Submitted URL: http://invoice.rampinteractive.com/
Effective URL: https://invoice.rampinteractive.com/
Submission Tags: @phish_report
Submission: On February 01 via api from FI — Scanned from CA

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 192.99.65.28, located in Montreal, Canada and belongs to OVH, FR. The main domain is invoice.rampinteractive.com.
TLS certificate: Issued by R3 on December 3rd 2023. Valid for: 3 months.
This is the only time invoice.rampinteractive.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 9 192.99.65.28 16276 (OVH)
2 151.101.193.229 54113 (FASTLY)
10 2
Apex Domain
Subdomains
Transfer
9 rampinteractive.com
invoice.rampinteractive.com
246 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 324
54 KB
10 2
Domain Requested by
9 invoice.rampinteractive.com 1 redirects invoice.rampinteractive.com
2 cdn.jsdelivr.net invoice.rampinteractive.com
10 2

This site contains no links.

Subject Issuer Validity Valid
invoice.rampinteractive.com
R3
2023-12-03 -
2024-03-02
3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3
2023-09-27 -
2024-10-28
a year crt.sh

This page contains 1 frames:

Primary Page: https://invoice.rampinteractive.com/
Frame ID: 04A98D045E357B914B95E23BA11BDD2E
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

RAMP InterActive Invoice Payment

Page URL History Show full URLs

  1. http://invoice.rampinteractive.com/ HTTP 308
    https://invoice.rampinteractive.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • blazor\.server\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

300 kB
Transfer

510 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://invoice.rampinteractive.com/ HTTP 308
    https://invoice.rampinteractive.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
invoice.rampinteractive.com/
Redirect Chain
  • http://invoice.rampinteractive.com/
  • https://invoice.rampinteractive.com/
2 KB
2 KB
Document
General
Full URL
https://invoice.rampinteractive.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.99.65.28 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
0ae1607fe9294673c6594a1f874236d965a1619d0a89745a4425e5d01822a0d8
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-headers
Content-Type, Authorization
access-control-allow-methods
GET,HEAD,POST,PUT,DELETE
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0
content-type
text/html; charset=utf-8
date
Thu, 01 Feb 2024 15:02:04 GMT
referrer-policy
no-referrer
server
Microsoft-IIS/10.0
strict-transport-security
max-age=15768000
transfer-encoding
chunked
x-content-type-options
nosniff
x-frame-options
DENY
x-iplb-instance
44732
x-iplb-request-id
56300F54:FB96_C063411C:01BB_65BBB27B_01F8:6AFF
x-xss-protection
1; mode=block

