www.roiscope.com Open in urlscan Pro
185.165.185.116 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Submission: On January 17 via automatic, source openphish (January 17th 2020, 12:25:56 pm UTC)

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 185.165.185.116, located in Romania and belongs to CHML-AS, RO. The main domain is www.roiscope.com.

This is the only time www.roiscope.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Itau (Banking)

Domain & IP information

	IP Address	AS Autonomous System
14	185.165.185.116 185.165.185.116	40975 (CHML-AS) (CHML-AS)
2	2a00:1450:400... 2a00:1450:4001:816::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
16	2

14 185.165.185.116 (Romania)

ASN40975 (CHML-AS, RO)
PTR: server6.ghesi.net

www.roiscope.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	roiscope.com www.roiscope.com	82 KB
2	google-analytics.com www.google-analytics.com	17 KB
16	2

	Domain	Requested by
14	www.roiscope.com	www.roiscope.com
2	www.google-analytics.com	www.roiscope.com
16	2

This site contains no links.

Subject Issuer	Validity	Valid
*.google-analytics.com GTS CA 1O1	`2019-12-20` - `2020-03-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Frame ID: 7E35D0ADDB4AFDB4A383D547ECC56FB8
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

16
Requests

13 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

99 kB
Transfer

174 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

Request Chain 11

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1047368417&utmhn=www.roiscope.com&utme=8(Aplicativo*Experiencia)9(NOT_APP%2Fmozilla%205.0%20%20windows%20nt%2010.0%20%20wow64%20%20applewebkit%20537.36%20%20khtml%20%20like%20gecko%20%20chrome%2049.0.2623.87%20safari%20537.36*TOUCH_2)11(2*2)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Ita%C3%B9%2030%20horas&utmhid=43221242&utmr=-&utmp=%2FLoginPF&utmht=1579263938938&utmac=UA-31857808-1&utmcc=__utma%3D227429662.1628229731.1579263939.1579263939.1579263939.1%3B%2B__utmz%3D227429662.1579263939.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1280364366&utmredir=1&utmu=qQCAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1047368417&utmhn=www.roiscope.com&utme=8(Aplicativo*Experiencia)9(NOT_APP%2Fmozilla%205.0%20%20windows%20nt%2010.0%20%20wow64%20%20applewebkit%20537.36%20%20khtml%20%20like%20gecko%20%20chrome%2049.0.2623.87%20safari%20537.36*TOUCH_2)11(2*2)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Ita%C3%B9%2030%20horas&utmhid=43221242&utmr=-&utmp=%2FLoginPF&utmht=1579263938938&utmac=UA-31857808-1&utmcc=__utma%3D227429662.1628229731.1579263939.1579263939.1579263939.1%3B%2B__utmz%3D227429662.1579263939.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1280364366&utmredir=1&utmu=qQCAAAAAAAAAAAAAAAAAAAAE~

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request ita2.php Show response
www.roiscope.com/APP-Sincronizacao/Mobile/ 15 KB
4 KB 163ms
144ms Document
text/html 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed / PHP/5.6.40
Resource Hash: d1e8f51d5c13792382fcaea5a609a5e5e34a4014d6ea29eb0c2ac0ab39dac361

Request headers

Host: www.roiscope.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Connection: Keep-Alive
X-Powered-By: PHP/5.6.40
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Fri, 17 Jan 2020 12:25:39 GMT
Server: LiteSpeed

GET
H/1.1 200
OK ga.js Show response
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 42 KB
17 KB 79ms
79ms Script
application/javascript 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ga.js
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: 752cbe5428983d2cc4e20933b2df4e298aeae6b833d3d800854808e291afd0ed

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:39 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 17148
Expires: Fri, 24 Jan 2020 12:25:39 GMT

GET
H/1.1 200
OK iphone.css
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 17 KB
3 KB 162ms
143ms Stylesheet
text/css 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/iphone.css
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: 00d0393fbbd8e3185eeb7b4d167bcd0a52845806ada161ea3b07f70bffdd3f77

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:39 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2696
Expires: Fri, 24 Jan 2020 12:25:39 GMT

GET
H/1.1 200
OK WebResource.axd Show response
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 20 KB
21 KB 154ms
136ms Script
application/octet-stream 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/WebResource.axd
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: b15bedfb9c47a85571d8b6a8c9ca0844a172cb8e83f97817fdffa7a414035649

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 20792
Content-Type: application/octet-stream

