![](/screenshots/7f8fbe7d-ac71-4c1e-83af-0345a630a8cc.png)
rob.raiffeisen.it
Open in
urlscan Pro
195.254.225.85
Malicious Activity!
Public Scan
Effective URL: https://rob.raiffeisen.it/nibank/MAIN
Submission: On August 02 via manual from CH — Scanned from IT
Summary
TLS certificate: Issued by Thawte RSA CA 2018 on January 25th 2022. Valid for: a year.
This is the only time rob.raiffeisen.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Raiffeisen Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 25 | 195.254.225.85 195.254.225.85 | 44512 (KONVERTO-AS) (KONVERTO-AS) | |
22 | 2 |
ASN44512 (KONVERTO-AS, IT)
PTR: reserved-225085.rol.raiffeisen.net
rob.raiffeisen.it |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
raiffeisen.it
3 redirects
rob.raiffeisen.it |
412 KB |
22 | 1 |
Domain | Requested by | |
---|---|---|
25 | rob.raiffeisen.it |
3 redirects
rob.raiffeisen.it
|
22 | 1 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
rob.raiffeisen.it Thawte RSA CA 2018 |
2022-01-25 - 2023-01-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://rob.raiffeisen.it/nibank/MAIN
Frame ID: 9686A9AB692178B1BA361479558918CD
Requests: 29 HTTP requests in this frame
Screenshot
![](/screenshots/7f8fbe7d-ac71-4c1e-83af-0345a630a8cc.png)
Page Title
LoginPage URL History Show full URLs
-
http://rob.raiffeisen.it/
HTTP 301
https://rob.raiffeisen.it/ HTTP 302
https://rob.raiffeisen.it/nibank/MAIN HTTP 302
https://rob.raiffeisen.it/nibank/login/index.html?ver=20220802085220 Page URL
- https://rob.raiffeisen.it/nibank/MAIN Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
18 Outgoing links
These are links going to different origins than the main page.
Title: Registrierung
Search URL Search Domain Scan URL
Title: Hilfe
Search URL Search Domain Scan URL
Title: Sicherheitshinweis
Search URL Search Domain Scan URL
Title: Benutzernummer vergessen, was tun?
Search URL Search Domain Scan URL
Title: Neue Loginseite, wie melde ich mich an?
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: Datenschutz
Search URL Search Domain Scan URL
Title: Transparenz
Search URL Search Domain Scan URL
Title: Raiffeisen Information Service KonsGmbH
Search URL Search Domain Scan URL
Title: Raiffeisen Versicherungsdienst
Search URL Search Domain Scan URL
Title: Konverto
Search URL Search Domain Scan URL
Title: Raiffeisen Nachrichten
Search URL Search Domain Scan URL
Title: Raiffeisen Magazin
Search URL Search Domain Scan URL
Title: Raiffeisen InvestmentClub
Search URL Search Domain Scan URL
Title: Raiffeisen Pensionsfonds
Search URL Search Domain Scan URL
Title: Raiffeisen Gesundheitsfonds
Search URL Search Domain Scan URL
Title: Wohnen in Südtirol
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://rob.raiffeisen.it/
HTTP 301
https://rob.raiffeisen.it/ HTTP 302
https://rob.raiffeisen.it/nibank/MAIN HTTP 302
https://rob.raiffeisen.it/nibank/login/index.html?ver=20220802085220 Page URL
- https://rob.raiffeisen.it/nibank/MAIN Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://rob.raiffeisen.it/ HTTP 301
- https://rob.raiffeisen.it/ HTTP 302
- https://rob.raiffeisen.it/nibank/MAIN HTTP 302
- https://rob.raiffeisen.it/nibank/login/index.html?ver=20220802085220
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.html
rob.raiffeisen.it/nibank/login/ Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
rob.raiffeisen.it/nibank/login/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Logo_Raiffeisen.gif
rob.raiffeisen.it/nibank/login/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lightshow.gif
rob.raiffeisen.it/nibank/common/graphics/ |
846 B 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
Primary Request
MAIN
rob.raiffeisen.it/nibank/ |
25 KB 27 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
rob.raiffeisen.it/nibank/common/login/raiffeisen/css/ |
118 KB 120 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ie10-viewport-bug-workaround.css
rob.raiffeisen.it/nibank/common/login/raiffeisen/css/ |
433 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
raiffeisen.css
rob.raiffeisen.it/nibank/common/login/raiffeisen/css/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
util.js
rob.raiffeisen.it/nibank/common/login/raiffeisen/js/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header.png
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-v1.png
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
28 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Attenzione.png
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
728 B 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video_preview_1.jpg
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
9 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video_preview_2.jpg