Redirect headers

content-length
0
location
https://invoice.rampinteractive.com/
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/
190 KB
30 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css
Requested by
Host: invoice.rampinteractive.com
URL: https://invoice.rampinteractive.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.229 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://invoice.rampinteractive.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 01 Feb 2024 15:02:19 GMT
x-content-type-options
nosniff
content-encoding
br
age
8551414
x-jsd-version
5.2.3
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
30336
x-served-by
cache-fra-eddf8230122-FRA, cache-yyz4536-YYZ
x-jsd-version-type
version
etag
W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
site.css
invoice.rampinteractive.com/css/
2 KB
3 KB
Stylesheet
General
Full URL
https://invoice.rampinteractive.com/css/site.css
Requested by
Host: invoice.rampinteractive.com
URL: https://invoice.rampinteractive.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.99.65.28 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
2904b645cf6cf943f1c90d1bb5fc765809da1b15a83ddd35365e037af648da88
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 15:02:04 GMT
strict-transport-security
max-age=15768000
x-content-type-options
nosniff
x-iplb-instance
44732
content-length
2347
x-xss-protection
1; mode=block
referrer-policy
no-referrer
last-modified
Fri, 30 Jun 2023 07:18:32 GMT
server
Microsoft-IIS/10.0
x-iplb-request-id
56300F54:FB96_C063411C:01BB_65BBB27B_01F9:6AFF
etag
"1d9ab23134a9d2b"
x-frame-options
DENY
access-control-allow-methods
GET,HEAD,POST,PUT,DELETE
content-type
text/css
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
blazor.server.js
invoice.rampinteractive.com/_framework/
132 KB
133 KB
Script
General
Full URL
https://invoice.rampinteractive.com/_framework/blazor.server.js
Requested by
Host: invoice.rampinteractive.com
URL: https://invoice.rampinteractive.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.99.65.28 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
59ec41e0b4ec5ea977158c598d2456f3fc636eb6cd955c16437fd532ab4044cf
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 15:02:04 GMT
strict-transport-security
max-age=15768000
x-content-type-options
nosniff
x-iplb-instance
44732
content-length
135236
x-xss-protection
1; mode=block
referrer-policy
no-referrer
last-modified
Wed, 07 Dec 2022 10:44:16 GMT
server
Microsoft-IIS/10.0
x-iplb-request-id
56300F54:FB96_C063411C:01BB_65BBB27B_01FA:6AFF
etag
"1d90a28da36d044"
x-frame-options
DENY
access-control-allow-methods
GET,HEAD,POST,PUT,DELETE
content-type
text/javascript
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
defaults.css
invoice.rampinteractive.com/_content/Havit.Blazor.Components.Web.Bootstrap/
9 KB
10 KB
Stylesheet
General
Full URL
https://invoice.rampinteractive.com/_content/Havit.Blazor.Components.Web.Bootstrap/defaults.css
Requested by
Host: invoice.rampinteractive.com
URL: https://invoice.rampinteractive.com/css/site.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.99.65.28 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
3c6c9010aa971f4af4b2b57300529b1af1b41f586bf04e79682644167b985487
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 15:02:04 GMT
strict-transport-security
max-age=15768000
x-content-type-options
nosniff
x-iplb-instance
44731
content-length
9643
x-xss-protection
1; mode=block
referrer-policy
no-referrer
last-modified
Fri, 30 Jun 2023 07:18:36 GMT
server
Microsoft-IIS/10.0
x-iplb-request-id
56300F54:FB98_C063411C:01BB_65BBB27B_0008:294C
etag
"1d9ab2315accbab"
x-frame-options
DENY
access-control-allow-methods
GET,HEAD,POST,PUT,DELETE
content-type
text/css
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
bootstrap-icons.css
invoice.rampinteractive.com/_content/Havit.Blazor.Components.Web.Bootstrap/
95 KB
96 KB
Stylesheet
General
Full URL
https://invoice.rampinteractive.com/_content/Havit.Blazor.Components.Web.Bootstrap/bootstrap-icons.css
Requested by
Host: invoice.rampinteractive.com
URL: https://invoice.rampinteractive.com/_content/Havit.Blazor.Components.Web.Bootstrap/defaults.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.99.65.28 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
1890f30fb73d3cb00ff490e44dcc98c889c0ad06bb5595021641d9d28ec47c9d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 15:02:04 GMT
strict-transport-security
max-age=15768000
x-content-type-options
nosniff
x-iplb-instance
44731
content-length
97627
x-xss-protection
1; mode=block
referrer-policy
no-referrer
last-modified
Fri, 30 Jun 2023 07:18:35 GMT
server
Microsoft-IIS/10.0
x-iplb-request-id
56300F54:FB98_C063411C:01BB_65BBB27B_000A:294C
etag
"1d9ab2315152adb"
x-frame-options
DENY
access-control-allow-methods
GET,HEAD,POST,PUT,DELETE
content-type
text/css
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
initializers
invoice.rampinteractive.com/_blazor/
2 B
573 B
Fetch
General
Full URL
https://invoice.rampinteractive.com/_blazor/initializers
Requested by
Host: invoice.rampinteractive.com
URL: https://invoice.rampinteractive.com/_framework/blazor.server.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.99.65.28 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 15:02:04 GMT
strict-transport-security
max-age=15768000
x-content-type-options
nosniff
referrer-policy
no-referrer
server
Microsoft-IIS/10.0
x-iplb-request-id
56300F54:FB98_C063411C:01BB_65BBB27B_000B:294C
x-iplb-instance
44731
x-frame-options
DENY
transfer-encoding
chunked
access-control-allow-methods
GET,HEAD,POST,PUT,DELETE
access-control-allow-origin
*
content-type
application/json; charset=utf-8
access-control-allow-headers
Content-Type, Authorization
x-xss-protection
1; mode=block
tinymce-blazor.js
invoice.rampinteractive.com/_content/TinyMCE.Blazor/
0
0
Script
General
Full URL
https://invoice.rampinteractive.com/_content/TinyMCE.Blazor/tinymce-blazor.js
Requested by
Host: invoice.rampinteractive.com
URL: https://invoice.rampinteractive.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.99.65.28 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 15:02:04 GMT
strict-transport-security
max-age=15768000
x-content-type-options
nosniff
referrer-policy
no-referrer
server
Microsoft-IIS/10.0
x-iplb-request-id
56300F54:FB96_C063411C:01BB_65BBB27B_01FE:6AFF
x-iplb-instance
44732
x-frame-options
DENY
transfer-encoding
chunked
access-control-allow-methods
GET,HEAD,POST,PUT,DELETE
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization
x-xss-protection
1; mode=block
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/
79 KB
24 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js
Requested by
Host: invoice.rampinteractive.com
URL: https://invoice.rampinteractive.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.229 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
aa53d582f97eb594c2a5cc5824574707f9ba9837bce3046bfa5f3556860f4e04
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://invoice.rampinteractive.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 01 Feb 2024 15:02:19 GMT
x-content-type-options
nosniff
content-encoding
br
age
6703535
x-jsd-version
5.3.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
24668
x-served-by
cache-fra-etou8220038-FRA, cache-yyz4536-YYZ
x-jsd-version-type
version
etag
W/"13a25-1yL6mYLaiqSN+IJRuxiX8Twds7k"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
negotiate
invoice.rampinteractive.com/_blazor/
316 B
855 B
Fetch
General
Full URL
https://invoice.rampinteractive.com/_blazor/negotiate?negotiateVersion=1
Requested by
Host: invoice.rampinteractive.com
URL: https://invoice.rampinteractive.com/_framework/blazor.server.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.99.65.28 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
0c617b987ba05937b1cd79e039cabe07d51250677487ffd5b97ff351d55e73b6
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
X-Requested-With
XMLHttpRequest
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
X-SignalR-User-Agent
Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version)

