sosacademias.com.br
Open in
urlscan Pro
162.214.109.30
Malicious Activity!
Public Scan
Submitted URL: https://implantedentariojundiai.com.br/map4
Effective URL: https://sosacademias.com.br/pste/Postnord/
Submission: On November 11 via manual from DK
Effective URL: https://sosacademias.com.br/pste/Postnord/
Submission: On November 11 via manual from DK
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 10 HTTP transactions.
The main IP is 162.214.109.30, located in
Provo, United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is sosacademias.com.br.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 21st 2020. Valid for: 3 months.
This is the only time sosacademias.com.br was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 21st 2020. Valid for: 3 months.
This is the only time sosacademias.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostNord AB (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 12 | 162.214.109.30 162.214.109.30 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 10 | 2 |
12
162.214.109.30
(Provo, United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-4683802.cdsn.cc
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-4683802.cdsn.cc
| implantedentariojundiai.com.br | |
| sosacademias.com.br |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
sosacademias.com.br
sosacademias.com.br |
79 KB |
| 2 |
implantedentariojundiai.com.br
2 redirects
implantedentariojundiai.com.br |
520 B |
| 10 | 2 |
| Domain | Requested by | |
|---|---|---|
| 10 | sosacademias.com.br |
sosacademias.com.br
|
| 2 | implantedentariojundiai.com.br | 2 redirects |
| 10 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sosacademias.com.br cPanel, Inc. Certification Authority |
2020-10-21 - 2021-01-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sosacademias.com.br/pste/Postnord/
Frame ID: 3AAA834E6F5B435C566C6AD31D3E771D
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://implantedentariojundiai.com.br/map4
HTTP 301
https://implantedentariojundiai.com.br/map4/ HTTP 302
https://sosacademias.com.br/pste/Postnord/ Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://implantedentariojundiai.com.br/map4
HTTP 301
https://implantedentariojundiai.com.br/map4/ HTTP 302
https://sosacademias.com.br/pste/Postnord/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
sosacademias.com.br/pste/Postnord/ Redirect Chain
|
15 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
portal.css
sosacademias.com.br/pste/Postnord/core/ |
9 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cc.js
sosacademias.com.br/pste/Postnord/core/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
postnord-logo.svg
sosacademias.com.br/pste/Postnord/core/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
shield.png
sosacademias.com.br/pste/Postnord/core/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
visa.png
sosacademias.com.br/pste/Postnord/core/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mastercard.png
sosacademias.com.br/pste/Postnord/core/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
318 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
StagSansWeb-Book.woff
sosacademias.com.br/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
StagSansWeb-Book.ttf
sosacademias.com.br/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
STAGSANS-BOOK.OTF
sosacademias.com.br/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostNord AB (Transportation)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| $cc object| antiClickjack function| showError function| setFocus undefined| getQueryString function| hideElements function| onLoadPage0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
implantedentariojundiai.com.br
sosacademias.com.br
162.214.109.30
135f8a436a480d5b37ed9630bfc87561093a6877fbe4090e38406ca53005334e
15820ba47b6da2ed63b6e623a07b970dbb04ed70805f3c9ec4287b4816b7e32a
23610d31bc8b715644312fa43d488d85581ab15336f69b0755b00fe8725461a6
3024cc41e53a08d72f6ee4f45c3bb5819ff88e71b948ed57475518edd2489626
3ba73f75360efd1e119b4be51ab2d2b78eefe1a3474f8fb0608f7b876194a17d
535787c4f4449d969e06c30ed43d0fa4e730eab8d6a871f35cef8db89b784b85
968e1f7b0d3de0deee0154404133b6827721359ea396dcab0354f065f6db8898
a4e97fa82cfa954d1a71c7c13e57844c718fa48859d9452be6ce1bd282ef389c