weyadvocacia.com.br
Open in
urlscan Pro
191.252.134.192
Malicious Activity!
Public Scan
Effective URL: https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae/pp14jm1q9zbmvwwclgntk1um.php?rand=13InboxLightaspxn.1...
Submission: On June 30 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 20th 2022. Valid for: 3 months.
This is the only time weyadvocacia.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BIGLOBE (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 4 | 191.252.134.192 191.252.134.192 | 27715 (Locaweb S...) (Locaweb Servicos de Internet SA) | |
8 | 2406:da14:5ff... 2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:260:407:... 2001:260:407:88c::2 | 2518 (BIGLOBE B...) (BIGLOBE BIGLOBE Inc.) | |
2 | 2406:da14:5e4... 2406:da14:5e4:7d00:d42e:796f:9b5:a577 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 99.86.4.113 99.86.4.113 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 54.82.213.63 54.82.213.63 | 14618 (AMAZON-AES) (AMAZON-AES) | |
17 | 7 |
ASN16509 (AMAZON-02, US)
webmail.biglobe.ne.jp |
ASN15169 (GOOGLE, US)
ssl.google-analytics.com |
ASN16509 (AMAZON-02, US)
member4.sso.biglobe.ne.jp |
ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-113.fra6.r.cloudfront.net
cdn.treasuredata.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-82-213-63.compute-1.amazonaws.com
in.treasuredata.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
biglobe.ne.jp
webmail.biglobe.ne.jp member4.sso.biglobe.ne.jp |
96 KB |
4 |
weyadvocacia.com.br
1 redirects
weyadvocacia.com.br |
11 KB |
2 |
treasuredata.com
cdn.treasuredata.com — Cisco Umbrella Rank: 17365 in.treasuredata.com — Cisco Umbrella Rank: 3986 |
14 KB |
1 |
bcdn.jp
top.bcdn.jp |
2 KB |
1 |
google-analytics.com
ssl.google-analytics.com — Cisco Umbrella Rank: 390 |
17 KB |
17 | 5 |
Domain | Requested by | |
---|---|---|
8 | webmail.biglobe.ne.jp |
weyadvocacia.com.br
|
4 | weyadvocacia.com.br |
1 redirects
weyadvocacia.com.br
|
2 | member4.sso.biglobe.ne.jp |
weyadvocacia.com.br
|
1 | in.treasuredata.com |
cdn.treasuredata.com
|
1 | cdn.treasuredata.com |
top.bcdn.jp
|
1 | top.bcdn.jp |
weyadvocacia.com.br
|
1 | ssl.google-analytics.com |
weyadvocacia.com.br
|
17 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.biglobe.ne.jp |
webmail.biglobe.ne.jp |
support.biglobe.ne.jp |
email.biglobe.ne.jp |
office.biglobe.ne.jp |
www.biglobe.co.jp |
Subject Issuer | Validity | Valid | |
---|---|---|---|
weyadvocacia.com.br cPanel, Inc. Certification Authority |
2022-04-20 - 2022-07-19 |
3 months | crt.sh |
webmail.biglobe.ne.jp Amazon |
2021-12-21 - 2023-01-19 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-06-06 - 2022-08-29 |
3 months | crt.sh |
top.bcdn.jp GeoTrust RSA CA 2018 |
2021-12-24 - 2023-01-24 |
a year | crt.sh |
member4.sso.biglobe.ne.jp GlobalSign Extended Validation CA - SHA256 - G3 |
2021-08-25 - 2022-09-26 |
a year | crt.sh |
*.treasuredata.com Amazon |
2021-09-17 - 2022-10-16 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae/pp14jm1q9zbmvwwclgntk1um.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 444180C16AFC814B8350682E11DED4FF
Requests: 15 HTTP requests in this frame
Frame:
https://member4.sso.biglobe.ne.jp/heute
Frame ID: ED12325D9E7710E65F80958F1A97C973
Requests: 1 HTTP requests in this frame
Frame:
https://member4.sso.biglobe.ne.jp/webmail/advanced/firstview/del_suppress.html
Frame ID: B0DBD5F08F6F55FBFE5FE283AC66208D
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
BIGLOBEメール ログインPage URL History Show full URLs
-
https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae
HTTP 301
https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae/ Page URL
- https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae/pp14jm1q9zbmvwwclgntk1um.php?rand... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Microsoft ASP.NET (Web Frameworks) Expand
Detected patterns
- \.aspx?(?:$|\?)
