![](/screenshots/47a85608-b804-49ad-a997-45eca52494ae.png)
norabots.net
Open in
urlscan Pro
184.154.61.171
Malicious Activity!
Public Scan
Submission: On December 10 via api from JP — Scanned from JP
Summary
This is the only time norabots.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banca Monte dei Paschi (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 184.154.61.171 184.154.61.171 | 32475 (SINGLEHOP...) (SINGLEHOP-LLC) | |
8 | 81.26.195.203 81.26.195.203 | 13018 (Banca Mon...) (Banca Monte Dei Paschi Di Siena) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 2a02:6ea0:d30... 2a02:6ea0:d300::11 | 60068 (CDN77 ^_^) (CDN77 ^_^) | |
1 | 18.194.131.224 18.194.131.224 | 16509 (AMAZON-02) (AMAZON-02) | |
5 | 2a02:6ea0:d30... 2a02:6ea0:d300::12 | 60068 (CDN77 ^_^) (CDN77 ^_^) | |
20 | 7 |
ASN32475 (SINGLEHOP-LLC, US)
PTR: srv05.jvexecutive.com
norabots.net |
ASN13018 (Banca Monte Dei Paschi Di Siena, IT)
PTR: digital.mps.it
digital.mps.it |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-131-224.eu-central-1.compute.amazonaws.com
bootstrap.smartsuppchat.com |
ASN60068 (CDN77 ^_^, GB)
widget-v2.smartsuppcdn.com | |
translations.smartsuppcdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
mps.it
digital.mps.it |
52 KB |
5 |
smartsuppcdn.com
widget-v2.smartsuppcdn.com — Cisco Umbrella Rank: 63226 translations.smartsuppcdn.com — Cisco Umbrella Rank: 67665 |
193 KB |
2 |
smartsuppchat.com
www.smartsuppchat.com — Cisco Umbrella Rank: 60073 bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 55558 |
6 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 687 |
33 KB |
1 |
norabots.net
norabots.net |
182 KB |
20 | 5 |
Domain | Requested by | |
---|---|---|
8 | digital.mps.it |
norabots.net
digital.mps.it |
4 | widget-v2.smartsuppcdn.com |
www.smartsuppchat.com
|
1 | translations.smartsuppcdn.com |
widget-v2.smartsuppcdn.com
|
1 | bootstrap.smartsuppchat.com |
www.smartsuppchat.com
|
1 | www.smartsuppchat.com |
norabots.net
|
1 | code.jquery.com |
norabots.net
|
1 | norabots.net | |
20 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
aziendaonline.mps.it |
ib.mps.it |
www.cartetitolari.mps.it |
www.carteaziende.mps.it |
www.mpshop.mps.it |
www.mps.it |
Subject Issuer | Validity | Valid | |
---|---|---|---|
digital.mps.it Sectigo RSA Extended Validation Secure Server CA |
2022-03-14 - 2023-04-14 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
*.smartsuppchat.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-12-01 - 2022-12-29 |
a year | crt.sh |
*.smartsuppcdn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1 |
2022-10-19 - 2023-11-19 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
http://norabots.net/
Frame ID: 577A345C7862BC6323C5E02C5B6D1235
Requests: 15 HTTP requests in this frame
Frame:
https://digital.mps.it/login.html
Frame ID: BCF12B72108E68A27C6581EB8B9EC283
Requests: 1 HTTP requests in this frame
Frame:
https://widget-v2.smartsuppcdn.com/static/js/runtime-main.ae11910a.js
Frame ID: 0C6B5F080225EA70629833682BA14992
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/47a85608-b804-49ad-a997-45eca52494ae.png)
Page Title
Banca MPSDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Title: PASKEY AZIENDAONLINE Corporate banking
Search URL Search Domain Scan URL
Title: PASKEY TESORERIA ONLINE E TRIBUNALI ONLINE Enti e istituzioni
Search URL Search Domain Scan URL
Title: PASKEY INTERNET BANKING Vecchia piattaforma
Search URL Search Domain Scan URL
Title: PORTALE CARTA MONTEPASCHI TITOLARI
Search URL Search Domain Scan URL
Title: PORTALE CARTA MONTEPASCHI AZIENDE
Search URL Search Domain Scan URL
Title: PORTALE ESERCENTI
Search URL Search Domain Scan URL
Title: SALDO CARTA PREPAGATA
Search URL Search Domain Scan URL
Title: DIFENDITI DALLE TRUFFE
Search URL Search Domain Scan URL
Title: HAI BISOGNO DI AIUTO?
