urlscan.io logo urlscan.io
SecurityTrails logo

boleto.a-black-friday.com Open in urlscan Pro
2606:4700:30::681c:163  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://boleto.a-black-friday.com/
Submission: On November 19 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 3 countries across 5 domains to perform 18 HTTP transactions. The main IP is 2606:4700:30::681c:163, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is boleto.a-black-friday.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 13th 2018. Valid for: a year.
This is the only time boleto.a-black-friday.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lojas Americanas (Retail)

Domain & IP information

IP Address AS Autonomous System
2 2606:4700:30:... 13335 (CLOUDFLAR...)
6 151.80.204.61 16276 (OVH)
5 2.18.233.188 16625 (AKAMAI-AS)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 151.101.2.110 54113 (FASTLY)
1 162.247.242.18 23467 (NEWRELIC-...)
1 2600:9000:20b... 16509 (AMAZON-02)
1 54.230.95.149 16509 (AMAZON-02)
18 9
2    2606:4700:30::681c:163 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
boleto.a-black-friday.com
6    151.80.204.61 (Italy)

ASN16276 (OVH, FR)
PTR: ip61.ip-151-80-204.eu
statics-americanas.b2w.io
5    2.18.233.188 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-188.deploy.static.akamaitechnologies.com
images-americanas.b2w.io
1    2a02:26f0:6c00:28e::19fe (European Union)

ASN20940 (AKAMAI-ASN1, US)
spacey-api-v2-americanas.b2w.io
1    151.101.2.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com
1    162.247.242.18 (United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-6.nr-data.net
bam.nr-data.net
1    2600:9000:20bb:9200:0:ee2:240:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
selo.siteblindado.com
1    54.230.95.149 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-95-149.fra2.r.cloudfront.net
api.siteblindado.com
Domain Requested by
6 statics-americanas.b2w.io boleto.a-black-friday.com
5 images-americanas.b2w.io boleto.a-black-friday.com
2 boleto.a-black-friday.com boleto.a-black-friday.com
1 api.siteblindado.com selo.siteblindado.com
1 selo.siteblindado.com statics-americanas.b2w.io
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com boleto.a-black-friday.com
1 spacey-api-v2-americanas.b2w.io statics-americanas.b2w.io
18 8
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2018-11-13 -
2019-11-13		 a year crt.sh
*.b2w.io
SSL Blindado 2		 2018-07-10 -
2019-08-25		 a year crt.sh
b2wdigital.com
DigiCert SHA2 Secure Server CA		 2018-11-05 -
2020-02-04		 a year crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2018-11-07 -
2019-04-14		 5 months crt.sh
*.nr-data.net
GeoTrust RSA CA 2018		 2018-01-11 -
2020-03-17		 2 years crt.sh
*.siteblindado.com
SSL Blindado 2		 2017-07-28 -
2019-08-22		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://boleto.a-black-friday.com/
Frame ID: 7F00A104910F125F4E67C39BE66275B1
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<[^>]+data-react/i
Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i
Overall confidence: 100%
Detected patterns
  • env /^NREUM/i

Page Statistics

18
Requests

100 %
HTTPS

38 %
IPv6

5
Domains

8
Subdomains

9
IPs

3
Countries

978 kB
Transfer

3847 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
boleto.a-black-friday.com/ 		373 KB
84 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://boleto.a-black-friday.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:163 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
30be12268eba11bca4679fa402f2da3e00317d783c510e381dffce939ff772d1

Request headers

:method
GET
:authority
boleto.a-black-friday.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 19 Nov 2018 22:53:58 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d97eb68efb1e00479184449fcaa6eb8281542668038; expires=Tue, 19-Nov-19 22:53:58 GMT; path=/; domain=.a-black-friday.com; HttpOnly; Secure PHPSESSID=scum3d36m6gt880nok63k9nuc2; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
47c64186ad4dc2ce-FRA
content-encoding
gzip
theme.css
statics-americanas.b2w.io/zion/1.71.1-garage.0/theme/stylesheets/ 		471 KB
75 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/zion/1.71.1-garage.0/theme/stylesheets/theme.css
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
Apache /
Resource Hash
848914eebba0c3a527d6ed7c97fcd7a5c59eefbb9ea532b47bd9ea478c65fdbc

