![](/screenshots/6c4d9101-7838-4586-b954-79a869418b08.png)
www.primastampa.eu
Open in
urlscan Pro
89.46.105.61
Malicious Activity!
Public Scan
Effective URL: https://www.primastampa.eu/Ditr654652ju/Manage/Serv/servuizianoo.php
Submission: On April 01 via manual from IT — Scanned from IT
Summary
TLS certificate: Issued by Actalis Domain Validation Server CA G3 on January 5th 2023. Valid for: a year.
This is the only time www.primastampa.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aruba (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:20:... 2606:4700:20::681a:a2a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 89.46.105.61 89.46.105.61 | 31034 (ARUBA-ASN) (ARUBA-ASN) | |
1 | 95.101.54.243 95.101.54.243 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 46.137.30.102 46.137.30.102 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 4 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-54-243.deploy.static.akamaitechnologies.com
secure-ds.serving-sys.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-46-137-30-102.eu-west-1.compute.amazonaws.com
w.usabilla.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
usabilla.com
w.usabilla.com — Cisco Umbrella Rank: 3392 |
11 KB |
1 |
serving-sys.com
secure-ds.serving-sys.com — Cisco Umbrella Rank: 2503 |
80 KB |
1 |
primastampa.eu
www.primastampa.eu |
103 KB |
1 |
thenoverings.com
1 redirects
thenoverings.com |
666 B |
3 | 4 |
Domain | Requested by | |
---|---|---|
1 | w.usabilla.com |
srcdoc
|
1 | secure-ds.serving-sys.com |
www.primastampa.eu
|
1 | www.primastampa.eu | |
1 | thenoverings.com | 1 redirects |
3 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.primastampa.eu Actalis Domain Validation Server CA G3 |
2023-01-05 - 2024-02-05 |
a year | crt.sh |
secure-ds.serving-sys.com R3 |
2023-02-21 - 2023-05-22 |
3 months | crt.sh |
w.usabilla.com Amazon RSA 2048 M01 |
2023-02-09 - 2024-02-09 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.primastampa.eu/Ditr654652ju/Manage/Serv/servuizianoo.php
Frame ID: F65E6B80150F83313E23A1CEBDA97D91
Requests: 11 HTTP requests in this frame
Frame:
https://w.usabilla.com/7fe6a6518d1e.js?lv=1
Frame ID: A3958447F9CA7371EB8803DF90ACE195
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/6c4d9101-7838-4586-b954-79a869418b08.png)
Page Title
Servizio Hosting - Aruba.itPage URL History Show full URLs
-
http://thenoverings.com/
HTTP 301
https://www.primastampa.eu/Ditr654652ju/Manage/Serv/servuizianoo.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Sizmek.png)
Detected patterns
- serving-sys\.com/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://thenoverings.com/
HTTP 301
https://www.primastampa.eu/Ditr654652ju/Manage/Serv/servuizianoo.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
servuizianoo.php
www.primastampa.eu/Ditr654652ju/Manage/Serv/ Redirect Chain
|
306 KB 103 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
areaclienti-EN-no-promo_67430145580878486.jpg
secure-ds.serving-sys.com/resources/PROD/asset/1073743419/IMAGE/20211217/ |
79 KB 80 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
219 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
822 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
45 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7fe6a6518d1e.js
w.usabilla.com/ Frame A395 |
36 KB 11 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aruba (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless function| savepage_ShadowLoader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secure-ds.serving-sys.com
thenoverings.com
w.usabilla.com
www.primastampa.eu
2606:4700:20::681a:a2a
46.137.30.102
89.46.105.61
95.101.54.243
27a9a24907f8907c98afcf081684fe8fe95f3381ef49ff0d56c9e8e1eb525b6f
5d746dbba741cc1efdc26938dd5ed8e1800a0e28a2939447a85f028dfdf8f67e
6676b05ef9626756989d9dbc09608830af666a330ad1bfa12438b9775330c474
6c46bf722fb11c3066171661ece073b58b6ea6c16b00a9d3cc162a6f215b57f1
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61
b7fd66e7218e3267d3968a3648c882f33ea39d19d94fc64541efe76fd6385e3d
bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c486b0df4be03e42c2dc262f79c1dc86912d863d03d1d7cfabb33a4df909354e
d9ad9ccafbc7696d83a75b36483dc07f3a1465c7d4443047f7d2803045435dcd
ea8102aa48e148730886e2055561e40c78f1203291fe59c49cb8ae557fc9291f