villa-azzurro.com Open in urlscan Pro
173.199.184.24 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://villa-azzurro.com/trade/ofc1
Effective URL:
https://villa-azzurro.com/trade/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048...
Submission: On August 13 via manual (August 13th 2020, 3:18:21 pm UTC) from US

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 173.199.184.24, located in Lansing, United States and belongs to LIQUIDWEB, US. The main domain is villa-azzurro.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 17th 2020. Valid for: 3 months.

This is the only time villa-azzurro.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 4	173.199.184.24 173.199.184.24	32244 (LIQUIDWEB) (LIQUIDWEB)
1	2606:4700::68... 2606:4700::6811:4e6b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:3c01::f0... 2600:3c01::f03c:91ff:fe79:43b	63949 (LINODE-AP...) (LINODE-AP Linode)
4	4

4 173.199.184.24 (Lansing, United States) 2 redirects

ASN32244 (LIQUIDWEB, US)
PTR: host.pressmax.net

villa-azzurro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4e6b (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:3c01::f03c:91ff:fe79:43b (United States)

ASN63949 (LINODE-AP Linode, LLC, US)

jsonip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	villa-azzurro.com 2 redirects villa-azzurro.com	363 KB
1	jsonip.com jsonip.com	451 B
1	cloudflare.com cdnjs.cloudflare.com	73 KB
4	3

	Domain	Requested by
4	villa-azzurro.com	2 redirects
1	jsonip.com	cdnjs.cloudflare.com
1	cdnjs.cloudflare.com	villa-azzurro.com
4	3

This site contains no links.

Subject Issuer	Validity	Valid
villa-azzurro.com cPanel, Inc. Certification Authority	`2020-06-17` - `2020-09-15`	3 months	crt.sh
cdnjs.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-12` - `2022-08-17`	2 years	crt.sh
jsonip.com Let's Encrypt Authority X3	`2020-06-28` - `2020-09-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://villa-azzurro.com/trade/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89
Frame ID: BB8E717A67779794EBA526597C17550E
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://villa-azzurro.com/trade/ofc1 HTTP 301
https://villa-azzurro.com/trade/ofc1/ HTTP 303
https://villa-azzurro.com/trade/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4f... Page URL
https://villa-azzurro.com/trade/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5e... Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

436 kB
Transfer

1203 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://villa-azzurro.com/trade/ofc1 HTTP 301
https://villa-azzurro.com/trade/ofc1/ HTTP 303
https://villa-azzurro.com/trade/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89 Page URL
https://villa-azzurro.com/trade/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://villa-azzurro.com/trade/ofc1 HTTP 301
https://villa-azzurro.com/trade/ofc1/ HTTP 303
https://villa-azzurro.com/trade/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89

4 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

r.php
villa-azzurro.com/trade/ofc1/
Redirect Chain

https://villa-azzurro.com/trade/ofc1
https://villa-azzurro.com/trade/ofc1/
https://villa-azzurro.com/trade/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89

222 B
232 B

123ms
123ms

Document
text/html

173.199.184.24
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://villa-azzurro.com/trade/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.199.184.24 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.pressmax.net
Software: LiteSpeed /
Resource Hash

Request headers

:method: GET
:authority: villa-azzurro.com
:scheme: https
:path: /trade/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=57fl8dcbek73f9b93mk5ha1ed5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 175
content-encoding: br
vary: Accept-Encoding
date: Thu, 13 Aug 2020 15:17:35 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"

Redirect headers

status: 303
set-cookie: PHPSESSID=57fl8dcbek73f9b93mk5ha1ed5; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
location: ./r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89
content-type: text/html; charset=UTF-8
content-length: 0
date: Thu, 13 Aug 2020 15:17:35 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"

GET
H2 200 Primary Request / Show response
villa-azzurro.com/trade/ofc1/s/ 542 KB
362 KB 141ms
141ms Document
text/html 173.199.184.24
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://villa-azzurro.com/trade/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.199.184.24 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host.pressmax.net
Software: LiteSpeed /
Resource Hash: 1e736d3b3468655452d61b7d9ee41c8c9bf2ece82f923c1c13a9e0d8015aec39

Request headers

:method: GET
:authority: villa-azzurro.com
:scheme: https
:path: /trade/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://villa-azzurro.com/trade/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=57fl8dcbek73f9b93mk5ha1ed5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://villa-azzurro.com/trade/ofc1/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89

Response headers

status: 200
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
content-type: text/html; charset=UTF-8
content-encoding: br
vary: Accept-Encoding
date: Thu, 13 Aug 2020 15:17:36 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"

GET
H2 200 jquery.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/ 257 KB
73 KB 51ms
33ms Script
application/javascript 2606:4700::6811:4e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Requested by

Host: villa-azzurro.com
URL: https://villa-azzurro.com/trade/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4e6b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://villa-azzurro.com/trade/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 13 Aug 2020 15:17:36 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 2306245
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0489fef5d00000c2f4a1314200000001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:20:15 GMT
server: cloudflare
etag: W/"5afd494f-40464"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Tue, 03 Aug 2021 15:17:36 GMT
cache-control: public, max-age=30672000
cf-ray: 5c2367694950c2f4-FRA
served-in-seconds: 0.004

GET
DATA 200
OK truncated
/ 383 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1ce4c4aeeb995517fdd9248fcb34ec101c7193d1435e0c68a45c600075b03d28

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK / Show response
jsonip.com/ 150 B
451 B 459ms
152ms Script
application/json 2600:3c01::f03c:91ff:fe79:43b
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://jsonip.com/?callback=jQuery300035275445094028_1597331856902&_=1597331856903

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:3c01::f03c:91ff:fe79:43b , United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

4f76cc618562ef537f7f11f158218e36033c38e5743c9c68fd529e1dcd65650d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://villa-azzurro.com/trade/ofc1/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=771c97cbf46a4fb5ebfd294fa3a1bf8be9048f28e991fb3722a9dbb49e554c892747ae89
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 13 Aug 2020 15:17:37 GMT
Server: nginx/1.16.1
Strict-Transport-Security: max-age=31536000;
Access-Control-Allow-Methods: GET
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78d8381f0086cda47410c39c642635e238296bd07d56c0a9d6b1a2226585ca8e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 97f01d6817f34941172337d9c969829a0874970b12ee5a8f17c319d547fb1485

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b58a0d3db4f12ab7dd83da6b8a6acee1df6ef851c3eff3b801454fc9b731b348

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| getIPAddress string| x

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
jsonip.com
villa-azzurro.com
173.199.184.24
2600:3c01::f03c:91ff:fe79:43b
2606:4700::6811:4e6b
1ce4c4aeeb995517fdd9248fcb34ec101c7193d1435e0c68a45c600075b03d28
1e736d3b3468655452d61b7d9ee41c8c9bf2ece82f923c1c13a9e0d8015aec39
4f76cc618562ef537f7f11f158218e36033c38e5743c9c68fd529e1dcd65650d
78d8381f0086cda47410c39c642635e238296bd07d56c0a9d6b1a2226585ca8e
8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a
97f01d6817f34941172337d9c969829a0874970b12ee5a8f17c319d547fb1485
b58a0d3db4f12ab7dd83da6b8a6acee1df6ef851c3eff3b801454fc9b731b348

villa-azzurro.com Open in urlscan Pro 173.199.184.24 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

436 kBTransfer

1203 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

villa-azzurro.com Open in urlscan Pro
173.199.184.24 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

436 kB
Transfer

1203 kB
Size

0
Cookies

4 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!