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
last-modified
Thu, 30 Aug 2018 20:46:31 GMT
server
Apache
status
200
etag
"75b5e-574ad2b77faa8-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/css
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Tue, 20 Nov 2018 22:53:59 GMT
3868dfb588de6d0589aa66ddec0f0916.main.css
statics-americanas.b2w.io/zion/stylesheets// 		14 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/zion/stylesheets//3868dfb588de6d0589aa66ddec0f0916.main.css
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
Apache /
Resource Hash
8e6e7f0adbbcc9477a1cea6d9b06b9b1d1f922352cb232d66898cbce5c72774f

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
status
200
content-length
2900
last-modified
Thu, 30 Aug 2018 20:46:21 GMT
server
Apache
etag
"3685-574ad2adf7449-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/css
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
accept-ranges
bytes
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Tue, 20 Nov 2018 22:53:59 GMT
vendor.js
statics-americanas.b2w.io/zion/1.71.1-garage.0/ 		845 KB
185 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/zion/1.71.1-garage.0/vendor.js
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
Apache /
Resource Hash
29dd0e912e1c7092e7271f1f198486b8f90c62bf2f3f3af957aa7e0afca1cbd6

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
last-modified
Thu, 30 Aug 2018 20:46:10 GMT
server
Apache
status
200
etag
"d35c0-574ad2a3788cd-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Tue, 20 Nov 2018 22:53:59 GMT
main.js
statics-americanas.b2w.io/zion/1.71.1-garage.0/ 		2 MB
489 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/zion/1.71.1-garage.0/main.js
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
Apache /
Resource Hash
57297b2e08386af73e1f823f5ce0b66fa5d41e6c40804aea6eb5760e0146d65e

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
last-modified
Thu, 30 Aug 2018 20:46:12 GMT
server
Apache
status
200
etag
"1b541f-574ad2a560e33-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Tue, 20 Nov 2018 22:53:59 GMT
header.min.js
statics-americanas.b2w.io/statics-header/1.23.21.1405/ 		129 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/statics-header/1.23.21.1405/header.min.js
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
Apache /
Resource Hash
76ee30e38f1e4b832a8661fcce2c67004da3a067563363422fc366c85e4215c0

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
status
200
content-length
33784
last-modified
Tue, 28 Aug 2018 14:00:42 GMT
server
Apache
etag
"20233-5747f4478f6f9-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
accept-ranges
bytes
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Tue, 20 Nov 2018 22:53:59 GMT
129610205_1GG.jpg
images-americanas.b2w.io/produtos/01/00/item/129610/2/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/produtos/01/00/item/129610/2/129610205_1GG.jpg
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.188 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-188.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c508ddba89ada6d00fe4826ac66455943c9292d3b115d9c230e1a950e00dcb25

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
cache-control
public, max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
content-length
16647
expires
Mon, 26 Nov 2018 22:53:59 GMT
129610281_1GG.jpg
images-americanas.b2w.io/produtos/01/00/item/129610/2/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/produtos/01/00/item/129610/2/129610281_1GG.jpg
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.188 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-188.deploy.static.akamaitechnologies.com
Software
Thumbor/6.3.2 /
Resource Hash
478e5895b5a627245fcadcf5118d85ecfec70ea273bb7b125a078782f52279ad

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
server
Thumbor/6.3.2
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
cache-control
public, max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
content-length
17498
expires
Mon, 26 Nov 2018 22:53:59 GMT
131940650_1GG.jpg
images-americanas.b2w.io/produtos/01/00/item/131940/6/ 		14 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/produtos/01/00/item/131940/6/131940650_1GG.jpg
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.188 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-188.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b1ba5c6b31eee218a99e46de5ba96f850cebcd6fe4eacd0575e916fc797cbda1

