![](/screenshots/72d13ae5-f596-4ef2-ab35-a8e12412c915.png)
andiamo-travel.com
Open in
urlscan Pro
69.160.95.72
Malicious Activity!
Public Scan
Effective URL: https://andiamo-travel.com/ent.com_moonV4/index.html
Submission Tags: 7815860
Submission: On October 08 via api from GB — Scanned from GB
Summary
TLS certificate: Issued by R3 on September 7th 2022. Valid for: 3 months.
This is the only time andiamo-travel.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Ent Credit Union (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 50.87.150.146 50.87.150.146 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
4 | 69.160.95.72 69.160.95.72 | 5048 (FIBER) (FIBER) | |
4 | 2a02:26f0:350... 2a02:26f0:3500:16::215:148f | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
4 | 104.17.255.12 104.17.255.12 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:223... 2600:9000:223f:3200:0:99b9:cd80:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700::68... 2606:4700::6812:1734 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
2 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2a02:26f0:350... 2a02:26f0:3500:16::215:1495 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
4 | 2606:4700:e6:... 2606:4700:e6::ac40:cb1c | () () | |
28 | 13 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 50-87-150-146.unifiedlayer.com
brettrapkin.com |
ASN5048 (FIBER, US)
PTR: 72.95.160.69.static.dns-solutions.net
andiamo-travel.com |
ASN20940 (AKAMAI-ASN1, NL)
use.typekit.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 3306 ka-f.fontawesome.com |
100 KB |
5 |
typekit.net
use.typekit.net — Cisco Umbrella Rank: 1023 p.typekit.net — Cisco Umbrella Rank: 1263 |
194 KB |
4 |
ent.com
online.ent.com — Cisco Umbrella Rank: 808485 |
56 KB |
4 |
andiamo-travel.com
andiamo-travel.com |
87 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 358 |
12 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 977 |
53 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2902 |
30 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3315 |
15 KB |
1 |
salemove.com
libs.salemove.com — Cisco Umbrella Rank: 40529 |
118 KB |
1 |
brettrapkin.com
brettrapkin.com |
272 B |
28 | 10 |
Domain | Requested by | |
---|---|---|
4 | ka-f.fontawesome.com |
kit.fontawesome.com
andiamo-travel.com |
4 | online.ent.com |
andiamo-travel.com
online.ent.com |
4 | use.typekit.net |
andiamo-travel.com
use.typekit.net |
4 | andiamo-travel.com |
andiamo-travel.com
|
2 | cdnjs.cloudflare.com |
andiamo-travel.com
|
2 | code.jquery.com |
andiamo-travel.com
|
1 | p.typekit.net |
use.typekit.net
|
1 | ajax.aspnetcdn.com |
andiamo-travel.com
|
1 | stackpath.bootstrapcdn.com |
andiamo-travel.com
|
1 | kit.fontawesome.com |
andiamo-travel.com
|
1 | libs.salemove.com |
andiamo-travel.com
|
1 | brettrapkin.com | |
28 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
brettrapkin.com R3 |
2022-09-21 - 2022-12-20 |
3 months | crt.sh |
andiamo-travel.com R3 |
2022-09-07 - 2022-12-06 |
3 months | crt.sh |
use.typekit.net DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-09-14 - 2023-10-15 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-15 - 2023-06-15 |
a year | crt.sh |
*.glia.com Amazon |
2022-07-18 - 2023-08-16 |
a year | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-12-01 - 2023-01-01 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2022-07-11 - 2023-07-11 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://andiamo-travel.com/ent.com_moonV4/index.html
Frame ID: 29F6EB864EDE091B69BB40BF48182664
Requests: 32 HTTP requests in this frame
Screenshot
![](/screenshots/72d13ae5-f596-4ef2-ab35-a8e12412c915.png)
Page URL History Show full URLs
- https://brettrapkin.com/ent.com.html Page URL
- https://andiamo-travel.com/ent.com_moonV4/index.html Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
![](/vendor/wappa/icons/Popper.png)
Detected patterns
- /popper\.js/([0-9.]+)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://brettrapkin.com/ent.com.html Page URL
- https://andiamo-travel.com/ent.com_moonV4/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
ent.com.html
brettrapkin.com/ |
132 B 272 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
andiamo-travel.com/ent.com_moonV4/ |
47 KB 47 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bjh0ewy.css
use.typekit.net/ |
13 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.36ec3a08.css
online.ent.com/Banking/hlm/Ent.React.Template/media/css/ |
216 KB 33 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.1e398acc.css
online.ent.com/Banking/hlm/Ent.React.Template/media/css/ |
222 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
visitor-app.edec9f19.default.css
