www.qoobo.it Open in urlscan Pro
104.21.20.182 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.qoobo.it/wp-content/ewww/se/
Submission: On February 19 via api (February 19th 2024, 7:30:33 am UTC) from EE — Scanned from CH

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 7 domains to perform 16 HTTP transactions. The main IP is 104.21.20.182, located in and belongs to CLOUDFLARENET, US. The main domain is www.qoobo.it.
TLS certificate: Issued by GTS CA 1P5 on January 9th 2024. Valid for: 3 months.

This is the only time www.qoobo.it was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swiss Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
9	104.21.20.182 104.21.20.182	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.250.181.234 142.250.181.234	15169 (GOOGLE) (GOOGLE)
1	104.18.11.207 104.18.11.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.92.160.192 52.92.160.192	16509 (AMAZON-02) (AMAZON-02)
16	5

9 104.21.20.182 (None, )

ASN13335 (CLOUDFLARENET, US)

www.qoobo.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.234 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.11.207 (None, )

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.92.160.192 (Boardman, United States)

ASN16509 (AMAZON-02, US)

s3-us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	qoobo.it www.qoobo.it	50 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 48	1 KB
1	amazonaws.com s3-us-west-2.amazonaws.com	6 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3222	25 KB
0	etorostatic.com Failed etoro-cdn.etorostatic.com Failed
0	gstatic.com Failed fonts.gstatic.com Failed
0	cloudflare.com Failed cdnjs.cloudflare.com Failed
16	7

	Domain	Requested by
9	www.qoobo.it	www.qoobo.it
2	fonts.googleapis.com	www.qoobo.it
1	s3-us-west-2.amazonaws.com	www.qoobo.it
1	stackpath.bootstrapcdn.com	www.qoobo.it
0	etoro-cdn.etorostatic.com Failed	www.qoobo.it
0	fonts.gstatic.com Failed	fonts.googleapis.com
0	cdnjs.cloudflare.com Failed	www.qoobo.it
16	7

This site contains no links.

Subject Issuer	Validity	Valid
qoobo.it GTS CA 1P5	`2024-01-09` - `2024-04-08`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-29` - `2024-04-22`	3 months	crt.sh
bootstrapcdn.com GTS CA 1P5	`2024-01-28` - `2024-04-27`	3 months	crt.sh
*.s3-us-west-2.amazonaws.com Amazon RSA 2048 M01	`2024-01-23` - `2024-12-31`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.qoobo.it/wp-content/ewww/se/
Frame ID: 2BA1C309D37B2D26D06D3D59C6832242
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Swiss Post

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

16
Requests

81 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

5
IPs

2
Countries

83 kB
Transfer

264 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.qoobo.it/wp-content/ewww/se/ 4 KB
2 KB 2209ms
196ms Document
text/html 104.21.20.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: e3ad63fa7034173bd38e8f9de3159a8787e10dc2faaf4c45556e080fa175e195

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 857ccd5c689c5a25-MXP
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 19 Feb 2024 07:30:02 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dCh2ElPA5lwVqflwhiSprGn%2FhLk2IBeD4d8IQ6NvQLYqvxZ%2BlK70yy5NTaWUBTsFYznmGxnr6%2FKTSiN7DqtJ4WXUx1ttXFBNoa6Zs9ALLhXL4L%2Fi3KDcHuZEM%2FOCfrw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-aruba-cache: NA
x-aruba2-cache: NA
x-powered-by: ASP.NET

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
808 B 566ms
98ms Stylesheet
text/css 142.250.181.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Varela+Round&display=swap

Requested by

Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f10.1e100.net

Software

ESF /

Resource Hash

5397809adb99bdd5f4bd3dbfaadb6749e1d356fc9526890c005f36ac212d0761

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
date: Mon, 19 Feb 2024 07:30:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Mon, 19 Feb 2024 07:30:02 GMT