GET
H/1.1 200
OK WebResource(1).axd Show response
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 3 KB
3 KB 155ms
137ms Script
application/octet-stream 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/WebResource(1).axd
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: 2235ae869e418c6a37c86868bb6326ec85079ee0fc00cf2bd39882bd4b218d9d

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3003
Content-Type: application/octet-stream

GET
H/1.1 200
OK logo_nm.png
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 2 KB
2 KB 169ms
150ms Image
image/png 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/logo_nm.png
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: 479e98acc92133600bf208703d3d6aa267e8b270291de67f999d96c20451a35f

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1890
Expires: Fri, 24 Jan 2020 12:25:40 GMT

GET
H/1.1 200
OK 30_nm.png
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 2 KB
2 KB 137ms
119ms Image
image/png 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/30_nm.png
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: 2942283657612b371f42e59a6e28db8d2c3095fc31cf0b4eed39ccc5a1672485

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:39 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2202
Expires: Fri, 24 Jan 2020 12:25:39 GMT

GET
H/1.1 200
OK banner_aplicativos.gif
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 4 KB
4 KB 79ms
78ms Image
image/gif 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/banner_aplicativos.gif
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: 066a5ee182c42e95b1a4a63b6312123473888c6a1743eb9587a3ea9fd36ee11d

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Content-Type: image/gif
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3882
Expires: Fri, 24 Jan 2020 12:25:40 GMT

GET
H/1.1 200
OK BotaoVoltar.png
www.roiscope.com/APP-Sincronizacao/Mobile/indexjuridica_files/ 4 KB
4 KB 70ms
70ms Image
image/png 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/indexjuridica_files/BotaoVoltar.png
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: cefd73f62d090c7265ca976b865e3c67fec4a43d299f72ef8d0f29bf134d1207

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 4004
Expires: Fri, 24 Jan 2020 12:25:40 GMT

GET
H/1.1 200
OK BotaoContinuar.png
www.roiscope.com/APP-Sincronizacao/Mobile/indexjuridica_files/ 9 KB
10 KB 78ms
78ms Image
image/png 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/indexjuridica_files/BotaoContinuar.png
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: 0940dfef966e68b8cd2db91437e4192e499c54174846b405a590fb77c8694c04

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 9636
Expires: Fri, 24 Jan 2020 12:25:40 GMT

GET
H/1.1 200
OK spacer.gif
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 45 B
336 B 81ms
81ms Image
image/gif 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/spacer.gif
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: e0f8dceb516151e70891cb4ed02aac4b5800b37c13d8328a35919472efe0f93e

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Content-Type: image/gif
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 45
Expires: Fri, 24 Jan 2020 12:25:40 GMT

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

6ms
5ms

Script
text/javascript

2a00:1450:4001:816::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 506
date: Fri, 17 Jan 2020 12:17:12 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17168
expires: Fri, 17 Jan 2020 14:17:12 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS

GET
H2

200

__utm.gif
www.google-analytics.com/r/
Redirect Chain

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1047368417&utmhn=www.roiscope.com&utme=8(Aplicativo*Experiencia)9(NOT_APP%2Fmozilla%205.0%20%20windows%20nt%2010.0%20%20wow64%20%...
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1047368417&utmhn=www.roiscope.com&utme=8(Aplicativo*Experiencia)9(NOT_APP%2Fmozilla%205.0%20%20windows%20nt%2010.0%20%20wow64%20...

35 B
111 B

13ms
13ms

Image
image/gif

2a00:1450:4001:816::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1047368417&utmhn=www.roiscope.com&utme=8(Aplicativo*Experiencia)9(NOT_APP%2Fmozilla%205.0%20%20windows%20nt%2010.0%20%20wow64%20%20applewebkit%20537.36%20%20khtml%20%20like%20gecko%20%20chrome%2049.0.2623.87%20safari%20537.36*TOUCH_2)11(2*2)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Ita%C3%B9%2030%20horas&utmhid=43221242&utmr=-&utmp=%2FLoginPF&utmht=1579263938938&utmac=UA-31857808-1&utmcc=__utma%3D227429662.1628229731.1579263939.1579263939.1579263939.1%3B%2B__utmz%3D227429662.1579263939.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1280364366&utmredir=1&utmu=qQCAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jan 2020 12:25:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1047368417&utmhn=www.roiscope.com&utme=8(Aplicativo*Experiencia)9(NOT_APP%2Fmozilla%205.0%20%20windows%20nt%2010.0%20%20wow64%20%20applewebkit%20537.36%20%20khtml%20%20like%20gecko%20%20chrome%2049.0.2623.87%20safari%20537.36*TOUCH_2)11(2*2)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Ita%C3%B9%2030%20horas&utmhid=43221242&utmr=-&utmp=%2FLoginPF&utmht=1579263938938&utmac=UA-31857808-1&utmcc=__utma%3D227429662.1628229731.1579263939.1579263939.1579263939.1%3B%2B__utmz%3D227429662.1579263939.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1280364366&utmredir=1&utmu=qQCAAAAAAAAAAAAAAAAAAAAE~
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK bg_iph_nm.png
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 3 KB
3 KB 77ms
77ms Image
image/png 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/bg_iph_nm.png
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: fea1d162a3c7bc8f7d4812a40b8047417ab6cc998ca87ab70df1a2d2b99ce3f4