libs.salemove.com/ |
298 KB 118 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ef709dd840.js
kit.fontawesome.com/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
andiamo-travel.com/ent.com_moonV4/Financial/Education/Investment/RealsState/ |
414 B 682 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ncua.c8630dbf.png
online.ent.com/Banking/hlm/Ent.React.Template/media/images/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading.gif
andiamo-travel.com/ent.com_moonV4/Financial/Education/Investment/RealsState/ |
38 KB 38 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ |
49 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
actions.js
andiamo-travel.com/ent.com_moonV4/Financial/Education/Investment/RealsState/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p.css
p.typekit.net/ |
5 B 195 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
26 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
3 KB 1 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
929 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d8f10800a50e29d08462edd9163a6d18.svg
online.ent.com/Banking/hlm/Ent.React.Template/media/ |
1 KB 806 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
use.typekit.net/af/bcdde2/00000000000000003b9af1d8/27/ |
64 KB 64 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
use.typekit.net/af/ab749c/00000000000000003b9af1da/27/ |
64 KB 64 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
use.typekit.net/af/8db0ad/00000000000000003b9af1df/27/ |
64 KB 65 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
af7ae505a9eed503f8b8e6982036873e.woff2
online.ent.com/Banking/hlm/Ent.React.Template/media/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
41 KB 41 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/ |
76 KB 77 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fee66e712a8a08eef5805a46892932ad.woff
online.ent.com/Banking/hlm/Ent.React.Template/media/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- online.ent.com
- URL
- https://online.ent.com/Banking/hlm/Ent.React.Template/media/af7ae505a9eed503f8b8e6982036873e.woff2
- Domain
- online.ent.com
- URL
- https://online.ent.com/Banking/hlm/Ent.React.Template/media/fee66e712a8a08eef5805a46892932ad.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Ent Credit Union (Financial)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| a string| result1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ent.com/ | Name: __cf_bm Value: XRM8rBVKlWg6yrG4S8N9MtFCMv.IcUjR2xj_Z0SJ6aM-1665238460-0-AYP9IPSRvK8QuskJWYy16UJbXBTZtltBDlGmCwxbAv2O03bZafCwpBES5zGfr2MWLbRGM8YgpgUdNf3gVAGDSgk= |
10 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
andiamo-travel.com
brettrapkin.com
cdnjs.cloudflare.com
code.jquery.com
ka-f.fontawesome.com
kit.fontawesome.com
libs.salemove.com
online.ent.com
p.typekit.net
stackpath.bootstrapcdn.com
use.typekit.net
online.ent.com
104.17.255.12
152.199.19.160
2001:4de0:ac18::1:a:2b
2600:9000:223f:3200:0:99b9:cd80:93a1
2606:4700::6811:180e
2606:4700::6812:1734
2606:4700::6812:bcf
2606:4700:e6::ac40:cb1c
2a02:26f0:3500:16::215:148f
2a02:26f0:3500:16::215:1495
50.87.150.146
69.160.95.72
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
262a10870c5688cadfe2e2f065d2bfae9b123bceffec5465e8861dccccd9246e
4e6b3ef425ab736614f94fbe9328cfd0b90f3479bca1071aaa4400847ed21405
560fd3e537cc4bb9f6ba03c8ae68778d6217b037db1be9b82a50440a602b7725
5c822ac42a3c4b5e4480190640a6cb38a3de93da836ceb9a5f7ab5d3ac02de51
5e3d5246b17e19e65385092db07554d8e1c5c4a226a6d7f97824b8e1e8571e34
6591151a59884fc604c603404dd00363c521ddc7bae17a897b6e6acba159b2fc
681b0c00d0eb207178a979ce2dce8afdce278bdb1c419eb31f18d0ab59a55af5
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
7924e7e8b95825e4cefbfc31444ea9247e1b0d04cb066b56f06addf9cc7c5eaf
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8bcecbd1eeb6e999bc9583d1e35c12a74d044dba44ee22e185e138f05ca05414
8cde9f9f2f7ffc277e35dd423f57e8f10a2deba6b5ab2039e3bf4ae8654cb682
9213ac17b151af2419644a4dc52b1e944d29797ffe61dc8d8e0be784114026f9
9c65597dd6ac95c51d315bb74f54942f1039812505b8adf0e3ef263f9d839275
a6e2410507045f040a54fd897f5ef49faed0af2bd6e81a27cb266e92143d09e3
aaccee7c0170414486589dd14cece46919ce30d3b1e9c3b2f9dffd09f73bfe42
b7dae6bd9ece0e8a99328534cb45e49db075d93c65d49dec10ecd8d3f397aa5c
bb86f86818edf9a28a68b1bb9e948fbab277079dc54728b6ead04f1aa2f790f8
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
dfe5ad62a6a746e2d8693eb319717057d5ad1db070940bde96c8530161487492
e78f37796df1049ac2e167adf2774fd466a6b0b56e8ee22503eb7c2e49f5c154
eec2cb838f76cfdf9254021a3247670aba0afb0dfdaa26f901114a3eaaed4c29
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda