intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com Open in urlscan Pro
45.143.138.58 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Submission: On July 09 via automatic, source openphish (July 9th 2020, 1:41:55 am UTC)

Summary HTTP 10 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 45.143.138.58, located in Russian Federation and belongs to GARANT-PARK-INTERNET, RU. The main domain is intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 8th 2020. Valid for: 3 months.

This is the only time intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Intesa Sanpaolo (Banking)

Domain & IP information

	IP Address		AS Autonomous System
8	45.143.138.58 45.143.138.58		47196 (GARANT-PA...) (GARANT-PARK-INTERNET)
2	2606:4700::68... 2606:4700::6810:84e5		13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2

8 45.143.138.58 (Russian Federation)

ASN47196 (GARANT-PARK-INTERNET, RU)

intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:84e5 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	lovelycook.com intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com	68 KB
2	cloudflare.com cdnjs.cloudflare.com	30 KB
10	2

	Domain	Requested by
8	intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com	intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
2	cdnjs.cloudflare.com	intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
10	2

This site contains no links.

Subject Issuer	Validity	Valid
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com Let's Encrypt Authority X3	`2020-07-08` - `2020-10-06`	3 months	crt.sh
cloudflare.com Cloudflare Inc ECC CA-3	`2020-07-04` - `2021-07-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Frame ID: 6B040CCB0435A9D98FD56B009FA10DF3
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

98 kB
Transfer

151 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request okeylogin1.html Show response
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/ 5 KB
6 KB 335ms
82ms Document
text/html 45.143.138.58
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.58 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: e3bd0981a8c5e702acbd9d3ca74bd9cf11e658d14c4ff7ae57e7d10bea49b464

Request headers

Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 01:41:34 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
Last-Modified: Wed, 08 Jul 2020 16:50:13 GMT
ETag: "1554-5a9f0e6d3b71f"
Accept-Ranges: bytes
Content-Length: 5460
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK bootstrap.min.css
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/css/ 41 KB
41 KB 83ms
81ms Stylesheet
text/css 45.143.138.58
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/css/bootstrap.min.css
Requested by: Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.58 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: 25927cf69b719c814ca5bb9fc7d72666803004ad29698968c3e3cc6f91404f78

Request headers

Referer: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 01:41:34 GMT
Last-Modified: Wed, 08 Jul 2020 16:50:13 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
ETag: "a3df-5a9f0e6d374b7"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 41951

GET
H/1.1 200
OK minos.css
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/css/ 5 KB
5 KB 240ms
81ms Stylesheet
text/css 45.143.138.58
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/css/minos.css
Requested by: Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.58 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: 1a0efbf178cf13708f9d234038ef4ab30da9d278f7845e804131db3dfa95710e

Request headers

Referer: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 01:41:34 GMT
Last-Modified: Wed, 08 Jul 2020 16:50:13 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
ETag: "1257-5a9f0e6d3883f"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 4695

GET
H/1.1 404
Not Found verified-by-visa-trans.png
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/acs/static/images/ 242 B
242 B 252ms
83ms Image
text/html 45.143.138.58
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/acs/static/images/verified-by-visa-trans.png
Requested by: Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.58 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: eb0c3637c14a8d73a45739ecb6d1b2c2345fa9080e7680d531edf19c66636519

Request headers

Referer: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 01:41:34 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 242
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK logo_intesaSpaolo.png
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/images/ 14 KB
14 KB 251ms
81ms Image
image/png 45.143.138.58
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/images/logo_intesaSpaolo.png
Requested by: Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.58 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: a12f2be1f12f31eb7af1f7138d491e0aa49c7a62f9dc212ffe032bb7172b4549

Request headers

Referer: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 01:41:34 GMT
Last-Modified: Wed, 08 Jul 2020 16:50:13 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
ETag: "3654-5a9f0e6d39faf"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 13908

GET
H/1.1 200
OK o-key.png
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/images/ 1 KB
2 KB 100ms
83ms Image
image/png 45.143.138.58
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/images/o-key.png
Requested by: Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.58 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: 9f9c7170aaaea923ab039b77747ca1da9ce93fa7cb64e63f5e4aaecf688af129

Request headers

Referer: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 01:41:34 GMT
Last-Modified: Wed, 08 Jul 2020 16:50:13 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
ETag: "517-5a9f0e6d3a397"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1303

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/ 84 KB
29 KB 42ms
14ms Script
application/javascript 2606:4700::6810:84e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 09 Jul 2020 01:41:34 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 4764624
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 03d2d547ab000005e965b7c200000001
served-in-seconds: 0.004
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:20:15 GMT
server: cloudflare
etag: W/"5afd494f-14e4a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5afe57ec484e05e9-FRA
expires: Tue, 29 Jun 2021 01:41:34 GMT

GET
H2 200 jquery.cookie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/ 1 KB
1 KB 39ms
11ms Script
application/javascript 2606:4700::6810:84e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js

Requested by

Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 09 Jul 2020 01:41:34 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 13195418
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 03d2d547ac000005e965b7d200000001
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:20:12 GMT
server: cloudflare
etag: W/"5afd494c-514"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5afe57ec485005e9-FRA
expires: Tue, 29 Jun 2021 01:41:34 GMT

GET
H/1.1 404
Not Found bootstrap.min.js
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/acs/static/js/ 0
0 246ms
82ms Script
text/html 45.143.138.58
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/acs/static/js/bootstrap.min.js
Requested by: Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.58 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash

Request headers

Referer: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 01:41:34 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 228
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found minos.js
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/acs/static/js/ 0
0 248ms
80ms Script
text/html 45.143.138.58
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/acs/static/js/minos.js?ver=1.1
Requested by: Host: intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
URL: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.58 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash

Request headers

Referer: https://intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com/860966ec1942ae518ab057c1feaa7895/okeylogin1.html?securessl=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 01:41:34 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 220
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Intesa Sanpaolo (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| ready function| inIframe function| accessLogIfImInsideAnIframe

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
intesasanpaoalo.com.it.accedi.tuo.conto.online.lovelycook.com
2606:4700::6810:84e5
45.143.138.58
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1a0efbf178cf13708f9d234038ef4ab30da9d278f7845e804131db3dfa95710e
25927cf69b719c814ca5bb9fc7d72666803004ad29698968c3e3cc6f91404f78
9f9c7170aaaea923ab039b77747ca1da9ce93fa7cb64e63f5e4aaecf688af129
a12f2be1f12f31eb7af1f7138d491e0aa49c7a62f9dc212ffe032bb7172b4549
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
e3bd0981a8c5e702acbd9d3ca74bd9cf11e658d14c4ff7ae57e7d10bea49b464
eb0c3637c14a8d73a45739ecb6d1b2c2345fa9080e7680d531edf19c66636519