ristorantenauita.it Open in urlscan Pro
81.88.52.219  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request shapoint.htm Show response ristorantenauita.it/Sharepoint/sharepintv2/	11 KB 3 KB	610ms 116ms	Document text/html	81.88.52.219 REGISTER-AS
General Check archive.org Show headers Download Go to Full URL https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.88.52.219 , Italy, ASN39729 (REGISTER-AS, IT), Reverse DNS lhcp3219.webapps.net Software Apache / Resource Hash f93d3f485cb09d32eb02d07b51d2c6947b8bb17d092e3b33f147cb295da35d47 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language en-US,en;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-length 3019 content-type text/html date Sat, 21 Jan 2023 15:08:37 GMT etag "20c72b0-2b5b-5f29701d0d500-gzip" last-modified Thu, 19 Jan 2023 05:14:28 GMT server Apache vary Accept-Encoding,User-Agent
GET H2	200	microsoft-logo.png sherwoodestate.sharepoint.com/_layouts/15/images/	3 KB 4 KB	1408ms 925ms	Image image/png	2620:1ec:8fa::8 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://sherwoodestate.sharepoint.com/_layouts/15/images/microsoft-logo.png Requested by Host: ristorantenauita.it URL: https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:8fa::8 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / ASP.NET Resource Hash 825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://ristorantenauita.it/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 21 Jan 2023 15:08:38 GMT x-content-type-options nosniff x-powered-by ASP.NET x-cache CONFIG_NOCACHE p3p CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" content-length 3331 microsoftsharepointteamservices 16.0.0.23207 x-ms-invokeapp 1; RequireReadOnly sprequestduration 7 last-modified Sat, 14 Jan 2023 03:37:36 GMT x-msedge-ref Ref A: 981A2C2EB86E4E31B98BD176284567C6 Ref B: EWR311000101051 Ref C: 2023-01-21T15:08:37Z etag "0401d8bc927d91:0" content-type image/png cache-control max-age=31536000 accept-ranges bytes spiislatency 2
GET H2	200	5dLpMgL.png i.imgur.com/	238 KB 239 KB	35ms 11ms	Image image/png	199.232.36.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/5dLpMgL.png Requested by Host: ristorantenauita.it URL: https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.36.193 New York, United States, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 49cd32a9879d1d838209c2479057ec98c8db5a1151e0eea98ae3d405fe4aae28 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://ristorantenauita.it/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 21 Jan 2023 15:08:37 GMT strict-transport-security max-age=300 x-content-type-options nosniff age 338069 x-cache HIT, HIT content-length 243876 x-served-by cache-iad-kcgs7200149-IAD, cache-lga21921-LGA last-modified Tue, 17 Jan 2023 17:14:08 GMT server cat factory 1.0 x-timer S1674313717.140470,VS0,VE3 etag "fb71e48b2330408afac41e0bcfbbd4c0" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 35, 1
GET H2	200	oge.css dl.dropboxusercontent.com/s/o11b7i9cmqbmzqr/	13 KB 7 KB	404ms 312ms	Stylesheet text/css	2620:100:6019:15::a27d:40f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/o11b7i9cmqbmzqr/oge.css?dl=0 Requested by Host: ristorantenauita.it URL: https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6019:15::a27d:40f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 6eff56e410c95a964747fee6133af818110d7c1baeb5c5b17ea027b9ce7b5831 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://ristorantenauita.it/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' date Sat, 21 Jan 2023 15:08:37 GMT x-content-type-options nosniff accept-encoding identity,gzip content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains; preload x-dropbox-request-id fef5485353fb46f2b7d2145ec6bfb0fd x-dropbox-response-origin far_remote content-disposition inline; filename="oge.css"; filename*=UTF-8''oge.css pragma public server envoy x-server-response-time 295 vary Accept-Encoding content-type text/css; charset=utf-8 cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	36ms 5ms	Script text/javascript	2607:f8b0:4006:807::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: ristorantenauita.it URL: https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:807::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ristorantenauita.it/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Sat, 21 Jan 2023 14:21:27 GMT content-encoding gzip x-content-type-options nosniff age 2830 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sun, 21 Jan 2024 14:21:27 GMT
GET H2	200	file-co.js Show response opposite-uneven-stocking.glitch.me/	28 KB 29 KB	146ms 66ms	Script application/javascript	3.216.72.21 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://opposite-uneven-stocking.glitch.me/file-co.js Requested by Host: ristorantenauita.it URL: https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.216.72.21 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-216-72-21.compute-1.amazonaws.com Software AmazonS3 / Resource Hash b57bbc748e72750d7fb31f21d47d704823ff45f25bf7d02f386c1fac4ac9cb58 Request headers Referer https://ristorantenauita.it/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Sat, 21 Jan 2023 15:08:37 GMT x-amz-version-id XRyz.THsQCp4eGnObHkFq1VCPjcFtGBO last-modified Thu, 19 Jan 2023 14:46:27 GMT server AmazonS3 x-amz-request-id 70PA5RWVXVMY49PR etag "66a08cbfd060d88f9836ce708e1ca82f" content-type application/javascript; charset=utf-8 cache-control no-cache accept-ranges bytes content-length 28796 x-amz-id-2 yTFMD5wsaMn+uSanIMxRnTnILg8Nq9v5WZ6wI/pKk/lqr6U99+cjumRMO6adFCbBA99nWFr9O6Y=
GET H2	200	i9jVu59.png i.imgur.com/	442 KB 443 KB	15ms 15ms	Image image/png	199.232.36.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/i9jVu59.png Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/o11b7i9cmqbmzqr/oge.css?dl=0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.36.193 New York, United States, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 0dfb23f53a4e9ce3d89b1896e437aee5f601c7c549cb44985793c96fb44ca10e Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://dl.dropboxusercontent.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 21 Jan 2023 15:08:37 GMT strict-transport-security max-age=300 x-content-type-options nosniff age 177792 x-cache HIT, MISS content-length 452830 x-served-by cache-iad-kiad7000037-IAD, cache-lga21921-LGA last-modified Thu, 19 Jan 2023 13:45:26 GMT server cat factory 1.0 x-timer S1674313718.603978,VS0,VE9 etag "f275ada6864e520f788669125481d26a" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 31, 0
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5 Request headers Referer Origin https://ristorantenauita.it accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type application/octet-stream

