orientalactu.com Open in urlscan Pro
207.174.214.207  Malicious Activity! Public Scan

URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Submission: On October 31 via manual — Scanned from DE

Summary

This website contacted 10 IPs in 4 countries across 7 domains to perform 33 HTTP transactions. The main IP is 207.174.214.207, located in Burlington, United States and belongs to PUBLIC-DOMAIN-REGISTRY, US. The main domain is orientalactu.com.
This is the only time orientalactu.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca d'Italia (Banking)

Domain & IP information

IP Address AS Autonomous System
1 207.174.214.207 394695 (PUBLIC-DO...)
6 85.159.192.145 34759 (ASN-BANCA...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
2 158.69.139.230 16276 (OVH)
1 67.202.94.93 32748 (STEADFAST)
1 104.18.28.199 13335 (CLOUDFLAR...)
7 208.100.17.186 32748 (STEADFAST)
1 67.202.105.32 32748 (STEADFAST)
33 10
Domain Requested by
7 ic.tynt.com orientalactu.com
6 servizionline.bancaditalia.it orientalactu.com
servizionline.bancaditalia.it
2 t.dtscout.com waust.at
t.dtscout.com
1 de.tynt.com cdn.tynt.com
1 cdn.tynt.com waust.at
1 whos.amung.us waust.at
1 waust.at orientalactu.com
1 code.jquery.com orientalactu.com
1 orientalactu.com
33 9
Subject Issuer Validity Valid
servizionline.bancaditalia.it
Actalis Organization Validated Server CA G3
2021-09-20 -
2022-09-20
a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2021-07-14 -
2022-08-14
a year crt.sh
*.dtscout.com
Sectigo RSA Domain Validation Secure Server CA
2021-10-28 -
2022-11-27
a year crt.sh
*.tynt.com
Sectigo RSA Domain Validation Secure Server CA
2021-09-23 -
2022-09-30
a year crt.sh

This page contains 1 frames:

Primary Page: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Frame ID: 802650ABBBC7B2FCC1D353B669209EA9
Requests: 34 HTTP requests in this frame

