www.rppartners.it Open in urlscan Pro
89.46.108.21  Malicious Activity! Public Scan

Submitted URL: https://www.ibs-freni.it/?email=myles.sheridan@iaggbs.com
Effective URL: https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&emai...
Submission: On June 26 via manual from IN

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 89.46.108.21, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.rppartners.it.
TLS certificate: Issued by Actalis Domain Validation Server CA G2 on April 12th 2019. Valid for: a year.
This is the only time www.rppartners.it was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 89.46.105.64 31034 (ARUBA-ASN)
1 7 89.46.108.21 31034 (ARUBA-ASN)
6 1
Apex Domain
Subdomains
Transfer
7 rppartners.it
www.rppartners.it
306 KB
1 ibs-freni.it
www.ibs-freni.it
162 B
6 2
Domain Requested by
7 www.rppartners.it 1 redirects www.rppartners.it
1 www.ibs-freni.it 1 redirects
6 2

This site contains no links.

Subject Issuer Validity Valid
*.rppartners.it
Actalis Domain Validation Server CA G2
2019-04-12 -
2020-07-12
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
Frame ID: 0A96A38AB68B010C727FABD11BCC5BCE
Requests: 6 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://www.ibs-freni.it/?email=myles.sheridan@iaggbs.com HTTP 302
    https://www.rppartners.it/00/Office/365/?email=myles.sheridan@iaggbs.com HTTP 302
    https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=5... Page URL

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

305 kB
Transfer

405 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.ibs-freni.it/?email=myles.sheridan@iaggbs.com HTTP 302
    https://www.rppartners.it/00/Office/365/?email=myles.sheridan@iaggbs.com HTTP 302
    https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Login.php
www.rppartners.it/00/Office/365/
Redirect Chain
  • https://www.ibs-freni.it/?email=myles.sheridan@iaggbs.com
  • https://www.rppartners.it/00/Office/365/?email=myles.sheridan@iaggbs.com
  • https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
23 KB
5 KB
Document
General
Full URL
https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
89.46.108.21 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1277.aruba.it
Software
aruba-proxy / PHP/5.5.38
Resource Hash
8670996263429cfc36f4ad5c6e930a164bdc8f20d54af58f936f539a3688c28d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.rppartners.it
:scheme
https
:path
/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
server
aruba-proxy
date
Wed, 26 Jun 2019 15:17:10 GMT
content-type
text/html
vary
Accept-Encoding
x-powered-by
PHP/5.5.38
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-servername
ipvsproxy140.ad.aruba.it
content-encoding
gzip

Redirect headers

status
302
server
aruba-proxy
date
Wed, 26 Jun 2019 15:17:10 GMT
content-type
text/html
location
Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
x-powered-by
PHP/5.5.38
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-servername
ipvsproxy140.ad.aruba.it
converged.css
www.rppartners.it/00/Office/365/images/
100 KB
19 KB
Stylesheet
General
Full URL
https://www.rppartners.it/00/Office/365/images/converged.css
Requested by
Host: www.rppartners.it
URL: https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
89.46.108.21 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1277.aruba.it
Software
aruba-proxy /
Resource Hash
d91ab164f7f64967f34c727db7715d1f65bef2c3f10b76b02c7b1a8ba9c2ddec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
Origin
https://www.rppartners.it

Response headers

x-servername
ipvsproxy140.ad.aruba.it
date
Wed, 26 Jun 2019 15:17:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 26 Jun 2019 14:43:53 GMT
server
aruba-proxy
etag
W/"18e2c-58c3b130957aa"
vary
Accept-Encoding
content-type
text/css
status
200
x-xss-protection
1; mode=block
37_533e293f0c8947ada653b47c00e394e2.png
www.rppartners.it/00/Office/365/images/
2 KB
2 KB
Image
General
Full URL
https://www.rppartners.it/00/Office/365/images/37_533e293f0c8947ada653b47c00e394e2.png
Requested by
Host: www.rppartners.it
URL: https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
89.46.108.21 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1277.aruba.it
Software
aruba-proxy /
Resource Hash
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy140.ad.aruba.it
date
Wed, 26 Jun 2019 15:17:10 GMT
x-content-type-options
nosniff
last-modified
Wed, 26 Jun 2019 14:43:53 GMT
server
aruba-proxy
etag
"6d6-58c3b130947d4"
content-type
image/png
status
200
accept-ranges
bytes
content-length
1750
x-xss-protection
1; mode=block
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
www.rppartners.it/00/Office/365/images/
4 KB
2 KB
Image
General
Full URL
https://www.rppartners.it/00/Office/365/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by
Host: www.rppartners.it
URL: https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
89.46.108.21 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1277.aruba.it
Software
aruba-proxy /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy140.ad.aruba.it
date
Wed, 26 Jun 2019 15:17:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 26 Jun 2019 14:43:53 GMT
server
aruba-proxy
etag
W/"e43-58c3b1309bd4c"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-xss-protection
1; mode=block
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
www.rppartners.it/00/Office/365/images/
513 B
509 B
Image
General
Full URL
https://www.rppartners.it/00/Office/365/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Requested by
Host: www.rppartners.it
URL: https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
89.46.108.21 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1277.aruba.it
Software
aruba-proxy /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy140.ad.aruba.it
date
Wed, 26 Jun 2019 15:17:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 26 Jun 2019 14:43:53 GMT
server
aruba-proxy
etag
W/"201-58c3b13094c04"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-xss-protection
1; mode=block
33_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
www.rppartners.it/00/Office/365/images/
277 KB
277 KB
Image
General
Full URL
https://www.rppartners.it/00/Office/365/images/33_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
Requested by
Host: www.rppartners.it
URL: https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
89.46.108.21 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1277.aruba.it
Software
aruba-proxy /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.rppartners.it/00/Office/365/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=57&id=2824132177&email=myles.sheridan@iaggbs.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-servername
ipvsproxy140.ad.aruba.it
date
Wed, 26 Jun 2019 15:17:10 GMT
x-content-type-options
nosniff
last-modified
Wed, 26 Jun 2019 14:43:53 GMT
server
aruba-proxy
etag
"452d7-58c3b1309388d"
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
283351
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block