www.formalav.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 31.11.33.239, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.formalav.com.
TLS certificate: Issued by Actalis Domain Validation Server CA G3 on March 3rd 2022. Valid for: a year.

This is the only time www.formalav.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banka Citadele (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1	31.11.33.239 31.11.33.239		31034 (ARUBA-ASN) (ARUBA-ASN)
5	2

1 31.11.33.239 (Arezzo, Italy)

ASN31034 (ARUBA-ASN, IT)
PTR: websn2s229.aruba.it

www.formalav.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	formalav.com www.formalav.com	475 KB
5	1

	Domain	Requested by
1	www.formalav.com
5	1

This site contains links to these domains. Also see Links.

Domain
online.citadele.lv
www.citadele.lv

Subject Issuer	Validity	Valid
*.formalav.com Actalis Domain Validation Server CA G3	`2022-03-03` - `2023-03-03`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.formalav.com/wp-content/ibbf/Citadele.internetbanka.php?lv_lv?s=&r=
Frame ID: 27FF62CF1E4BA5F202AAEC7A59DD9DDD
Requests: 6 HTTP requests in this frame

Frame: data://truncated
Frame ID: 97174240B96630C794A61197C22C0CBC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Citadele internetbanka

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

5
Requests

20 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

643 kB
Transfer

652 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citadele.lv/ibbf/ru_lv?loginType=codecard_calculator
Title: RU

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibbf/en_lv?loginType=codecard_calculator
Title: EN

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibbf/lv_lv

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibbf/lv_lv?loginType=codecard_calculator&f=1
Title: Aizmirsāt paroli?

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibhelp/login_lv_lv.htm
Title: Palīdzība

Search URL Search Domain Scan URL

URL: https://www.citadele.lv/lv/support/online-banking/
Title: Informācija par Internetbanku

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibhelp/security_lv_lv.htm
Title: Internetbankas droša lietošana

Search URL Search Domain Scan URL

URL: https://www.citadele.lv/lv/
Title: www.citadele.lv

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Citadele.internetbanka.php Show response www.formalav.com/wp-content/ibbf/	474 KB 475 KB	204ms 70ms	Document text/html	31.11.33.239 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.formalav.com/wp-content/ibbf/Citadele.internetbanka.php?lv_lv?s=&r= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.33.239 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn2s229.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `13fd62d756b9664625f44592ba89493b4fc7ef70a8249b947136e8b7f54c7b98` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers Content-Length 485734 Content-Type text/html; charset=UTF-8 Date Fri, 30 Sep 2022 14:35:43 GMT Server Microsoft-IIS/8.5 X-Aruba-Cache NA X-Aruba2-Cache NA X-Powered-By ASP.NET
GET DATA	200 OK	truncated /	38 KB 38 KB		Font application/x-font-otf
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f7a392ec9263fb7c4723cd2b3dd727ecb7abb08080d737fb51d5e2ba59a49e3d` Request headers Referer Origin https://www.formalav.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Content-Type application/x-font-otf
GET DATA	200 OK	truncated /	37 KB 37 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e8eea96e29a7c0a72612ab85ca3229979666467a28349642c2176e7189a1a39c` Request headers Referer Origin https://www.formalav.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	8 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f6ea8147a796c7dd400044088cd0f3f9802f2e59df4640ac47c90124468be062` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	39 KB 39 KB		Font application/x-font-otf
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d51609cb4e7b43c4383b62590a77afde105e6320a448d0473fb647531bd62582` Request headers Referer Origin https://www.formalav.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Content-Type application/x-font-otf
GET DATA	200 OK	truncated /	39 KB 39 KB		Font application/x-font-otf
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c3ccd8bd926647c99b4bb5436ed01b330f633d1464b50d189e4a5367751d6055` Request headers Referer Origin https://www.formalav.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Content-Type application/x-font-otf
GET DATA	200 OK	truncated / Frame 9717	81 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banka Citadele (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.formalav.com
31.11.33.239
044f2944f2667ddc30f531b61a4ab559e9321bb6610faa05137b729d7c21d758
0995f15d4323490ac0d3c7e4f530b3ba31a586dbd48717faaeaba78008a3052b
13fd62d756b9664625f44592ba89493b4fc7ef70a8249b947136e8b7f54c7b98
6dd66cb33d3bf9f2d42103513cb5c81d9ce4d56618c4d2ca87cc72584afcb5dd
7424f30af393e0d17ec8d2e61331b7afebb9b273f912d32043adbe91885b10c3
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
c3ccd8bd926647c99b4bb5436ed01b330f633d1464b50d189e4a5367751d6055
d51609cb4e7b43c4383b62590a77afde105e6320a448d0473fb647531bd62582
e8eea96e29a7c0a72612ab85ca3229979666467a28349642c2176e7189a1a39c
f6ea8147a796c7dd400044088cd0f3f9802f2e59df4640ac47c90124468be062
f7a392ec9263fb7c4723cd2b3dd727ecb7abb08080d737fb51d5e2ba59a49e3d

www.formalav.com Open in urlscan Pro 31.11.33.239 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

20 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

643 kBTransfer

652 kBSize

0 Cookies

8 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

www.formalav.com Open in urlscan Pro
31.11.33.239 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

643 kB
Transfer

652 kB
Size

0
Cookies

5 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!