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
9 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video_preview_3.jpg
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
9 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video_preview_4.jpg
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
9 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video_preview_5.jpg
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
11 KB 11 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video_preview_6.jpg
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
10 KB 11 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
launcher.png
rob.raiffeisen.it/nibank/common/login/raiffeisen/img/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
rob.raiffeisen.it/nibank/common/login/raiffeisen/js/ |
95 KB 96 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
rob.raiffeisen.it/nibank/common/login/raiffeisen/js/ |
36 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ie10-viewport-bug-workaround.js
rob.raiffeisen.it/nibank/common/login/raiffeisen/js/ |
641 B 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
547 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
552 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
715 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
380 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
177 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
351 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
242 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Raiffeisen Bank (Banking)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| detectIE function| fakePlaceholder function| get_cookie_language function| set_cookie function| changeLanguage function| getOsBrowser function| linkToDemoServer function| $ function| jQuery object| jQuery112402052452432315206 function| checkLoginButton undefined| counterBack function| startProgressbar function| goToInbank function| goToFarbmatrix function| goToIndex4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
rob.raiffeisen.it/nibank | Name: JSESSIONID Value: 6vTWnxGB9pIzex4_HfwVpDnl-yWwpUCSnHpXE2TF.robeap02-p |
|
rob.raiffeisen.it/ | Name: SameSite Value: None |
|
rob.raiffeisen.it/ | Name: ADRUM_BT1 Value: "R:75|i:4312|e:132" |
|
rob.raiffeisen.it/ | Name: ADRUM_BTa Value: "R:75|g:117891e2-ace3-4189-99df-18f7085a3706|n:customer1_e520cf5c-1be3-4516-a0dc-7b0f2c068120" |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'self' https://*.raiffeisen.it https://*.nyx.raiffeisen.net data:; img-src 'self' data: blob: https://*.raiffeisen.it https://www.google-analytics.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.raiffeisen.it https://www.google-analytics.com https://*.nyx.raiffeisen.net; style-src 'unsafe-inline' 'self' https://*.raiffeisen.it; font-src 'self' https://*.raiffeisen.it data:; connect-src 'self' blob: https://*.raiffeisen.it wss://*.raiffeisen.it wss://*.raiffeisen.it:9092 wss://*.raiffeisen.it:9099 |
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | sameorigin |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
rob.raiffeisen.it
195.254.225.85
0369ac9eb09f078df7c14bbb251506943995d7c919a72259a96f885f9cb245d6
0eae04d6d6290d60f758d9f0325b8c5cbca79ddb9ea0c3dad08bf9ffa11a807c
145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5
17ec74c69eb8c08a5c82d7126fa307525806b2b9f06cda918c5f750428c40d40
1b273ecffd76fb2ce7a2d91494da4d01a50a3b8d3f01b7c16909b28cc265b2fe
1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
54359112c0af1dfed4c2680b292f24ae9e807c64490818420e409b9e96489b1f
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5ad76095cb70c628a880b538dc52eb3a69e90ee9ef2795f7d4ff96e108dfc778
62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6b6a04e3b4ab3237a50dffd37616bbf776ddd2561289c4ef081490949e3ec791
717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53
82bc712ea147738196a0bd9b14fdb8ca1e0131a73953647a4a4943c661a21c44
8756d97013e4542aec17f1f6e39d3f11a790a17d137aa4e3c9027d9c36a83355
aff47e2a1652d7814fcffb12e0a3ca3d95ef5e5e76f439a887db8b0ed41cdadc
b9bb985a3ac1db40d68d82cbf588fb77c09aa23fa5132914e3729bd011f86106
be6ce7c9b074a51357f3756330743372ca23794a0f800255a26ec39c510e5d5e
c356b002055ba302917cdfdd29fe50aaaeb4b2644da09cd57f24d18786612745
c371a5d9520828f9833970fd5491b7c9b63fd82879910ee02642ffeee02181b9
d3f9f70211916634049375a3158c0b516f33ba959841ce72899f3fd2ebfaf7ec
d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115
e1df7b52bea25c1b627cf0fd7da42e0c76d37136986da7cb23ca3074af20bb0c
eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366
f663fd5d5698e04a8e56de60c13c54abcb6943adcb21c3d5e80866d0eda0604d
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c