![](/screenshots/447b2016-b92a-4793-bd27-cf8c92c26f13.png)
lhcp3357.festos.it
Open in
urlscan Pro
81.88.53.107
Malicious Activity!
Public Scan
Effective URL: https://lhcp3357.festos.it/lfu3sb0ZYCr2q94SnApxOLJwQ7etdzgyFRoUWi8j16TEvIaGPN/?67YGHUJOIK=78UYHUII23
Submission: On August 22 via manual from UA — Scanned from DE
Summary
TLS certificate: Issued by R3 on August 21st 2023. Valid for: 3 months.
This is the only time lhcp3357.festos.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 185.2.4.16 185.2.4.16 | 203461 (REGISTER_...) (REGISTER_UK-AS) | |
1 6 | 81.88.53.107 81.88.53.107 | 39729 (REGISTER-AS) (REGISTER-AS) | |
5 | 1 |
ASN203461 (REGISTER_UK-AS, IT)
PTR: lhcp1016.webapps.net
www.gsconsolemarcello.it |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
festos.it
1 redirects
lhcp3357.festos.it |
32 KB |
1 |
gsconsolemarcello.it
1 redirects
www.gsconsolemarcello.it |
258 B |
5 | 2 |
Domain | Requested by | |
---|---|---|
6 | lhcp3357.festos.it |
1 redirects
lhcp3357.festos.it
|
1 | www.gsconsolemarcello.it | 1 redirects |
5 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
lhcp3357.festos.it R3 |
2023-08-21 - 2023-11-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://lhcp3357.festos.it/lfu3sb0ZYCr2q94SnApxOLJwQ7etdzgyFRoUWi8j16TEvIaGPN/?67YGHUJOIK=78UYHUII23
Frame ID: 34A2DDD60A325CF6DB93011F36D53F3A
Requests: 5 HTTP requests in this frame
Screenshot
![](/screenshots/447b2016-b92a-4793-bd27-cf8c92c26f13.png)
Page Title
CaptchaPage URL History Show full URLs
-
https://www.gsconsolemarcello.it/b4674684548/29960067103/390571677253
HTTP 302
https://lhcp3357.festos.it/?67YGHUJOIK=78UYHUII23 HTTP 302
https://lhcp3357.festos.it/lfu3sb0ZYCr2q94SnApxOLJwQ7etdzgyFRoUWi8j16TEvIaGPN/?67YGHUJOIK=78UYHUII23 Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.gsconsolemarcello.it/b4674684548/29960067103/390571677253
HTTP 302
https://lhcp3357.festos.it/?67YGHUJOIK=78UYHUII23 HTTP 302
https://lhcp3357.festos.it/lfu3sb0ZYCr2q94SnApxOLJwQ7etdzgyFRoUWi8j16TEvIaGPN/?67YGHUJOIK=78UYHUII23 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
lhcp3357.festos.it/lfu3sb0ZYCr2q94SnApxOLJwQ7etdzgyFRoUWi8j16TEvIaGPN/ Redirect Chain
|
4 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.css
lhcp3357.festos.it/lfu3sb0ZYCr2q94SnApxOLJwQ7etdzgyFRoUWi8j16TEvIaGPN/loding_files/ |
149 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
go.svg
lhcp3357.festos.it/lfu3sb0ZYCr2q94SnApxOLJwQ7etdzgyFRoUWi8j16TEvIaGPN/loding_files/ |
2 KB 794 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Ajax.gif
lhcp3357.festos.it/lfu3sb0ZYCr2q94SnApxOLJwQ7etdzgyFRoUWi8j16TEvIaGPN/loding_files/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
lhcp3357.festos.it/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| refreshing_Captcha1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
lhcp3357.festos.it/ | Name: PHPSESSID Value: feqne9t583sv312n8gvellkl64 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
lhcp3357.festos.it
www.gsconsolemarcello.it
185.2.4.16
81.88.53.107
1ee0431e54996c58846b61adac621fed62433e8c4b50aa756947ceb27721b4d1
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
a29236eed54ff257f34dd88abfd5a2f14b9190d84802f6703152d6b4ea511ca9
aebc793d0064383ee6b1625bf3bb32532ec30a5c12bf9117066107d412119123
c6a3e06247ee31c23db0ed1b786038116146ae12045640ca258e41e03a00848a