![](/screenshots/16c4e762-471b-44e1-ac4d-e19ea72ccf17.png)
fattura-invoice.it.swtest.ru
Open in
urlscan Pro
77.222.62.71
Malicious Activity!
Public Scan
Effective URL: http://fattura-invoice.it.swtest.ru/confirm/areautenti/login.php
Submission: On February 27 via manual from IT — Scanned from IT
Summary
This is the only time fattura-invoice.it.swtest.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aruba (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 13.249.9.90 13.249.9.90 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 104.18.39.181 104.18.39.181 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 4 | 77.222.62.71 77.222.62.71 | 44112 (SWEB-AS) (SWEB-AS) | |
2 | 2 |
ASN16509 (AMAZON-02, US)
PTR: server-13-249-9-90.cdg53.r.cloudfront.net
eu-central-1.protection.sophos.com |
ASN44112 (SWEB-AS, RU)
PTR: vh306.sweb.ru
fattura-invoice.it.swtest.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
swtest.ru
2 redirects
fattura-invoice.it.swtest.ru |
117 KB |
1 |
myclickfunnels.com
1 redirects
vbnvnrtzyn.myclickfunnels.com |
1 KB |
1 |
sophos.com
1 redirects
eu-central-1.protection.sophos.com — Cisco Umbrella Rank: 561378 |
446 B |
2 | 3 |
Domain | Requested by | |
---|---|---|
4 | fattura-invoice.it.swtest.ru |
2 redirects
srcdoc
|
1 | vbnvnrtzyn.myclickfunnels.com | 1 redirects |
1 | eu-central-1.protection.sophos.com | 1 redirects |
2 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
hosting.aruba.it |
Subject Issuer | Validity | Valid |
---|
This page contains 3 frames:
Primary Page:
http://fattura-invoice.it.swtest.ru/confirm/areautenti/login.php
Frame ID: 95C33D1C9B378939CAF06B3D7EABD267
Requests: 12 HTTP requests in this frame
Frame:
http://fattura-invoice.it.swtest.ru/confirm/areautenti/404.php?msg=w.usabilla.com/7fe6a6518d1e.js?lv=1
Frame ID: D3CBAA2420ED89BF554823269239E901
Requests: 1 HTTP requests in this frame
Frame:
data://truncated
Frame ID: A37D293CD7CC332116460A95419C154B
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/16c4e762-471b-44e1-ac4d-e19ea72ccf17.png)
Page Title
Servizio Hosting - Aruba.itPage URL History Show full URLs
-
https://eu-central-1.protection.sophos.com/?d=myclickfunnels.com&u=aHR0cHM6Ly92Ym52bnJ0enluLm15Y2xpY2tmdW5uZWxzLmNvbS9i...
HTTP 302
https://vbnvnrtzyn.myclickfunnels.com/bvbnv565ere56465 HTTP 302
http://fattura-invoice.it.swtest.ru/confirm/ HTTP 302
http://fattura-invoice.it.swtest.ru/confirm/areautenti/ HTTP 302
http://fattura-invoice.it.swtest.ru/confirm/areautenti/login.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Ahoy (Analytics) Expand
Detected patterns
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: home
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://eu-central-1.protection.sophos.com/?d=myclickfunnels.com&u=aHR0cHM6Ly92Ym52bnJ0enluLm15Y2xpY2tmdW5uZWxzLmNvbS9idmJudjU2NWVyZTU2NDY1&i=NjUwODE2NjY4NGY2Y2E0YWI0MmEzN2Iw&t=empHL3Zyb2RYdUdDNnQwVFphbFlhZHZKajg4d04wRnB6NmF0WExQK01sWT0=&h=436152c7575a4bd889046325e8c6c148&s=AVNPUEhUT0NFTkNSWVBUSVaTzwae0a7vvhL33d8_5MD7YJcf5_ouOooyhcwsKSpjfA
HTTP 302
https://vbnvnrtzyn.myclickfunnels.com/bvbnv565ere56465 HTTP 302
http://fattura-invoice.it.swtest.ru/confirm/ HTTP 302
http://fattura-invoice.it.swtest.ru/confirm/areautenti/ HTTP 302
http://fattura-invoice.it.swtest.ru/confirm/areautenti/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
fattura-invoice.it.swtest.ru/confirm/areautenti/ Redirect Chain
|
344 KB 117 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
219 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
822 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
45 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
846 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
404.php
fattura-invoice.it.swtest.ru/confirm/areautenti/ Frame D3CB |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame A37D |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aruba (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 34 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
vbnvnrtzyn.myclickfunnels.com/ | Name: ahoy_visitor Value: aff56248-a3c3-42b2-82b7-f03067ce2958 |
|
vbnvnrtzyn.myclickfunnels.com/ | Name: ahoy_visit Value: dd14b282-2ffa-4e37-877d-10b3d9acc827 |
|
.myclickfunnels.com/ | Name: _cf_session Value: EwNATJ1z7jY1cuKaTvAW7nNBkEJmYpnrlbPx78iPG2SGUonJsLD5QwXYk5iiX8zvkvKgoydwLwKCvT02R8C%2F%2FW2cNIFDCqkbpbdPwijdty5HeD41IIeWewOasKKZ87BKfEftOHDuuFxbycOrHTOrhVbRDc3rVPfxWW603FXx5XiMInd1zWLfGeS8Vc1vZxNNm7SapyaQAmekk1yxIvBU8yh3ria4YIuu5ecwGHSzAOV3mRjoxfqsm2vm8BsgmoMDS5gsMEWofxu4%2B3Th8jFZUQr8Dckid5UGSFbyT8Lh0cXL2JxnyzmT%2B8VRlPGMnjywZ5ZW7%2BE82eSqSIjXOzjNGBQGW1oifVmRfjJIkOVChRuks%2Fi5SbfBcBTS4vP3HrOMaVklhUy1kQ4hc7Cwwfmx9WES3RAbHQoabUrgrljmFghGRxep33x4E1qxmQ%3D%3D--rNuHFZrLBylk7MDt--%2FdjDtSWLWG8P%2FsZj9iSU6A%3D%3D |
|
.myclickfunnels.com/ | Name: __cf_bm Value: kBzpHcu1LqVl7C.5wIuiafMmHxfBOblrJtuuPHNfDp4-1709040149-1.0-ASh5x76AlhuN4AkzLpf5b0m//Tp9HiYscxmjLAAJsRhad6ILMXL6taqNGc6Wbt0Gk1ZSw+hWNLswOaUwULVRXmU= |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
eu-central-1.protection.sophos.com
fattura-invoice.it.swtest.ru
vbnvnrtzyn.myclickfunnels.com
104.18.39.181
13.249.9.90
77.222.62.71
27a9a24907f8907c98afcf081684fe8fe95f3381ef49ff0d56c9e8e1eb525b6f
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99
6676b05ef9626756989d9dbc09608830af666a330ad1bfa12438b9775330c474
6c46bf722fb11c3066171661ece073b58b6ea6c16b00a9d3cc162a6f215b57f1
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61
b7fd66e7218e3267d3968a3648c882f33ea39d19d94fc64541efe76fd6385e3d
bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
ca3f0b017d700269a09037d0188d0616c107119a612f899f5356252e7952cf90
d5864d5ddff471eb051069bf32bbf80f0bfa0cc842e2c24f563d9822109de55f
d9ad9ccafbc7696d83a75b36483dc07f3a1465c7d4443047f7d2803045435dcd