oportunidade.valdinascimento.com.br Open in urlscan Pro
65.111.191.227 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://similargo.com/out/aHR0cHM6Ly9vcG9ydHVuaWRhZGUudmFsZGluYXNjaW1lbnRvLmNvbS5ici92b3RyZWUvcGF5bWVudC5waHA?route=ac...
Effective URL:
https://oportunidade.valdinascimento.com.br/votree/payment.php
Submission: On March 29 via manual (March 29th 2022, 4:54:27 am UTC) from US — Scanned from DE

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 21 HTTP transactions. The main IP is 65.111.191.227, located in Miami, United States and belongs to INFOLINK-MIA-, US. The main domain is oportunidade.valdinascimento.com.br.
TLS certificate: Issued by R3 on February 24th 2022. Valid for: 3 months.

This is the only time oportunidade.valdinascimento.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Saudi Post (Government)

Domain & IP information

	IP Address	AS Autonomous System
1	2a06:98c1:312... 2a06:98c1:3120::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
20	65.111.191.227 65.111.191.227	15083 (INFOLINK-...) (INFOLINK-MIA-)
21	2

1 2a06:98c1:3120::7 (United States)

ASN13335 (CLOUDFLARENET, US)

similargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 65.111.191.227 (Miami, United States)

ASN15083 (INFOLINK-MIA-, US)
PTR: wordpress001.eb4us.com

oportunidade.valdinascimento.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	valdinascimento.com.br oportunidade.valdinascimento.com.br	524 KB
1	similargo.com similargo.com	955 B
21	2

	Domain	Requested by
20	oportunidade.valdinascimento.com.br	similargo.com oportunidade.valdinascimento.com.br
1	similargo.com
21	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-27` - `2022-06-26`	a year	crt.sh
valdinascimento.com.br R3	`2022-02-24` - `2022-05-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://oportunidade.valdinascimento.com.br/votree/payment.php
Frame ID: 6F7B2DB6426328DBB7BA29CBED979035
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Saudi Post - Simple & Trusted Payments

Page URL History Show full URLs

https://similargo.com/out/aHR0cHM6Ly9vcG9ydHVuaWRhZGUudmFsZGluYXNjaW1lbnRvLmNvbS5ici92b3RyZWUvcGF5... Page URL
https://oportunidade.valdinascimento.com.br/votree/payment.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

21
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

525 kB
Transfer

946 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://similargo.com/out/aHR0cHM6Ly9vcG9ydHVuaWRhZGUudmFsZGluYXNjaW1lbnRvLmNvbS5ici92b3RyZWUvcGF5bWVudC5waHA?route=account/order/info&order_id=EE5971659SA Page URL
https://oportunidade.valdinascimento.com.br/votree/payment.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 aHR0cHM6Ly9vcG9ydHVuaWRhZGUudmFsZGluYXNjaW1lbnRvLmNvbS5ici92b3RyZWUvcGF5bWVudC5waHA Show response
similargo.com/out/ 413 B
955 B 65ms
41ms Document
text/html 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://similargo.com/out/aHR0cHM6Ly9vcG9ydHVuaWRhZGUudmFsZGluYXNjaW1lbnRvLmNvbS5ici92b3RyZWUvcGF5bWVudC5waHA?route=account/order/info&order_id=EE5971659SA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0568a6fd61bcdb1567fd90ba79283a6415d2b24b3f3fbaa441d1c6063c89b296

Security Headers

Name	Value
Content-Security-Policy	default-src * data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Tue, 29 Mar 2022 04:54:23 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
cache-control: max-age=5
expires: Tue, 29 Mar 2022 04:54:28 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src * data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mLBQi1I%2BAH6X35eGQMS%2FwSKO%2Fj%2BELur%2B933FDNqpCH6%2FN%2BudqPM%2F%2Fqb3hLrqlBiyvZWYPR%2FfdMJXatoNFc%2FMGHzvxzX3B6WIoFVPruo0r%2BNlgNHfR1e59X8G2BO8%2B4ToeZh7lSQbRknOhTQx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6f3601dc6a8c5c02-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 Primary Request payment.php Show response
oportunidade.valdinascimento.com.br/votree/ 17 KB
5 KB 629ms
124ms Document
text/html 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Requested by: Host: similargo.com
URL: https://similargo.com/out/aHR0cHM6Ly9vcG9ydHVuaWRhZGUudmFsZGluYXNjaW1lbnRvLmNvbS5ici92b3RyZWUvcGF5bWVudC5waHA?route=account/order/info&order_id=EE5971659SA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 7dfa84dd8fa2462daa17574d24be974c3076a4edea037648b6ec9b6c4bd2142e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://similargo.com/

Response headers

server: nginx
date: Tue, 29 Mar 2022 04:54:22 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-encoding: gzip