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Sharepoint (Online) Microsoft (Consumer)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery function| _0x2d794d function| _0x442c4 function| _0x4113 function| _0x1f93 function| _0x470f1e function| _0x555869 number| count number| inputCount number| flag undefined| email undefined| password undefined| ip function| validateEmail function| stopProgress function| errorMsg function| onFormSubmit number| g_duration number| g_iisLatency number| g_cpuDuration number| g_queryCount number| g_queryDuration number| g_requireJSDone

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dropboxusercontent.com/	1969-12-31 23:59:59	Name: uc_session Value: Wzgd5USQKoKoi4t2mc1d154htJF07DEA5rcpcs8IfjCE86zQqX3ztvOKWnQHRg1M

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm(Line 5) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm(Line 5) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm(Line 94) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://opposite-uneven-stocking.glitch.me/file-co.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://ristorantenauita.it/Sharepoint/sharepintv2/shapoint.htm(Line 94) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://opposite-uneven-stocking.glitch.me/file-co.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
dl.dropboxusercontent.com
i.imgur.com
opposite-uneven-stocking.glitch.me
ristorantenauita.it
sherwoodestate.sharepoint.com
199.232.36.193
2607:f8b0:4006:807::200a
2620:100:6019:15::a27d:40f
2620:1ec:8fa::8
3.216.72.21
81.88.52.219
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0dfb23f53a4e9ce3d89b1896e437aee5f601c7c549cb44985793c96fb44ca10e
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
49cd32a9879d1d838209c2479057ec98c8db5a1151e0eea98ae3d405fe4aae28
6eff56e410c95a964747fee6133af818110d7c1baeb5c5b17ea027b9ce7b5831
825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb
b57bbc748e72750d7fb31f21d47d704823ff45f25bf7d02f386c1fac4ac9cb58
f93d3f485cb09d32eb02d07b51d2c6947b8bb17d092e3b33f147cb295da35d47