Screenshot

Page Title

Banca D'Italia - Alert Sicurezza

Page Statistics

33
Requests

55 %
HTTPS

22 %
IPv6

7
Domains

9
Subdomains

10
IPs

4
Countries

659 kB
Transfer

761 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

33 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request accedi.html
orientalactu.com/portale.bancaitalia.nexi/
37 KB
8 KB
Document
General
Full URL
http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
HTTP/1.1
Server
207.174.214.207 Burlington, United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
Software
nginx/1.19.10 /
Resource Hash
d68c2e80c4ea20111acbc59aea49be2864dd19ffd3563fb390d31e65a76b5c2b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Sun, 31 Oct 2021 13:05:24 GMT
Server
nginx/1.19.10
Content-Type
text/html
Content-Length
8020
Last-Modified
Wed, 27 Oct 2021 13:13:40 GMT
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
X-Server-Cache
false
styles.f96b5068c64b3c8ce413.css
servizionline.bancaditalia.it/
233 KB
233 KB
Stylesheet
General
Full URL
https://servizionline.bancaditalia.it/styles.f96b5068c64b3c8ce413.css
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
85.159.192.145 , Italy, ASN34759 (ASN-BANCADITALIA, IT),
Reverse DNS
servizionline.bancaditalia.it
Software
/
Resource Hash
9561897c1d9d7f0489092e647704fd3f864ba937b20e22f0d18e0479ca97bc6d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options no-sniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 13:05:24 GMT
X-Content-Type-Options
no-sniff
Last-Modified
Tue, 06 Jul 2021 05:34:20 GMT
X-FRAME-OPTIONS
SAMEORIGIN
Content-Type
text/css
Connection
Keep-Alive
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=300
Content-Length
238274
X-XSS-Protection
1; mode=block
logoBI.png
servizionline.bancaditalia.it/assets/images/
9 KB
10 KB
Image
General
Full URL
https://servizionline.bancaditalia.it/assets/images/logoBI.png
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
85.159.192.145 , Italy, ASN34759 (ASN-BANCADITALIA, IT),
Reverse DNS
servizionline.bancaditalia.it
Software
/
Resource Hash
a6c8c3cc7887002a50911309fd6a949238707bdf7b7076756e64c0ea9bc064a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options no-sniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 13:05:24 GMT
X-Content-Type-Options
no-sniff
Last-Modified
Tue, 06 Jul 2021 05:34:20 GMT
X-FRAME-OPTIONS
SAMEORIGIN
Content-Type
image/png
Connection
Keep-Alive
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=300
Content-Length
9332
X-XSS-Protection
1; mode=block
01-logo-SO-colore.svg
servizionline.bancaditalia.it/assets/images/
4 KB
5 KB
Image
General
Full URL
https://servizionline.bancaditalia.it/assets/images/01-logo-SO-colore.svg
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
85.159.192.145 , Italy, ASN34759 (ASN-BANCADITALIA, IT),
Reverse DNS
servizionline.bancaditalia.it
Software
/
Resource Hash
cfab57b71c1fa68bc7a5f9c766053a2eeeee5a5f0bd89fc2712a43aa5931c6b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options no-sniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 13:05:24 GMT
X-Content-Type-Options
no-sniff
Last-Modified
Tue, 06 Jul 2021 05:34:20 GMT
X-FRAME-OPTIONS
SAMEORIGIN
Content-Type
image/svg+xml
Connection
Keep-Alive
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=300
Content-Length
4189
X-XSS-Protection
1; mode=block
icoMenu4b.png
servizionline.bancaditalia.it/assets/images/
7 KB
7 KB
Image
General
Full URL
https://servizionline.bancaditalia.it/assets/images/icoMenu4b.png
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
85.159.192.145 , Italy, ASN34759 (ASN-BANCADITALIA, IT),
Reverse DNS
servizionline.bancaditalia.it
Software
/
Resource Hash
df7eae06601cde3566aeb708e4baddeebf9f90c0e44a46e23d19d4ed88116141
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options no-sniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 13:05:24 GMT
X-Content-Type-Options
no-sniff
Last-Modified
Tue, 06 Jul 2021 05:34:20 GMT
X-FRAME-OPTIONS
SAMEORIGIN
Content-Type
image/png
Connection
Keep-Alive
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=300
Content-Length
6800
X-XSS-Protection
1; mode=block
numeroVerde.png
servizionline.bancaditalia.it/assets/images/
12 KB
13 KB
Image
General
Full URL
https://servizionline.bancaditalia.it/assets/images/numeroVerde.png
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
85.159.192.145 , Italy, ASN34759 (ASN-BANCADITALIA, IT),
Reverse DNS
servizionline.bancaditalia.it
Software
/
Resource Hash
88a168b5a9697328b8d90351186e71bb281827c39c24a68e2d9c5de727c187f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options no-sniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 13:05:24 GMT
X-Content-Type-Options
no-sniff
Last-Modified
Tue, 06 Jul 2021 05:34:20 GMT
X-FRAME-OPTIONS
SAMEORIGIN
Content-Type
image/png
Connection
Keep-Alive
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=300
Content-Length
12541
X-XSS-Protection
1; mode=block
jquery-latest.min.js
code.jquery.com/
94 KB
33 KB
Script
General
Full URL
https://code.jquery.com/jquery-latest.min.js
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:24 GMT
content-encoding
gzip
last-modified
Fri, 24 Oct 2014 00:16:08 GMT
server
nginx
etag
"54499a48-1762a"
vary
Accept-Encoding
x-hw
1635685524.dop227.fr8.t,1635685524.cds287.fr8.hn,1635685524.cds280.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
33202
d.js
waust.at/
13 KB
8 KB
Script
General
Full URL
http://waust.at/d.js
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
HTTP/1.1
Server
2606:4700:20::681a:507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8fb1850e00c24b83e04ea4f41fe5774cff1d476a293fa7b35cba97827eb194cd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 13:05:24 GMT
content-encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age
3287
Transfer-Encoding
chunked
Connection
keep-alive
last-modified
Mon, 03 May 2021 17:48:39 GMT
Server
cloudflare
etag
W/"60903777-3444"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ipRNrOeB1UqUXfYgsA7%2BywWqatMJ4qSxQKc%2BFsP9kHHndRS%2BopnUvhhhlHA%2BlgRztAkkDKGKCBtpeCCnoMXTVEErYDm91dAaV4jRFhmhYQTXDYX4InsBcFFv0ixOtDc4uR8mNm7o"}],"group":"cf-nel","max_age":604800}
Content-Type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400
CF-RAY
6a6d183f7f064401-FRA
expires
Mon, 01 Nov 2021 12:10:37 GMT
BG_01.7b875ce73c7491bfb260.jpg
servizionline.bancaditalia.it/
330 KB
331 KB
Image
General
Full URL
https://servizionline.bancaditalia.it/BG_01.7b875ce73c7491bfb260.jpg
Requested by
Host: servizionline.bancaditalia.it
URL: https://servizionline.bancaditalia.it/styles.f96b5068c64b3c8ce413.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
85.159.192.145 , Italy, ASN34759 (ASN-BANCADITALIA, IT),
Reverse DNS
servizionline.bancaditalia.it
Software
/
Resource Hash
ff7de9ce3627680f079794d02df36687edc8fe5eb48b56833ac52de1fb420a69
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options no-sniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://servizionline.bancaditalia.it/styles.f96b5068c64b3c8ce413.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 13:05:24 GMT
X-Content-Type-Options
no-sniff
Last-Modified
Tue, 06 Jul 2021 05:34:20 GMT
X-FRAME-OPTIONS
SAMEORIGIN
Content-Type
image/jpeg
Connection
Keep-Alive
Strict-Transport-Security
max-age=31536000; includeSubDomains
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=299
Content-Length
338367
X-XSS-Protection
1; mode=block
titillium-web-v4-latin-600.99d941431f3f55fd46ad.woff2
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-regular.b4375f78b37bdba3323f.woff2
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-700.7694e06a64d08c6d3564.woff2
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-300.6c3f043c89f623f06e37.woff2
servizionline.bancaditalia.it/
0
0