GET
H2 200 all.min.css
www.qoobo.it/wp-content/ewww/se/css/ 58 KB
13 KB 80ms
78ms Stylesheet
text/css 104.21.20.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.qoobo.it/wp-content/ewww/se/css/all.min.css
Requested by: Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/wp-content/ewww/se/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Feb 2024 07:30:02 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2454
x-powered-by: ASP.NET
x-aruba-cache: NA
alt-svc: h3=":443"; ma=86400
last-modified: Sat, 17 Feb 2024 18:35:24 GMT
server: cloudflare
etag: W/"0fec311d061da1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oJxksGaEt42olcmOPsQh%2BlZsb54SeWqJgAHwmgmDW80%2BVxSxT85ZPchR%2FmitXDpnBXWIVtIuYN%2F3Z1w2vn%2F4r2KHJufwzfjk1FqVUPq2WuOljNpYDVbEkUH3j0%2BQFzM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
x-aruba2-cache: NA
cf-ray: 857ccd5dba245a25-MXP

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 157 KB
25 KB 563ms
124ms Stylesheet
text/css 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css

Requested by

Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Feb 2024 07:30:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 601
age: 7177018
cdn-cachedat: 08/03/2021 15:44:07
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:11 GMT
cdn-proxyver: 1.0
cdn-requestpullcode: 200
server: cloudflare
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 72292ca7a393da9d388c402f68f6a70c
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 857ccd608bf50221-ZRH
cdn-requestpullsuccess: True

GET
H2 200 style.css
www.qoobo.it/wp-content/ewww/se/css/ 6 KB
2 KB 57ms
56ms Stylesheet
text/css 104.21.20.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.qoobo.it/wp-content/ewww/se/css/style.css
Requested by: Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: cfaaaf453532e7ad6fbbfe5860bbfa41d6f310f256743360aebf86091f54efcd

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/wp-content/ewww/se/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Feb 2024 07:30:02 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2454
cf-polished: origSize=9454
x-aruba-cache: NA
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Sat, 17 Feb 2024 18:35:24 GMT
server: cloudflare
etag: W/"0fec311d061da1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jg9U7IdZV0lF%2F1p61Gwf8%2BHVlwGDYgUPfLftpzmCzLN0TU39DdSJM5NMkj2YCJG6a6aPvr7SCABDn7yVhXzCKuKvJTUGO0dalF%2BbkZ7LIpkyc6AmCa%2BZ0Z5VILH7hSg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
x-aruba2-cache: NA
cf-ray: 857ccd5dba265a25-MXP

GET
H/1.1 200
OK masking-input.js Show response
s3-us-west-2.amazonaws.com/s.cdpn.io/3/ 6 KB
6 KB 1002ms
434ms Script
text/javascript 52.92.160.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-us-west-2.amazonaws.com/s.cdpn.io/3/masking-input.js
Requested by: Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.92.160.192 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5eb35f04e9f27358da6d4d10c8cab27641286f9d01268388afbde24175a26d8b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Mon, 19 Feb 2024 07:30:04 GMT
x-amz-version-id: null
Last-Modified: Wed, 30 Nov 2016 13:54:12 GMT
Server: AmazonS3
x-amz-request-id: K9M1MBK5895ZB1XS
ETag: "34caa9c1db33dea7751ad862bd5755e2"
Content-Type: text/javascript
Cache-Control: public
Accept-Ranges: bytes
Content-Length: 5939
x-amz-id-2: dw53zaEGQaZuYR/0YqWRZFEnzebOZIHYU/sHEmZezlLDRERxdeau+CF2hg9oDekLlmN6cmX4yJw=
Expires: Mon, 30 Nov 2026 13:54:10 GMT

GET
H2 200 swiis-logo.png
www.qoobo.it/wp-content/ewww/se/img/ 5 KB
5 KB 60ms
59ms Image
image/png 104.21.20.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.qoobo.it/wp-content/ewww/se/img/swiis-logo.png
Requested by: Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 490ed4cd487facdb15cde073a96adbb1abf8912ddbfa22fd04a22c70a3326560

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/wp-content/ewww/se/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Feb 2024 07:30:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2454
x-aruba-cache: NA
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 4845
last-modified: Sat, 17 Feb 2024 18:35:24 GMT
server: cloudflare
etag: "7a99612d061da1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IA1DKa55ZRRE49NuLb8tpeIEkhhApCM%2Fdoo9p38zt9uv2Wm4ghYtJrWwi6tYLT1MPSkYiqdIcwaEjH9Xfc7afq97EYLYn9Ik6AMSC92cyu9mtpmBhCwuwBPruM1fvO4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
x-aruba2-cache: NA
accept-ranges: bytes
cf-ray: 857ccd5dba295a25-MXP