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
18 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: 詳細
Search URL Search Domain Scan URL
Title: 使い分けアドレス初月無料キャンペーン(2021/8/2(月)~2021/9/30(木))
Search URL Search Domain Scan URL
Title: メールサービス メンテナンス(2021/8/25)
Search URL Search Domain Scan URL
Title: 【重要】BIGLOBEメール(Webメール)への電話認証導入と電話番号登録のお願い
Search URL Search Domain Scan URL
Title: Webメールにログインが出来ない場合はこちらをご確認ください。
Search URL Search Domain Scan URL
Title: ID・パスワードを忘れた(個人会員)
Search URL Search Domain Scan URL
Title: ID・パスワードを忘れた(法人会員)
Search URL Search Domain Scan URL
Title: ヘルプ
Search URL Search Domain Scan URL
Title: よくあるお問い合わせ
Search URL Search Domain Scan URL
Title: メールサービス
Search URL Search Domain Scan URL
Title: 障害情報
Search URL Search Domain Scan URL
Title: 会社概要
Search URL Search Domain Scan URL
Title: 個人情報保護ポリシー
Search URL Search Domain Scan URL
Title: Cookieポリシー
Search URL Search Domain Scan URL
Title: 安心・安全
Search URL Search Domain Scan URL
Title: BIGLOBEトップ
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae
HTTP 301
https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae/ Page URL
- https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae/pp14jm1q9zbmvwwclgntk1um.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae HTTP 301
- https://weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae/
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae/ Redirect Chain
|
395 B 608 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
pp14jm1q9zbmvwwclgntk1um.php
weyadvocacia.com.br/cmd-login=c85652703f710065c1255aa03a9aefae/ |
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base02_and.css
webmail.biglobe.ne.jp/mobile/css/ |
15 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
global_and.css
webmail.biglobe.ne.jp/mobile/css/ |
18 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
info.css
webmail.biglobe.ne.jp/mobile/css/ |
102 B 249 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
webmail.biglobe.ne.jp/mobile/js/ |
54 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
change_page.js
webmail.biglobe.ne.jp/mobile/js/ |
987 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
input_time_chk.js
weyadvocacia.com.br/api/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_email_mb.gif
webmail.biglobe.ne.jp/images2/common/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
button_03.gif
webmail.biglobe.ne.jp/mobile/images/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c31a2fc863.js
webmail.biglobe.ne.jp/blog/ |
342 B 498 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
ssl.google-analytics.com/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rtms.js
top.bcdn.jp/j/ft_rtms/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
heute
member4.sso.biglobe.ne.jp/ Frame ED12 |
212 B 307 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
del_suppress.html
member4.sso.biglobe.ne.jp/webmail/advanced/firstview/ Frame B0DB |
214 B 344 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
td.min.js
cdn.treasuredata.com/sdk/1.7.1/ |
34 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pageviews
in.treasuredata.com/js/v3/event/web_access/ |
89 B 559 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BIGLOBE (Telecommunication)45 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery number| _submit_exec function| change_submit function| other_post function| post_submit object| _gaq string| jsHost string| rtmsJs object| newslist_url object| newslist_name object| newslist_blogname object| newslist_blogiurl object| newslist_date object| anamelist object| aurllist object| _gat function| a0_0x2a77f8 function| a0_0x4eff function| getCookie function| a0_0xb622 function| getVirtualParam string| td_setdomain string| td_writeKey string| td_dbname string| td_tblname string| td_testFlg object| td_storageCfg object| td_obj string| td_gaCookie object| td_vparam object| td_extData function| Treasure object| JSON3 function| TreasureJSONPCallback01 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.in.treasuredata.com/ | Name: _td_global Value: 80b1a907-6a16-4528-a4de-7df405eedba8 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.treasuredata.com
in.treasuredata.com
member4.sso.biglobe.ne.jp
ssl.google-analytics.com
top.bcdn.jp
webmail.biglobe.ne.jp
weyadvocacia.com.br
191.252.134.192
2001:260:407:88c::2
2406:da14:5e4:7d00:d42e:796f:9b5:a577
2406:da14:5ff:9a00:fc70:96f0:18d4:b7ac
2a00:1450:4001:812::2008
54.82.213.63
99.86.4.113
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
17e2209013efcb0ba23e308fc97195b4fc2bda818447de16e90bd1fc05364498
1be62ee1373b2feb21b1459288cd92754d29d7c3ccb008134b8538890bb98285
34139c7ee5bf4f652ebf32f7b2d286f8d28e4d6c1506e4fa3de68c7b4db36b63
3aa9f235c06f8205b4b91091c02bbb8c8a23b12fafa257f68aecc4be22e8b7c0
6154a633987cebded2892928002581c2008702c3ad30609b557f3aab74628e9e
6f47d8cbeebfb58186a00fad67c829cb96e9b5a389850e08ef6a472ae3822521
759b1b9e6dc66f114fe61e0a384327b6dfc7ccaa40dad73a474168ca644e1f61
78b03e47087081f6ccd71fab017481364db4fd73ac848ca50499232adfda4103
a4529c44c823be47ebb2d35dc9d12f227c966a1401b7351379382e8a2262a026
a66313d478d9a89bae72f3b66740bb5cc54716dd56ffce4d0fed631f60461394
a67d545b142c7a8da7f12ae222f1d5f48448493c08444091c14eb11eaf319330
d3b2ec4968667291c8398175533ffad1943cfdd78df2891b7ce52f36642c577e
d548530775a6286f49ba66e0715876b4ec5985966b0291c21568fecfc4178e8d
da1c0e102b727a15f973085c3d8f21f47e77c10d98c8913c3a12e32a6d1c0f8a
e1838e972a0860eeabe922ad57f89189df0ecc21e8def514bdad616e7daa9e26