/
t.dtscout.com/i/
2 KB
3 KB
Script
General
Full URL
https://t.dtscout.com/i/?l=http%3A%2F%2Forientalactu.com%2Fportale.bancaitalia.nexi%2Faccedi.html&j=
Requested by
Host: waust.at
URL: http://waust.at/d.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.69.139.230 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
ip230.ip-158-69-139.net
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
867e8c0f65910529d214a22ff58f5ad38158e1c104cc1706c94d5f4d3780944c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 13:05:24 GMT
X-T
0.717
Server
nginx/1.14.0 (Ubuntu)
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
no-cache
Connection
close
X-S
mtl3
Expires
Sun, 31 Oct 2021 13:05:23 GMT
/
whos.amung.us/pingjs/
28 B
212 B
Script
General
Full URL
http://whos.amung.us/pingjs/?k=gjs5ie67b5&t=Banca%20D%27Italia%20-%20Alert%20Sicurezza&c=d&x=http%3A%2F%2Forientalactu.com%2Fportale.bancaitalia.nexi%2Faccedi.html&y=&a=0&v=27&r=1123
Requested by
Host: waust.at
URL: http://waust.at/d.js
Protocol
HTTP/1.1
Server
67.202.94.93 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
amung.us
Software
/
Resource Hash
1f3608423f690bf0b1ad4245d503e0479def2299deef408547f45290a2d227b0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:24 GMT
content-encoding
gzip
transfer-encoding
chunked
content-type
text/javascript;charset=UTF-8
titillium-web-v4-latin-600.b060eb46ce914bb63b25.woff
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-regular.18f37b8fccf3e295c232.woff
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-700.fdb183c419fdb62f5300.woff
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-300.0763f869c3cadee6d22d.woff
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-600.365c44da87cfb66a8ec0.ttf
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-regular.7e91f8ef73b5f3865005.ttf
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-700.f97db0decff4d838f37a.ttf
servizionline.bancaditalia.it/
0
0

titillium-web-v4-latin-300.833b63057599d1fdd3a3.ttf
servizionline.bancaditalia.it/
0
0

tc.js
cdn.tynt.com/
17 KB
7 KB
Script
General
Full URL
https://cdn.tynt.com/tc.js
Requested by
Host: waust.at
URL: http://waust.at/d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.28.199 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2347066080fea31af55c7112dca5245ea3eea67df5f24f1daae09f0870fbce62

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:24 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 27 Aug 2021 20:58:45 GMT
server
cloudflare
age
215151
etag
W/"61295205-431d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
6a6d18430cccc2c7-FRA
expires
Wed, 03 Nov 2021 13:05:24 GMT
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
p
ic.tynt.com/b/
0
227 B
Image
General
Full URL
https://ic.tynt.com/b/p?id=w!gjs5ie67b5&lm=0&ts=1635685524987&dn=TC&iso=0&t=Banca%20D%27Italia%20-%20Alert%20Sicurezza
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.186 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip186.208-100-17.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:25 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires
"Sat, 26 Jul 1997 05:00:00 GMT"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
/
t.dtscout.com/pv/
50 B
318 B
Script
General
Full URL
https://t.dtscout.com/pv/?_a=v&_h=orientalactu.com&_ss=8y9k6vdtfy&_pv=1&_ls=0&_u1=1&_u3=1&_cc=de&_pl=d&_cbid=5fw2&_cb=_dtspv.c
Requested by
Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=http%3A%2F%2Forientalactu.com%2Fportale.bancaitalia.nexi%2Faccedi.html&j=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.69.139.230 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
ip230.ip-158-69-139.net
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
f89c6756e44f5bc2e762a95b01f9fb0f84f45d263f1be1f0c51fa191e8e922ea

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 13:05:25 GMT
X-T
0.153
Server
nginx/1.14.0 (Ubuntu)
Transfer-Encoding
chunked
X-C
0
Content-Type
application/javascript
Cache-Control
no-cache
Connection
close
Expires
Sun, 31 Oct 2021 13:05:24 GMT
v2
de.tynt.com/deb/
4 B
202 B
Script
General
Full URL
https://de.tynt.com/deb/v2?id=w!gjs5ie67b5&dn=TC&cc=1&r=
Requested by
Host: cdn.tynt.com
URL: https://cdn.tynt.com/tc.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
/
Resource Hash
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:25 GMT
cache-control
max-age=86400
content-type
application/javascript
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
content-length
4
expires
Mon, 01 Nov 2021 13:05:25 GMT
p
ic.tynt.com/b/
0
227 B
Image
General
Full URL
https://ic.tynt.com/b/p?id=w!gjs5ie67b5&lm=0&ts=1635685524987&dn=TC&iso=0&t=Banca%20D%27Italia%20-%20Alert%20Sicurezza
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.186 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip186.208-100-17.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:25 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires
"Sat, 26 Jul 1997 05:00:00 GMT"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/
0
227 B
Image
General
Full URL
https://ic.tynt.com/b/p?id=w!gjs5ie67b5&lm=0&ts=1635685524987&dn=TC&iso=0&t=Banca%20D%27Italia%20-%20Alert%20Sicurezza
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.186 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip186.208-100-17.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:25 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires
"Sat, 26 Jul 1997 05:00:00 GMT"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/
0
227 B
Image
General
Full URL
https://ic.tynt.com/b/p?id=w!gjs5ie67b5&lm=0&ts=1635685524987&dn=TC&iso=0
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.186 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip186.208-100-17.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:25 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires
"Sat, 26 Jul 1997 05:00:00 GMT"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/
0
227 B
Image
General
Full URL
https://ic.tynt.com/b/p?id=w!gjs5ie67b5&lm=0&ts=1635685524987&dn=TC&iso=0
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.186 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip186.208-100-17.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:25 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires
"Sat, 26 Jul 1997 05:00:00 GMT"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/
0
227 B
Image
General
Full URL
https://ic.tynt.com/b/p?id=w!gjs5ie67b5&lm=0&ts=1635685524987&dn=TC&iso=0
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.186 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip186.208-100-17.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:25 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires
"Sat, 26 Jul 1997 05:00:00 GMT"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/
0
227 B
Image
General
Full URL
https://ic.tynt.com/b/p?id=w!gjs5ie67b5&lm=0&ts=1635685524987&dn=TC&iso=0
Requested by
Host: orientalactu.com
URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.186 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip186.208-100-17.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 13:05:25 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires
"Sat, 26 Jul 1997 05:00:00 GMT"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-600.99d941431f3f55fd46ad.woff2
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-regular.b4375f78b37bdba3323f.woff2
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-700.7694e06a64d08c6d3564.woff2
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-300.6c3f043c89f623f06e37.woff2
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-600.b060eb46ce914bb63b25.woff
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-regular.18f37b8fccf3e295c232.woff
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-700.fdb183c419fdb62f5300.woff
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-300.0763f869c3cadee6d22d.woff
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-600.365c44da87cfb66a8ec0.ttf
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-regular.7e91f8ef73b5f3865005.ttf
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-700.f97db0decff4d838f37a.ttf
Domain
servizionline.bancaditalia.it
URL
https://servizionline.bancaditalia.it/titillium-web-v4-latin-300.833b63057599d1fdd3a3.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca d'Italia (Banking)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery object| _wau string| wau_w_col string| wau_w_siz object| WAU_ren function| WAU_dynamic function| WAU_dynamic_request function| WAU_r_d function| WAU_insert function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x2 object| Tynt object| _33Across function| __uspapi object| _dtspv

