www.qoobo.it
Open in
urlscan Pro
104.21.20.182
Malicious Activity!
Public Scan
Effective URL: https://www.qoobo.it/wp-content/ewww/lazy/
Submission: On February 18 via automatic, source openphish — Scanned from SG
Summary
TLS certificate: Issued by GTS CA 1P5 on January 9th 2024. Valid for: 3 months.
This is the only time www.qoobo.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Schweizerische Bundesbahnen (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 45.32.126.160 45.32.126.160 | () () | |
1 | 104.21.20.182 104.21.20.182 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
qoobo.it
www.qoobo.it |
4 MB |
1 |
tmd.cloud
1 redirects
sg22.tmd.cloud |
298 B |
2 | 2 |
Domain | Requested by | |
---|---|---|
1 | www.qoobo.it | |
1 | sg22.tmd.cloud | 1 redirects |
2 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.sbb.ch |
login.swisspass.ch |
www.swisspass.ch |
www.onetrust.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
qoobo.it GTS CA 1P5 |
2024-01-09 - 2024-04-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.qoobo.it/wp-content/ewww/lazy/
Frame ID: 6FD2CB5E591C74D78BFEC0C29C3BEDDD
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
Back ButtonFilter ButtonPage URL History Show full URLs
-
https://sg22.tmd.cloud/~leonpubl/ron/
HTTP 302
https://www.qoobo.it/wp-content/ewww/lazy/ Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Zurück zu SBB.ch
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Passwort vergessen?
Search URL Search Domain Scan URL
Title: Jetzt registrieren
Search URL Search Domain Scan URL
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://sg22.tmd.cloud/~leonpubl/ron/
HTTP 302
https://www.qoobo.it/wp-content/ewww/lazy/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.qoobo.it/wp-content/ewww/lazy/ Redirect Chain
|
6 MB 4 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
14 KB 14 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
14 KB 14 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
137 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
272 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 7 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Schweizerische Bundesbahnen (Transportation)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| savepage_ShadowLoader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
sg22.tmd.cloud
www.qoobo.it
104.21.20.182
45.32.126.160
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d
8c6a5dc163115fa86582734510a28061e3f7746033d5d5ddba3224bcdba1ffa8
966a89b8080879ba41c6b9f15c5efb58182c33a0d2d1e08748beb554b28b4997
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
d45fd2cc05090e4b504f361216b1032409ed3cdf9904f50ce56e8a6b0f3c006e
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
e42fe383c86ab1185425bf334a44f9a311dd06d8ccf9e409d05b45dbe0bc48c6
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5