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
135
date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
x-edgeconnect-midmile-rtt
77
x-cache-status
HIT
status
200
content-length
12392
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
cache-control
public, max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
expires
Mon, 26 Nov 2018 22:53:59 GMT
129610483_1GG.jpg
images-americanas.b2w.io/produtos/01/00/item/129610/4/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/produtos/01/00/item/129610/4/129610483_1GG.jpg
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.188 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-188.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c6d1176cd1c2cc465d416c09c0e9ee8642a2e4f195f69b5d85d89ac0fd9577b4

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
cache-control
public, max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
content-length
17328
expires
Mon, 26 Nov 2018 22:53:59 GMT
email-decode.min.js
boleto.a-black-friday.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
830 B 		Script
General
Check archive.org
Download Go to
Full URL
https://boleto.a-black-friday.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:163 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

:path
/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma
no-cache
cookie
__cfduid=d97eb68efb1e00479184449fcaa6eb8281542668038; PHPSESSID=scum3d36m6gt880nok63k9nuc2
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
boleto.a-black-friday.com
referer
https://boleto.a-black-friday.com/
:scheme
https
:method
GET
Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:58 GMT
content-encoding
gzip
vary
Accept-Encoding
last-modified
Thu, 15 Nov 2018 18:24:37 GMT
server
cloudflare
etag
W/"5bedb9e5-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
cache-control
max-age=172800 public
cf-ray
47c6418b7eb5c2ce-FRA
expires
Wed, 21 Nov 2018 22:53:58 GMT
footer.min.js
statics-americanas.b2w.io/statics-footer/1.23.21.1405/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://statics-americanas.b2w.io/statics-footer/1.23.21.1405/footer.min.js
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.80.204.61 , Italy, ASN16276 (OVH, FR),
Reverse DNS
ip61.ip-151-80-204.eu
Software
Apache /
Resource Hash
8b7543f266c86f2dd36d5742990da8fae5666134bea74baf7aa38d10057f8418

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
status
200
content-length
2448
last-modified
Tue, 28 Aug 2018 14:00:44 GMT
server
Apache
etag
"1a4a-5747f44977b5e-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
cache-control
max-age=86400
accept-ranges
bytes
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, Host, Origin
expires
Tue, 20 Nov 2018 22:53:59 GMT
truncated
/ 		22 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bf91fe8cbc4f2d9ef41e522b3d4917a4d2dad4cbb1f133be1119fb3ea1bb6221

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Content-Type
img/png
feather
spacey-api-v2-americanas.b2w.io/v2/spacey-api/publications/desktop/ 		137 KB
19 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://spacey-api-v2-americanas.b2w.io/v2/spacey-api/publications/desktop/feather
Requested by
Host: statics-americanas.b2w.io
URL: https://statics-americanas.b2w.io/statics-header/1.23.21.1405/header.min.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28e::19fe , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
nginx /
Resource Hash
16b4b79db6273450065378c865c9a90630bed652a6c72fee7e4911ddc1b1befa

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://boleto.a-black-friday.com/
Origin
https://boleto.a-black-friday.com

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
vary
Accept-Encoding
x-tid
f6178aa3-a09b-490f-951f-ceca17a1f26a
x-cache-status
HIT
status
200
x-haproxy-ip
x-haproxy-hostname
us-east-1a-public-haproxy-americanas-10-238-2-68.atlas.b2w
x-public
true
content-length
19450
server
nginx
etag
W/"2249d-kYtj5kb/5Xxmv2DrJaJqgknnp8k"
access-control-max-age
86400
access-control-allow-methods
GET,OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-TID
cache-control
max-age=92, s-maxage=300
access-control-allow-credentials
false
access-control-allow-headers
*
nr-1071.min.js
js-agent.newrelic.com/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1071.min.js
Requested by
Host: boleto.a-black-friday.com
URL: https://boleto.a-black-friday.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
56097e8b7ceb27db42a5e102af6d11dfdcaee13d8716477a8e242b4957d7a280