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3181
Expires: Fri, 24 Jan 2020 12:25:40 GMT

GET
H/1.1 200
OK saved_resource
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 120 B
120 B 75ms
75ms Image
text/html 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/saved_resource
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed / PHP/5.6.40
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Content-Encoding: gzip
Server: LiteSpeed
X-Powered-By: PHP/5.6.40
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Connection: Keep-Alive
Content-Length: 124

GET
H/1.1 200
OK ItauLogo.png
www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ 7 KB
8 KB 85ms
85ms Image
image/png 185.165.185.116
CHML-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/index_files/ItauLogo.png
Requested by: Host: www.roiscope.com
URL: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
Protocol: HTTP/1.1
Server: 185.165.185.116 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS: server6.ghesi.net
Software: LiteSpeed /
Resource Hash: 7b6793adb9c95b47b80451f3665a58b4713f7427d640b99bb03c3d3a25a06778

Request headers

Referer: http://www.roiscope.com/APP-Sincronizacao/Mobile/ita2.php?number=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 12:25:40 GMT
Last-Modified: Wed, 08 May 2019 16:26:51 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 7592
Expires: Fri, 24 Jan 2020 12:25:40 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Itau (Banking)

64 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.roiscope.com/	1970-01-19 11:03:51	Name: __utmz Value: 227429662.1579263939.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.roiscope.com/	1969-12-31 23:59:59	Name: __utmc Value: 227429662
.roiscope.com/	1970-01-19 06:41:05	Name: __utmb Value: 227429662.1.10.1579263939
.roiscope.com/	1970-01-19 06:41:04	Name: __utmt Value: 1
.roiscope.com/	1970-01-20 00:12:15	Name: __utma Value: 227429662.1628229731.1579263939.1579263939.1579263939.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.google-analytics.com
www.roiscope.com
185.165.185.116
2a00:1450:4001:816::200e
00d0393fbbd8e3185eeb7b4d167bcd0a52845806ada161ea3b07f70bffdd3f77
066a5ee182c42e95b1a4a63b6312123473888c6a1743eb9587a3ea9fd36ee11d
0940dfef966e68b8cd2db91437e4192e499c54174846b405a590fb77c8694c04
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
2235ae869e418c6a37c86868bb6326ec85079ee0fc00cf2bd39882bd4b218d9d
2942283657612b371f42e59a6e28db8d2c3095fc31cf0b4eed39ccc5a1672485
479e98acc92133600bf208703d3d6aa267e8b270291de67f999d96c20451a35f
752cbe5428983d2cc4e20933b2df4e298aeae6b833d3d800854808e291afd0ed
7b6793adb9c95b47b80451f3665a58b4713f7427d640b99bb03c3d3a25a06778
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
b15bedfb9c47a85571d8b6a8c9ca0844a172cb8e83f97817fdffa7a414035649
cefd73f62d090c7265ca976b865e3c67fec4a43d299f72ef8d0f29bf134d1207
d1e8f51d5c13792382fcaea5a609a5e5e34a4014d6ea29eb0c2ac0ab39dac361
e0f8dceb516151e70891cb4ed02aac4b5800b37c13d8328a35919472efe0f93e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fea1d162a3c7bc8f7d4812a40b8047417ab6cc998ca87ab70df1a2d2b99ce3f4

www.roiscope.com Open in urlscan Pro 185.165.185.116 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

13 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

99 kBTransfer

174 kBSize

5 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

64 JavaScript Global Variables

5 Cookies

Indicators

www.roiscope.com Open in urlscan Pro
185.165.185.116 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

13 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

99 kB
Transfer

174 kB
Size

5
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!