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
focusprimeservicos.com.br
192.185.216.139
2a00:1450:4001:810::200a
248b49fa23de5dea97b2f57332f7fd8af2291675bd36f6fa55df643bd9e29530
4ef1af1a486c12106c53cd3eaf7ad1a82af738d845f707bd83fc431cb7a0b08c
662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33
79fb5a5de80ed598a94d3104507b7658b24127278d59f14bffb04398ddab3131
811c0c764bd8b11c928a763f5c99efa65f0b11e2f98f0e6761b7d3433406a16d
92bfdea12f0b81f1c9f6433025cf960f2fd371af15c88a799d49bf78954c166d
98850f349bbeebea3362ebc66c4317250bec0bec7378e6c8e1ed6ac6772af88e
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

focusprimeservicos.com.br Open in urlscan Pro 192.185.216.139 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

386 kBTransfer

453 kBSize

1 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

focusprimeservicos.com.br Open in urlscan Pro
192.185.216.139 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

386 kB
Transfer

453 kB
Size

1
Cookies

7 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!