GET
H2 200 bootstrap.css
oportunidade.valdinascimento.com.br/votree/files/ 140 KB
20 KB 248ms
247ms Stylesheet
text/css 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/bootstrap.css
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: e3ac3b8c4a13f2f0ae8c1ae1ecffa93f7f3528c05d440141f83cfea940132d6d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: W/"61d28742-23027"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 custom.css
oportunidade.valdinascimento.com.br/votree/files/ 12 KB
3 KB 248ms
248ms Stylesheet
text/css 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/custom.css
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 1027cddddbd69edd1f84013d8f86a9bafa415503b104e5e1fb003b70e5362e3b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: W/"61d28742-2f05"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
oportunidade.valdinascimento.com.br/votree/files/ 2 KB
792 B 249ms
248ms Stylesheet
text/css 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/style.css
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 68b7e9302357f948488decd18e467a578a663902ec7b18773f680eca120e8cd9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: W/"61d28742-6f6"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 opensans.css
oportunidade.valdinascimento.com.br/votree/files/ 1 KB
508 B 249ms
249ms Stylesheet
text/css 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/opensans.css
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 7b813b380d5e99d9d7ae94501469895cb3658f7b45d91ac6cfdfaa3665388112

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: W/"61d28742-4a9"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 intlTelInput.css
oportunidade.valdinascimento.com.br/votree/build/css/ 25 KB
3 KB 249ms
249ms Stylesheet
text/css 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/build/css/intlTelInput.css
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: ad32b1248207ba91fb945a37d38e7c9deafcba849245872203482db42930d491

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: W/"61d28742-62a6"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 loading_payment.gif
oportunidade.valdinascimento.com.br/votree/files/ 11 KB
11 KB 368ms
366ms Image
image/gif 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/loading_payment.gif
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 5432b59decde382eae206cbe12dee7dd05ca9dcacb67f027a59b6a97a4379f07

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: "61d28742-2a43"
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 10819
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 62617_1589791686.png
oportunidade.valdinascimento.com.br/votree/files/ 12 KB
12 KB 368ms
367ms Image
image/png 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/62617_1589791686.png
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 16893732c1d56cff7778f74e569a833e345cc0f0fb0c3226380d7bcf414f51fe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: "61d28742-2f60"
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 12128
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 58482363cef1014c0b5e49c1.png
oportunidade.valdinascimento.com.br/votree/files/ 80 KB
81 KB 368ms
367ms Image
image/png 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/58482363cef1014c0b5e49c1.png
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 60fc37f80886700e21b2f04c04bf880087a5a69d87a530e33d11e4eaea5ac67c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: "61d28742-141d3"
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 82387
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 58482354cef1014c0b5e49c0.png
oportunidade.valdinascimento.com.br/votree/files/ 37 KB
38 KB 368ms
367ms Image
image/png 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/58482354cef1014c0b5e49c0.png
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 750ac8d2bd2d0168a404a67733239d84262902c0dc2f231fff66182436a6e0c4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: "61d28742-9531"
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 38193
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 intlTelInput.js Show response
oportunidade.valdinascimento.com.br/votree/build/js/ 87 KB
21 KB 249ms
247ms Script
application/javascript 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/build/js/intlTelInput.js
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 1bc2d5be2d753eaf2f6c0e91bdb24a95a9e20d19e1d76edcbf1a0bb13818643f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: W/"61d28742-15cfa"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cards.png
oportunidade.valdinascimento.com.br/votree/files/ 18 KB
18 KB 368ms
367ms Image
image/png 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/cards.png
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 0434701192cc2fbfad32f66624b56676a8f416d3d94b259fa1eb1aaa60f6ad39

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: "61d28742-46c6"
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 18118
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cards1.png
oportunidade.valdinascimento.com.br/votree/files/ 17 KB
17 KB 368ms
367ms Image
image/png 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/cards1.png
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 186c8713eeaa90ab36660a4ae84f95e51aa3730dd3543c5ce18e776108a75b60

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: "61d28742-4364"
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 17252
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 trust-removebg-preview.png
oportunidade.valdinascimento.com.br/votree/files/ 132 KB
133 KB 368ms
367ms Image
image/png 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/trust-removebg-preview.png
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 4f1bf1cc5ae0cd0c356965fd378e4e9c30268533949d65349c2d4315852627a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: "61d28742-210ff"
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 135423
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 express-checkout.png
oportunidade.valdinascimento.com.br/votree/files/ 37 KB
37 KB 368ms
368ms Image
image/png 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/express-checkout.png
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/payment.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 1a84a7da15921a85f7a8bd195b2eee6310715e1d9afa14bf75b2ce6fd7bfd52d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: "61d28742-9448"
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 37960
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 404 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
oportunidade.valdinascimento.com.br/votree/files/ 0
0 2195ms
2195ms Font
text/html 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/files/opensans.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash

Request headers

Referer: https://oportunidade.valdinascimento.com.br/votree/files/opensans.css
Origin: https://oportunidade.valdinascimento.com.br
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:24 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://oportunidade.valdinascimento.com.br/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 mem8YaGs126MiZpBA-UFVZ0b.woff2
oportunidade.valdinascimento.com.br/votree/files/ 0
0 2262ms
2262ms Font
text/html 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/mem8YaGs126MiZpBA-UFVZ0b.woff2
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/files/opensans.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash

