ceplan.com.br Open in urlscan Pro
187.1.138.2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ceplan.com.br/logginn/NETFLIX%20MULTI/
Effective URL:
https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php
Submission: On September 23 via api (September 23rd 2024, 6:25:09 am UTC) from PL — Scanned from CH

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 187.1.138.2, located in Porto Alegre, Brazil and belongs to Cyberweb Networks Ltda, BR. The main domain is ceplan.com.br.
TLS certificate: Issued by R11 on September 16th 2024. Valid for: 3 months.

This is the only time ceplan.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address		AS Autonomous System
2 9	187.1.138.2 187.1.138.2		28299 (Cyberweb ...) (Cyberweb Networks Ltda)
8	2

9 187.1.138.2 (Porto Alegre, Brazil) 2 redirects

ASN28299 (Cyberweb Networks Ltda, BR)
PTR: web10f78.kinghost.net

ceplan.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	ceplan.com.br 2 redirects ceplan.com.br	761 KB
0	duckdns.org Failed telegrambotcheck.duckdns.org Failed
8	2

	Domain	Requested by
9	ceplan.com.br	2 redirects ceplan.com.br
0	telegrambotcheck.duckdns.org Failed	ceplan.com.br
8	2

This site contains no links.

Subject Issuer	Validity	Valid
ceplan.com.br R11	`2024-09-16` - `2024-12-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php
Frame ID: 7882CAADAE33C5BF0FD889AB51C292E8
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://ceplan.com.br/logginn/NETFLIX%20MULTI/ HTTP 302
https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/index.php HTTP 302
https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

761 kB
Transfer

794 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ceplan.com.br/logginn/NETFLIX%20MULTI/ HTTP 302
https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/index.php HTTP 302
https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request signin.php Show response ceplan.com.br/logginn/NETFLIX%20MULTI/auth/ Redirect Chain https://ceplan.com.br/logginn/NETFLIX%20MULTI/ https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/index.php https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php	36 KB 2 KB	208ms 207ms	Document text/html	187.1.138.2 Cyberweb Networks...
General Check archive.org Show headers Download Go to Full URL https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 187.1.138.2 Porto Alegre, Brazil, ASN28299 (Cyberweb Networks Ltda, BR), Reverse DNS web10f78.kinghost.net Software Apache / Resource Hash `bd2df88c89e0b99b101e1768c27289d64893e2f0d4e4e18e25673464980fc093` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-type text/html; charset=UTF-8 date Mon, 23 Sep 2024 06:25:00 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Accept-Encoding Redirect headers content-encoding gzip content-type text/html; charset=UTF-8 date Mon, 23 Sep 2024 06:24:59 GMT location signin.php server Apache vary Accept-Encoding
GET H2	200	style.css ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/	2 KB 2 KB	201ms 200ms	Stylesheet text/css	187.1.138.2 Cyberweb Networks...
General Check archive.org Show headers Download Go to Full URL https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/style.css Requested by Host: ceplan.com.br URL: https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 187.1.138.2 Porto Alegre, Brazil, ASN28299 (Cyberweb Networks Ltda, BR), Reverse DNS web10f78.kinghost.net Software Apache / Resource Hash `ec639da1e04408d4ccbe91dc227ddc21cc615b6d443928a2b49bb7280a0508bb` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Response headers cache-control max-age=1800 etag "642-6228184b71108" accept-ranges bytes content-length 1602 date Mon, 23 Sep 2024 06:25:00 GMT last-modified Thu, 19 Sep 2024 23:45:32 GMT content-type text/css server Apache
GET H2	200	logo.png ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/	32 KB 32 KB	200ms 199ms	Image image/png	187.1.138.2 Cyberweb Networks...
General Check archive.org Show headers Download Go to Show image Full URL https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/logo.png Requested by Host: ceplan.com.br URL: https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 187.1.138.2 Porto Alegre, Brazil, ASN28299 (Cyberweb Networks Ltda, BR), Reverse DNS web10f78.kinghost.net Software Apache / Resource Hash `94e277b7fd0aa31c86e646c079a8e27507efd39375d08eea8bd9d8ae6543ffca` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Response headers cache-control max-age=1800 etag "7e09-6228184b6b730" accept-ranges bytes content-length 32265 date Mon, 23 Sep 2024 06:25:00 GMT last-modified Thu, 19 Sep 2024 23:45:32 GMT content-type image/png server Apache
GET H2	200	jq.js Show response ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/	87 KB 88 KB	201ms 201ms	Script application/javascript	187.1.138.2 Cyberweb Networks...
General Check archive.org Show headers Download Go to Full URL https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/jq.js Requested by Host: ceplan.com.br URL: https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 187.1.138.2 Porto Alegre, Brazil, ASN28299 (Cyberweb Networks Ltda, BR), Reverse DNS web10f78.kinghost.net Software Apache / Resource Hash `ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Response headers cache-control max-age=1800 etag "15d9d-6228184b63647" accept-ranges bytes content-length 89501 date Mon, 23 Sep 2024 06:25:00 GMT last-modified Thu, 19 Sep 2024 23:45:32 GMT content-type application/javascript server Apache
GET H2	200	jquery1.js Show response ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/	361 KB 361 KB	748ms 748ms	Script application/javascript	187.1.138.2 Cyberweb Networks...
General Check archive.org Show headers Download Go to Full URL https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/jquery1.js Requested by Host: ceplan.com.br URL: https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 187.1.138.2 Porto Alegre, Brazil, ASN28299 (Cyberweb Networks Ltda, BR), Reverse DNS web10f78.kinghost.net Software Apache / Resource Hash `d066c11600369c32eea993e482d74be1bcc76c906f18f2ea7cd995bba6ecc385` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Response headers cache-control max-age=1800 etag "5a219-6228184b6690f" accept-ranges bytes content-length 369177 date Mon, 23 Sep 2024 06:25:00 GMT last-modified Thu, 19 Sep 2024 23:45:32 GMT content-type application/javascript server Apache
GET H2	200	back.jpg ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/	276 KB 276 KB	972ms 971ms	Image image/jpeg	187.1.138.2 Cyberweb Networks...
General Check archive.org Show headers Download Go to Show image Full URL https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/back.jpg Requested by Host: ceplan.com.br URL: https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 187.1.138.2 Porto Alegre, Brazil, ASN28299 (Cyberweb Networks Ltda, BR), Reverse DNS web10f78.kinghost.net Software Apache / Resource Hash `fab8bee9ff18e59b5eafe643a82e845296afce1dfa75eeafa5bf41811bd56836` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/res/style.css Response headers cache-control max-age=1800 etag "44f85-6228184b5e827" accept-ranges bytes content-length 282501 date Mon, 23 Sep 2024 06:25:00 GMT last-modified Thu, 19 Sep 2024 23:45:32 GMT content-type image/jpeg server Apache
POST		receive_token telegrambotcheck.duckdns.org/	0 0