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
x-amz-request-id
481FE111768851BD
x-cache
HIT
status
200
content-length
9086
x-amz-id-2
0YRbL+xndniUNryTFyPMh7blhTKIHFgax7VZOYNB0faQOHdTX/PT1kK81w0HdqDzPFNiC/1Ey3g=
x-served-by
cache-fra19123-FRA
last-modified
Wed, 28 Feb 2018 23:33:31 GMT
server
AmazonS3
x-timer
S1542668039.494391,VS0,VE0
etag
"a1a545c95f313a230157b47dca555c25"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4859
0699e41a46
bam.nr-data.net/1/ 		57 B
261 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/0699e41a46?a=48356373&v=1071.385e752&to=M1NXNxEFXEtRUkRZVgoZdhYQEF1VHx4%3D&rst=1363&ref=https://boleto.a-black-friday.com/&ap=100.133716&be=735&fe=1291&dc=808&tt=1ec454cc9229be&perf=%7B%22timing%22:%7B%22of%22:1542668038159,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:1,%22c%22:1,%22s%22:6,%22ce%22:22,%22rq%22:22,%22rp%22:607,%22rpe%22:796,%22dl%22:728,%22di%22:808,%22ds%22:808,%22de%22:808,%22dc%22:1291,%22l%22:1291,%22le%22:1293%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1071.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.18 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS
bam-6.nr-data.net
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Expires
Thu, 01 Jan 1970 00:00:00 GMT
Content-Length
57
Content-Type
text/javascript;charset=ISO-8859-1
BF_pre-02__HOME_topinho_branco.png
images-americanas.b2w.io/spacey/2018/11/07/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-americanas.b2w.io/spacey/2018/11/07/BF_pre-02__HOME_topinho_branco.png
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.188 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-188.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
107174f0088edbaa8e76ef30da36279ac0804552d1ab5f0d7056839e51212cea

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 19 Nov 2018 22:53:59 GMT
content-encoding
gzip
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
cache-control
public, max-age=604800
access-control-allow-headers
DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization, charset, Content-Encoding, Location, Allow, X-TID, WWW-Authenticate, X-Access-Control-Realm, internalId, Accept-Encoding, Accept-Language, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Host, Origin, Pragma, Referer, X-Preview, log
content-length
6465
expires
Mon, 26 Nov 2018 22:53:59 GMT
aw.js
selo.siteblindado.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://selo.siteblindado.com/aw.js
Requested by
Host: statics-americanas.b2w.io
URL: https://statics-americanas.b2w.io/statics-header/1.23.21.1405/header.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:9200:0:ee2:240:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fa0450bfb42a4268cd406e2fcb72d14cf99ae2f652a57ffe76adc829ca0e7eb4

Request headers

Referer
https://boleto.a-black-friday.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 16:06:43 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Aug 2018 16:06:04 GMT
Server
AmazonS3
Age
16949
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 8bbec5871de1c2a41003db8fbeafebf8.cloudfront.net (CloudFront)
Transfer-Encoding
chunked
Connection
keep-alive
X-Amz-Cf-Id
U-s2Bg_rox8Aw_rR_gAFbp-iKMOE08lAPEqUsd8zdbiJt_aYiRtVjQ==
info
api.siteblindado.com/v1/seal/aw/boleto.a-black-friday.com/ 		54 B
442 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.siteblindado.com/v1/seal/aw/boleto.a-black-friday.com/info
Requested by
Host: selo.siteblindado.com
URL: https://selo.siteblindado.com/aw.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.95.149 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-149.fra2.r.cloudfront.net
Software
gunicorn/19.9.0 /
Resource Hash
0a9a490ba1f2dc0239521d3bbfb2465509aa05302491e716de4ed8a838a9215f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://boleto.a-black-friday.com/
Origin
https://boleto.a-black-friday.com