Search URL Search Domain Scan URL
Title: Banca Monte dei Paschi di Siena S.p.A. GRUPPO IVA MPS - Partita IVA 01483500524
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
norabots.net/ |
181 KB 182 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
w.login.digitalBanking.min.css
digital.mps.it/cmn/assets/css/catalogo/ |
47 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-latest.min.js
code.jquery.com/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ext.js
digital.mps.it/cmn/assets/js/ |
25 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iconaSpeechAssistantred.png
digital.mps.it/libs/img/loginBI/ |
2 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.html
digital.mps.it/ Frame BCF1 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montedeipaschi_logo_hd.png
digital.mps.it/libs/img/ |
11 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
text-security-disc.woff2
digital.mps.it/cmn/font/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader.js
www.smartsuppchat.com/ |
19 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info%20tooltip_UI.svg
digital.mps.it/cmn/assets/icons/catalogo/ |
999 B 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico_carte.svg
digital.mps.it/libs/img/loginBI/ |
1 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico_informazioni.svg
digital.mps.it/libs/img/loginBI/ |
2 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
76c55fb536a8a3965c8cd8c28546bd2c38f6704f.json
bootstrap.smartsuppchat.com/widget/ |
1 KB 684 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset-manifest.json
widget-v2.smartsuppcdn.com/ |
2 KB 744 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runtime-main.ae11910a.js
widget-v2.smartsuppcdn.com/static/js/ Frame 0C6B |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.12acd1fb.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame 0C6B |
524 KB 159 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.9714ee62.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame 0C6B |
114 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
defaults
translations.smartsuppcdn.com/api/v1/widget/translations/lang/it/ Frame 0C6B |
5 KB 3 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
text-security-disc.woff
digital.mps.it/cmn/font/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
text-security-disc.ttf
digital.mps.it/cmn/font/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- digital.mps.it
- URL
- https://digital.mps.it/cmn/font/text-security-disc.woff2
- Domain
- digital.mps.it
- URL
- https://digital.mps.it/cmn/font/text-security-disc.woff
- Domain
- digital.mps.it
- URL
- https://digital.mps.it/cmn/font/text-security-disc.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banca Monte dei Paschi (Banking)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| oncontentvisibilityautostatechange function| $ function| jQuery function| encodeHTML function| unescapeHTML function| escapeHTML function| open_win object| pagespeed function| reloadCaptcha2Step function| open_infoMT object| userSelectionLast object| userSelectionFirst function| registerUsername function| registerPwd function| registerUser function| soloNumeri function| hideOverlay object| _smartsupp function| smartsupp object| userSelectionLinkPk boolean| SMARTSUPP_LOADED object| $smartsupp2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
norabots.net/ | Name: ssupp.vid Value: vivBtrBAtPNo |
|
norabots.net/ | Name: ssupp.visits Value: 1 |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bootstrap.smartsuppchat.com
code.jquery.com
digital.mps.it
norabots.net
translations.smartsuppcdn.com
widget-v2.smartsuppcdn.com
www.smartsuppchat.com
digital.mps.it
18.194.131.224
184.154.61.171
2001:4de0:ac18::1:a:3a
2a02:6ea0:d300::11
2a02:6ea0:d300::12
81.26.195.203
0723be3bac2e41d6d7aa267af24f45a7240d74ead82a130765f83fc6fbf19723
0a0c6433b58c72136375414d6f7a6a511932eeaac396f7c0991a2b953fa2eaaa
20ad16212d9d4a91ad441a655a1de20fc24d4424afe30dcd2ddbbc594742827f
43b9a121dc783cb2727bd154299d772301a0b833ba9eafb7e39a956fe62a36c7
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
55f4163462dfcbaf0e495b061bf37fd98614664a1472783a59df9451b428d182
60c6f305c2f53373ea45547505e65375033ff2dd6ae2b1d0cd6770d7dbbd9a96
7b487c27e8f58205e6365f7eb2201d9b33c0708ce8580abdce450e3be84e9fdb
9c9b26055379437522e81d6ad02ec43de51199f7ee3ad2fb8a7f6ab3a44efccf
aee03f32eaf0f0be700dc8dfa012de0c5d13e3ea2d774519360c4a9d59921a76
af1f612986de271c45f95cd021cec4739e8e9603d45a05b2acbc7349a1bcb761
b989e87444353500fa31829b5814b69d053f5e5553bfff4fcb26a38f76e0f08e
d46dda2fab1d8fe763cec3ef41291116c4df2667bdb89448b37fbc342249924a
db2c90435c2b444d41f028b2eeedb8db12baecb141d3bcfa2c8bcff3f7216faf
e77688df08643fef4aab09be7b9443860a30c01ba153ffbbdb9d6723b9137c84
fbada2455fee9aca709cc4d9fc879bca09ae9df11ea93a39b0b9783277f43c40