urlscan.io logo urlscan.io
SecurityTrails logo

clubdeportivofortaleza.com Open in urlscan Pro
162.222.227.230  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://links.panamamarketing.net/ls/click?upn=su8YI4Wp4mS7PUP4EPgImZV-2Bh7IPTpM0jOp6EJ5TZgbSNcBXkTfw2B2F6z26jvYDDhD-2FsBrULNduS9J...
Effective URL: https://clubdeportivofortaleza.com/web/3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13InboxLight.aspx?n=177425...
Submission: On May 21 via manual from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 162.222.227.230, located in Burlington, United States and belongs to PUBLIC-DOMAIN-REGISTRY, US. The main domain is clubdeportivofortaleza.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 7th 2020. Valid for: 3 months.
This is the only time clubdeportivofortaleza.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.118.52 11377 (SENDGRID)
1 2 162.222.227.230 394695 (PUBLIC-DO...)
1 2.18.233.122 16625 (AKAMAI-AS)
2 3
Apex Domain
Subdomains		 Transfer
2 clubdeportivofortaleza.com
clubdeportivofortaleza.com
27 KB
1 ui-portal.de
img.ui-portal.de
205 B
1 panamamarketing.net
links.panamamarketing.net
283 B
2 3
Domain Requested by
2 clubdeportivofortaleza.com 1 redirects
1 img.ui-portal.de clubdeportivofortaleza.com
1 links.panamamarketing.net 1 redirects
2 3

This site contains no links.

Subject Issuer Validity Valid
clubdeportivofortaleza.com
Let's Encrypt Authority X3		 2020-04-07 -
2020-07-06		 3 months crt.sh
img.ui-portal.de
GeoTrust RSA CA 2018		 2019-08-06 -
2020-11-04		 a year crt.sh

This page contains 1 frames:

Primary Page: https://clubdeportivofortaleza.com/web/3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 4A7C511F4D048B7A0A336BECD83CAD4A
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://links.panamamarketing.net/ls/click?upn=su8YI4Wp4mS7PUP4EPgImZV-2Bh7IPTpM0jOp6EJ5TZgbSNcBXkTfw2B2F6z26j... HTTP 302
    https://clubdeportivofortaleza.com/web/index.php?email=nicharass.a@linecorp.com HTTP 302
    https://clubdeportivofortaleza.com/web/3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13Inbo... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

26 kB
Transfer

62 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://links.panamamarketing.net/ls/click?upn=su8YI4Wp4mS7PUP4EPgImZV-2Bh7IPTpM0jOp6EJ5TZgbSNcBXkTfw2B2F6z26jvYDDhD-2FsBrULNduS9JkQLLS1WgbBlCfuo9-2B9MJxuvgjydBI4NkZVziahAFZOFLIO4RyY-aQ_VxHgeCt0HRJdjsbGvyEGnAYDUie9hqn16d-2BbXlSj8wPb3PdXYfVIyQx5EA8t33mfvYegCwzDS2KxL6kyeHLJqGXDUvJf1SCrdekC1cLYPIbWVQdFNy-2Bm-2BEZKy4wsi3L6PxcTv5ZRrWuM-2FGj4oY0TCo8R0WzVs-2Ff9Z5K902DWLPN88sTmZP8VNTqf0cMTTEjnsPV8QDMFDZkumZs3Cg8MFw-3D-3D HTTP 302
    https://clubdeportivofortaleza.com/web/index.php?email=nicharass.a@linecorp.com HTTP 302
    https://clubdeportivofortaleza.com/web/3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 3lyai3tnbr8w403sssnziw1d.php
clubdeportivofortaleza.com/web/
Redirect Chain
  • http://links.panamamarketing.net/ls/click?upn=su8YI4Wp4mS7PUP4EPgImZV-2Bh7IPTpM0jOp6EJ5TZgbSNcBXkTfw2B2F6z26jvYDDhD-2FsBrULNduS9JkQLLS1WgbBlCfuo9-2B9MJxuvgjydBI4NkZVziahAFZOFLIO4RyY-aQ_VxHgeCt0HRJd...
  • https://clubdeportivofortaleza.com/web/index.php?email=nicharass.a@linecorp.com
  • https://clubdeportivofortaleza.com/web/3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13InboxLight.aspx?n=1774256418&fid=4
39 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://clubdeportivofortaleza.com/web/3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.222.227.230 Burlington, United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
bh-39.webhostbox.net
Software
Apache / PHP/5.6.40
Resource Hash
0667ab7fb649db3a08bd097b756a2bc869cd8601438d8bd294aee6f6e8c8107a

Request headers

:method
GET
:authority
clubdeportivofortaleza.com
:scheme
https
:path
/web/3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13InboxLight.aspx?n=1774256418&fid=4
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
PHPSESSID=hf72225mlvuan77297b8rttbp0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Thu, 21 May 2020 02:01:36 GMT
server
Apache
x-powered-by
PHP/5.6.40
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html; charset=UTF-8

Redirect headers

status
302
date
Thu, 21 May 2020 02:01:36 GMT
server
Apache
x-powered-by
PHP/5.6.40
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
set-cookie
PHPSESSID=hf72225mlvuan77297b8rttbp0; path=/
location
3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
content-length
0
content-type
text/html; charset=UTF-8
p.gif
img.ui-portal.de/ 		42 B
205 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.ui-portal.de/p.gif
Requested by
Host: clubdeportivofortaleza.com
URL: https://clubdeportivofortaleza.com/web/3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.122 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-122.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://clubdeportivofortaleza.com/web/3lyai3tnbr8w403sssnziw1d.php?email=nicharass.a@linecorp.com&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 21 May 2020 02:01:37 GMT
last-modified
Thu, 08 Aug 2002 13:23:51 GMT
server
Apache
etag
"2a-3a7b33340c7c0"
content-type
image/gif
status
200
cache-control
public, max-age=1176
accept-ranges
bytes
x-robots-tag
noindex
content-length
42
truncated
/ 		23 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ec062ab5eb68e0bfb63e327c19ab4e848f4c44648247f846c76445b432837128

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| check

1 Cookies

Domain/Path Name / Value
clubdeportivofortaleza.com/ Name: PHPSESSID
Value: hf72225mlvuan77297b8rttbp0