GET H2	404	favicon.ico ceplan.com.br/	488 B 590 B	211ms 211ms	Other text/html	187.1.138.2 Cyberweb Networks...
General Check archive.org Show headers Download Go to Full URL https://ceplan.com.br/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 187.1.138.2 Porto Alegre, Brazil, ASN28299 (Cyberweb Networks Ltda, BR), Reverse DNS web10f78.kinghost.net Software Apache / Resource Hash `a6e2e353d8882532147bfcc278bc16ffe7e1625a7281a0d1aeadd24bf032e43c` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Response headers accept-ranges bytes content-length 488 etag "1e8-595ad1aad5040" date Mon, 23 Sep 2024 06:25:01 GMT last-modified Thu, 24 Oct 2019 19:33:13 GMT content-type text/html server Apache

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: telegrambotcheck.duckdns.org
URL: https://telegrambotcheck.duckdns.org:5001/receive_token?referrer=loco

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ceplan.com.br/	1969-12-31 23:59:59	Name: PHPSESSID Value: 65a4ebb80b538af8aa8400fd0ba49e01

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://ceplan.com.br/logginn/NETFLIX%20MULTI/auth/signin.php Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://ceplan.com.br/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ceplan.com.br
telegrambotcheck.duckdns.org
telegrambotcheck.duckdns.org
187.1.138.2
94e277b7fd0aa31c86e646c079a8e27507efd39375d08eea8bd9d8ae6543ffca
a6e2e353d8882532147bfcc278bc16ffe7e1625a7281a0d1aeadd24bf032e43c
bd2df88c89e0b99b101e1768c27289d64893e2f0d4e4e18e25673464980fc093
d066c11600369c32eea993e482d74be1bcc76c906f18f2ea7cd995bba6ecc385
ec639da1e04408d4ccbe91dc227ddc21cc615b6d443928a2b49bb7280a0508bb
ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127
fab8bee9ff18e59b5eafe643a82e845296afce1dfa75eeafa5bf41811bd56836

ceplan.com.br Open in urlscan Pro 187.1.138.2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

88 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

761 kBTransfer

794 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

ceplan.com.br Open in urlscan Pro
187.1.138.2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

761 kB
Transfer

794 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!