Response headers

Date
Mon, 19 Nov 2018 18:10:25 GMT
Via
1.1 10e95c517e657ad53448fce5195e9cba.cloudfront.net (CloudFront)
Server
gunicorn/19.9.0
Age
17014
X-Cache
Hit from cloudfront
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
*
Connection
keep-alive
Content-Length
54
X-Amz-Cf-Id
tntyTq4rmUzJfdCFV2VuQ8pR2godlVW6PE_YqNHrTdDInIKeFqd1WA==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lojas Americanas (Retail)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| camuflar object| NREUM object| newrelic function| __nr_require string| svghash object| featherRenderConfig string| __PRELOADED_STATE__ string| contador function| startTimer object| memoryStorage object| feather object| xmlhttp string| hostname object| languages string| app_path string| url object| json undefined| sealSelectors function| insertSeal

2 Cookies

Domain/Path Name / Value
boleto.a-black-friday.com/ Name: PHPSESSID
Value: scum3d36m6gt880nok63k9nuc2
.a-black-friday.com/ Name: __cfduid
Value: d97eb68efb1e00479184449fcaa6eb8281542668038

1 Console Messages

Source Level URL
Text
console-api error URL: https://boleto.a-black-friday.com/(Line 237)
Message:
ServiceWorker registration failed:

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.siteblindado.com
bam.nr-data.net
boleto.a-black-friday.com
images-americanas.b2w.io
js-agent.newrelic.com
selo.siteblindado.com
spacey-api-v2-americanas.b2w.io
statics-americanas.b2w.io
151.101.2.110
151.80.204.61
162.247.242.18
2.18.233.188
2600:9000:20bb:9200:0:ee2:240:93a1
2606:4700:30::681c:163
2a02:26f0:6c00:28e::19fe
54.230.95.149
0a9a490ba1f2dc0239521d3bbfb2465509aa05302491e716de4ed8a838a9215f
107174f0088edbaa8e76ef30da36279ac0804552d1ab5f0d7056839e51212cea
16b4b79db6273450065378c865c9a90630bed652a6c72fee7e4911ddc1b1befa
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
29dd0e912e1c7092e7271f1f198486b8f90c62bf2f3f3af957aa7e0afca1cbd6
30be12268eba11bca4679fa402f2da3e00317d783c510e381dffce939ff772d1
478e5895b5a627245fcadcf5118d85ecfec70ea273bb7b125a078782f52279ad
56097e8b7ceb27db42a5e102af6d11dfdcaee13d8716477a8e242b4957d7a280
57297b2e08386af73e1f823f5ce0b66fa5d41e6c40804aea6eb5760e0146d65e
76ee30e38f1e4b832a8661fcce2c67004da3a067563363422fc366c85e4215c0
848914eebba0c3a527d6ed7c97fcd7a5c59eefbb9ea532b47bd9ea478c65fdbc
8b7543f266c86f2dd36d5742990da8fae5666134bea74baf7aa38d10057f8418
8e6e7f0adbbcc9477a1cea6d9b06b9b1d1f922352cb232d66898cbce5c72774f
b1ba5c6b31eee218a99e46de5ba96f850cebcd6fe4eacd0575e916fc797cbda1
bf91fe8cbc4f2d9ef41e522b3d4917a4d2dad4cbb1f133be1119fb3ea1bb6221
c508ddba89ada6d00fe4826ac66455943c9292d3b115d9c230e1a950e00dcb25
c6d1176cd1c2cc465d416c09c0e9ee8642a2e4f195f69b5d85d89ac0fd9577b4
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
fa0450bfb42a4268cd406e2fcb72d14cf99ae2f652a57ffe76adc829ca0e7eb4