GET
H2 200 789655.png
www.qoobo.it/wp-content/ewww/se/img/ 24 KB
24 KB 63ms
63ms Image
image/png 104.21.20.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.qoobo.it/wp-content/ewww/se/img/789655.png
Requested by: Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: a6d98908dc979e12f29673659f3e4462a4fd97c00fa07acda6e126a03b81ad85

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/wp-content/ewww/se/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Feb 2024 07:30:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2454
x-aruba-cache: NA
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 24695
last-modified: Sat, 17 Feb 2024 18:35:24 GMT
server: cloudflare
etag: "834f412d061da1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MxfvC3dpJi0dTIyR1xj6H5UgJ0jjfcjhx9q9Dt3Ar%2BAnK4UUR8rqjbIqoDiRHXy3ECxBYWe1SmWcGwqd3Y4hYMIKEI7SrNiqU%2BxLPkmPjs1p6n5IrNZpB4IofOYDBaM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
x-aruba2-cache: NA
accept-ranges: bytes
cf-ray: 857ccd5dba2b5a25-MXP

GET
H2 200 1.png
www.qoobo.it/wp-content/ewww/se/img/ 597 B
887 B 86ms
85ms Image
image/png 104.21.20.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.qoobo.it/wp-content/ewww/se/img/1.png
Requested by: Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 255ac343be8acf31ca3debe1a89ecfeb7bf7949ca9bfcce726ec20db90d4ff71

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/wp-content/ewww/se/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Feb 2024 07:30:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2454
x-aruba-cache: NA
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 597
last-modified: Sat, 17 Feb 2024 18:35:24 GMT
server: cloudflare
etag: "ffef212d061da1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CWMTF9kLXnZIqmiX0EQVpYB8Vi%2BDtYTFxe9fkqa73xkQ4h8elJ9h3lA%2B4ofCm6F9fSboKlrFwRPtP52sM6imY2%2BseOdpXap%2BmwEj7duipn%2FcIpMtvQ5TMMo1eIc46nk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
x-aruba2-cache: NA
accept-ranges: bytes
cf-ray: 857ccd5e1a855a25-MXP

GET
H2 200 2.png
www.qoobo.it/wp-content/ewww/se/img/ 572 B
861 B 72ms
69ms Image
image/png 104.21.20.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.qoobo.it/wp-content/ewww/se/img/2.png
Requested by: Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 441985bca86f350bd89721c5219dbcee393f2d9b206930ba3997919a1f4d2e9c

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/wp-content/ewww/se/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Feb 2024 07:30:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2454
x-aruba-cache: NA
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 572
last-modified: Sat, 17 Feb 2024 18:35:24 GMT
server: cloudflare
etag: "163e312d061da1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UhJ%2FdO01bcf2MWmfj7OaBetCzTgDBhZTAc6JKFZ%2BQje5Y8Wm08znSxoEmptBndpHtFq4rl8E3ESyOd749rDWcMmqB%2BpsagtVB9StdxaMGuymWwQkyrXuilDMuWvmPOk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
x-aruba2-cache: NA
accept-ranges: bytes
cf-ray: 857ccd5e4ac65a25-MXP

GET
H2 200 3.png
www.qoobo.it/wp-content/ewww/se/img/ 564 B
878 B 85ms
84ms Image
image/png 104.21.20.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.qoobo.it/wp-content/ewww/se/img/3.png
Requested by: Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 1dd20181a733ac6bad0e65d39105cd1fe1bdd5cb9f68341a82d7a206310a1290

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/wp-content/ewww/se/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Feb 2024 07:30:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2453
x-aruba-cache: NA
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 564
last-modified: Sat, 17 Feb 2024 18:35:24 GMT
server: cloudflare
etag: "6a8c312d061da1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N26ipXJ1SNQXgby9qxXOPU3z3S8MpPmIlRgeSCSZDaZuF63XHIpmfi0QPL1yiZAPCLbUuWSViRwHeLQV72Wh5kICH65O3c98%2BNDhYbVtycCDo2L0wS1ZmUwdOrbpQ3g%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
x-aruba2-cache: NA
accept-ranges: bytes
cf-ray: 857ccd5eab485a25-MXP

GET
H2 200 4.png
www.qoobo.it/wp-content/ewww/se/img/ 657 B
1 KB 124ms
124ms Image
image/png 104.21.20.182
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.qoobo.it/wp-content/ewww/se/img/4.png
Requested by: Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.182 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: b07b4ba931d2ff580554dec6bcdad83977282139a2c2278df7b37eeb811c9ade