4 Cookies

Domain/Path Name / Value
.dtscout.com/ Name: m
Value: 1
.dtscout.com/ Name: b
Value: 1
.dtscout.com/ Name: oa
Value: 1
.dtscout.com/ Name: df
Value: 1635685524

24 Console Messages

Source Level URL
Text
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-600.99d941431f3f55fd46ad.woff2' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-600.99d941431f3f55fd46ad.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-regular.b4375f78b37bdba3323f.woff2' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-regular.b4375f78b37bdba3323f.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-700.7694e06a64d08c6d3564.woff2' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-700.7694e06a64d08c6d3564.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-300.6c3f043c89f623f06e37.woff2' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-300.6c3f043c89f623f06e37.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-600.b060eb46ce914bb63b25.woff' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-600.b060eb46ce914bb63b25.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-regular.18f37b8fccf3e295c232.woff' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-regular.18f37b8fccf3e295c232.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-700.fdb183c419fdb62f5300.woff' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-700.fdb183c419fdb62f5300.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-300.0763f869c3cadee6d22d.woff' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-300.0763f869c3cadee6d22d.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-600.365c44da87cfb66a8ec0.ttf' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-600.365c44da87cfb66a8ec0.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-regular.7e91f8ef73b5f3865005.ttf' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-regular.7e91f8ef73b5f3865005.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-300.833b63057599d1fdd3a3.ttf' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-300.833b63057599d1fdd3a3.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://orientalactu.com/portale.bancaitalia.nexi/accedi.html
Message:
Access to font at 'https://servizionline.bancaditalia.it/titillium-web-v4-latin-700.f97db0decff4d838f37a.ttf' from origin 'http://orientalactu.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://servizionline.bancaditalia.it/titillium-web-v4-latin-700.f97db0decff4d838f37a.ttf
Message:
Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.tynt.com
code.jquery.com
de.tynt.com
ic.tynt.com
orientalactu.com
servizionline.bancaditalia.it
t.dtscout.com
waust.at
whos.amung.us
servizionline.bancaditalia.it
104.18.28.199
158.69.139.230
2001:4de0:ac18::1:a:1a
207.174.214.207
208.100.17.186
2606:4700:20::681a:507
67.202.105.32
67.202.94.93
85.159.192.145
1f3608423f690bf0b1ad4245d503e0479def2299deef408547f45290a2d227b0
2347066080fea31af55c7112dca5245ea3eea67df5f24f1daae09f0870fbce62
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d
867e8c0f65910529d214a22ff58f5ad38158e1c104cc1706c94d5f4d3780944c
88a168b5a9697328b8d90351186e71bb281827c39c24a68e2d9c5de727c187f3
8fb1850e00c24b83e04ea4f41fe5774cff1d476a293fa7b35cba97827eb194cd
9561897c1d9d7f0489092e647704fd3f864ba937b20e22f0d18e0479ca97bc6d
a6c8c3cc7887002a50911309fd6a949238707bdf7b7076756e64c0ea9bc064a8
cfab57b71c1fa68bc7a5f9c766053a2eeeee5a5f0bd89fc2712a43aa5931c6b0
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
d68c2e80c4ea20111acbc59aea49be2864dd19ffd3563fb390d31e65a76b5c2b
df7eae06601cde3566aeb708e4baddeebf9f90c0e44a46e23d19d4ed88116141
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f89c6756e44f5bc2e762a95b01f9fb0f84f45d263f1be1f0c51fa191e8e922ea
ff7de9ce3627680f079794d02df36687edc8fe5eb48b56833ac52de1fb420a69