Request headers

Referer: https://oportunidade.valdinascimento.com.br/votree/files/opensans.css
Origin: https://oportunidade.valdinascimento.com.br
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:24 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://oportunidade.valdinascimento.com.br/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 mem5YaGs126MiZpBA-UNirkOUuhp.woff2
oportunidade.valdinascimento.com.br/votree/files/ 0
0 2428ms
2428ms Font
text/html 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/files/mem5YaGs126MiZpBA-UNirkOUuhp.woff2
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/files/opensans.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash

Request headers

Referer: https://oportunidade.valdinascimento.com.br/votree/files/opensans.css
Origin: https://oportunidade.valdinascimento.com.br
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:24 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://oportunidade.valdinascimento.com.br/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 flags.png
oportunidade.valdinascimento.com.br/votree/build/img/ 69 KB
69 KB 240ms
240ms Image
image/png 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oportunidade.valdinascimento.com.br/votree/build/img/flags.png
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/build/css/intlTelInput.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: 0a012cf808a24573168308916092d2d4bd3f2b4af8e16b59167013cc77acee55

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/build/css/intlTelInput.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:22 GMT
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: "61d28742-114c9"
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 70857
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 utils.js Show response
oportunidade.valdinascimento.com.br/votree/build/js/ 248 KB
56 KB 248ms
248ms Script
application/javascript 65.111.191.227
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: https://oportunidade.valdinascimento.com.br/votree/build/js/utils.js
Requested by: Host: oportunidade.valdinascimento.com.br
URL: https://oportunidade.valdinascimento.com.br/votree/build/js/intlTelInput.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 65.111.191.227 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: wordpress001.eb4us.com
Software: nginx /
Resource Hash: aeb6bc2ecd957d24b8bb08c9ebd6248835fbf6bbed3eeb1ac61d403eed193f56

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://oportunidade.valdinascimento.com.br/votree/payment.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 04:54:25 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 05:18:58 GMT
server: nginx
etag: W/"61d28742-3e07f"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Saudi Post (Government)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://oportunidade.valdinascimento.com.br/votree/files/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://oportunidade.valdinascimento.com.br/votree/files/mem8YaGs126MiZpBA-UFVZ0b.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://oportunidade.valdinascimento.com.br/votree/files/mem5YaGs126MiZpBA-UNirkOUuhp.woff2 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src * data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

oportunidade.valdinascimento.com.br
similargo.com
2a06:98c1:3120::7
65.111.191.227
0434701192cc2fbfad32f66624b56676a8f416d3d94b259fa1eb1aaa60f6ad39
0568a6fd61bcdb1567fd90ba79283a6415d2b24b3f3fbaa441d1c6063c89b296
0a012cf808a24573168308916092d2d4bd3f2b4af8e16b59167013cc77acee55
1027cddddbd69edd1f84013d8f86a9bafa415503b104e5e1fb003b70e5362e3b
16893732c1d56cff7778f74e569a833e345cc0f0fb0c3226380d7bcf414f51fe
186c8713eeaa90ab36660a4ae84f95e51aa3730dd3543c5ce18e776108a75b60
1a84a7da15921a85f7a8bd195b2eee6310715e1d9afa14bf75b2ce6fd7bfd52d
1bc2d5be2d753eaf2f6c0e91bdb24a95a9e20d19e1d76edcbf1a0bb13818643f
4f1bf1cc5ae0cd0c356965fd378e4e9c30268533949d65349c2d4315852627a0
5432b59decde382eae206cbe12dee7dd05ca9dcacb67f027a59b6a97a4379f07
60fc37f80886700e21b2f04c04bf880087a5a69d87a530e33d11e4eaea5ac67c
68b7e9302357f948488decd18e467a578a663902ec7b18773f680eca120e8cd9
750ac8d2bd2d0168a404a67733239d84262902c0dc2f231fff66182436a6e0c4
7b813b380d5e99d9d7ae94501469895cb3658f7b45d91ac6cfdfaa3665388112
7dfa84dd8fa2462daa17574d24be974c3076a4edea037648b6ec9b6c4bd2142e
ad32b1248207ba91fb945a37d38e7c9deafcba849245872203482db42930d491
aeb6bc2ecd957d24b8bb08c9ebd6248835fbf6bbed3eeb1ac61d403eed193f56
e3ac3b8c4a13f2f0ae8c1ae1ecffa93f7f3528c05d440141f83cfea940132d6d

oportunidade.valdinascimento.com.br Open in urlscan Pro 65.111.191.227 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

525 kBTransfer

946 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

0 Cookies

3 Console Messages

Security Headers

Indicators

oportunidade.valdinascimento.com.br Open in urlscan Pro
65.111.191.227 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

525 kB
Transfer

946 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!