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/wp-content/ewww/se/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 19 Feb 2024 07:30:03 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2454
x-aruba-cache: NA
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 657
last-modified: Sat, 17 Feb 2024 18:35:24 GMT
server: cloudflare
etag: "e5da312d061da1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=exJ23aO%2FUfrY7KN5Un2OKXsg2putDNRzjAaKv6rPrciz3FyJf5yETACRdFZZXVdsnW6IuuguDrYp6qolOhosZ0lMAUAIZehcYL3FSlFsY3JRIhvh9rTwGhFYlsGxZ18%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
x-aruba2-cache: NA
accept-ranges: bytes
cf-ray: 857ccd64292a5a25-MXP

GET cleave.min.js
cdnjs.cloudflare.com/ajax/libs/cleave.js/1.6.0/ 0
0

GET
H2 200 css
fonts.googleapis.com/ 1 KB
517 B 503ms
100ms Stylesheet
text/css 142.250.181.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins&play=swap

Requested by

Host: www.qoobo.it
URL: https://www.qoobo.it/wp-content/ewww/se/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f10.1e100.net

Software

ESF /

Resource Hash

aeaef97bf18d2484c113638fd359453729988db56c23f6f90370ce07542f8c8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.qoobo.it/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
date: Mon, 19 Feb 2024 07:30:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Mon, 19 Feb 2024 07:30:03 GMT

GET pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2
fonts.gstatic.com/s/poppins/v20/ 0
0

GET sprite-payment.png
etoro-cdn.etorostatic.com/web-client/img/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/cleave.js/1.6.0/cleave.min.js

Domain: fonts.gstatic.com
URL: https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2

Domain: etoro-cdn.etorostatic.com
URL: https://etoro-cdn.etorostatic.com/web-client/img/sprite-payment.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swiss Post (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.qoobo.it/	1969-12-31 23:59:59	Name: PHPSESSID Value: 694pm9setnmaggpuc2qoakj571

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cdnjs.cloudflare.com/ajax/libs/cleave.js/1.6.0/cleave.min.js Message: Failed to load resource: net::ERR_CONNECTION_CLOSED
network	error	URL: https://etoro-cdn.etorostatic.com/web-client/img/sprite-payment.png Message: Failed to load resource: net::ERR_CONNECTION_CLOSED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
etoro-cdn.etorostatic.com
fonts.googleapis.com
fonts.gstatic.com
s3-us-west-2.amazonaws.com
stackpath.bootstrapcdn.com
www.qoobo.it
cdnjs.cloudflare.com
etoro-cdn.etorostatic.com
fonts.gstatic.com
104.18.11.207
104.21.20.182
142.250.181.234
52.92.160.192
1dd20181a733ac6bad0e65d39105cd1fe1bdd5cb9f68341a82d7a206310a1290
255ac343be8acf31ca3debe1a89ecfeb7bf7949ca9bfcce726ec20db90d4ff71
441985bca86f350bd89721c5219dbcee393f2d9b206930ba3997919a1f4d2e9c
490ed4cd487facdb15cde073a96adbb1abf8912ddbfa22fd04a22c70a3326560
5397809adb99bdd5f4bd3dbfaadb6749e1d356fc9526890c005f36ac212d0761
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
5eb35f04e9f27358da6d4d10c8cab27641286f9d01268388afbde24175a26d8b
a6d98908dc979e12f29673659f3e4462a4fd97c00fa07acda6e126a03b81ad85
aeaef97bf18d2484c113638fd359453729988db56c23f6f90370ce07542f8c8f
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
b07b4ba931d2ff580554dec6bcdad83977282139a2c2278df7b37eeb811c9ade
cfaaaf453532e7ad6fbbfe5860bbfa41d6f310f256743360aebf86091f54efcd
e3ad63fa7034173bd38e8f9de3159a8787e10dc2faaf4c45556e080fa175e195

www.qoobo.it Open in urlscan Pro 104.21.20.182 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

81 %HTTPS

0 %IPv6

7 Domains

7 Subdomains

5 IPs

2 Countries

83 kBTransfer

264 kBSize

1 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

www.qoobo.it Open in urlscan Pro
104.21.20.182 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

81 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

5
IPs

2
Countries

83 kB
Transfer

264 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!