Response headers

date
Thu, 01 Feb 2024 15:02:05 GMT
strict-transport-security
max-age=15768000
x-content-type-options
nosniff
referrer-policy
no-referrer
server
Microsoft-IIS/10.0
x-iplb-request-id
56300F54:FB98_C063411C:01BB_65BBB27B_000C:294C
x-iplb-instance
44731
x-frame-options
DENY
access-control-allow-methods
GET,HEAD,POST,PUT,DELETE
content-type
application/json
access-control-allow-origin
*
access-control-allow-headers
Content-Type, Authorization
content-length
316
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| DotNet object| Blazor number| uidEvent object| bootstrap

0 Cookies

4 Console Messages

Source Level URL
Text
security error URL: https://invoice.rampinteractive.com/(Line 5)
Message:
The Content-Security-Policy directive name 'Content-Security-Policy:' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
security error URL: https://invoice.rampinteractive.com/(Line 5)
Message:
The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
network error URL: https://invoice.rampinteractive.com/_content/TinyMCE.Blazor/tinymce-blazor.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
security error URL: https://invoice.rampinteractive.com/
Message:
Refused to execute script from 'https://invoice.rampinteractive.com/_content/TinyMCE.Blazor/tinymce-blazor.js' because its MIME type ('') is not executable, and strict MIME type checking is enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block