firmamodulo-card.com
Open in
urlscan Pro
198.54.115.217
Malicious Activity!
Public Scan
Effective URL: https://firmamodulo-card.com/
Submission Tags: @ecarlesi possiblethreat phishing unicredit Search All
Submission: On April 15 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 15th 2024. Valid for: a year.
This is the only time firmamodulo-card.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Unicredit (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 198.54.115.217 198.54.115.217 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
9 | 1 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server112-3.web-hosting.com
firmamodulo-card.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
firmamodulo-card.com
firmamodulo-card.com |
40 KB |
9 | 1 |
Domain | Requested by | |
---|---|---|
9 | firmamodulo-card.com |
firmamodulo-card.com
|
9 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
firmamodulo-card.com Sectigo RSA Domain Validation Secure Server CA |
2024-04-15 - 2025-04-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://firmamodulo-card.com/
Frame ID: F29034714571986F2D0980388D714052
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://firmamodulo-card.com/
HTTP 307
https://firmamodulo-card.com/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://firmamodulo-card.com/
HTTP 307
https://firmamodulo-card.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
firmamodulo-card.com/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo-UniCredit.png
firmamodulo-card.com/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9j5git0ky54iterkjhge_eriuthut.js
firmamodulo-card.com/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
firmamodulo-card.com/ |
1 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home.png
firmamodulo-card.com/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
locator.png
firmamodulo-card.com/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
unicredit-regular.otf
firmamodulo-card.com/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
unicredit-regular.woff
firmamodulo-card.com/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
unicredit-regular.ttf
firmamodulo-card.com/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Unicredit (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
firmamodulo-card.com/ | Name: COOKIE_KEY Value: 171319186895 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
firmamodulo-card.com
198.54.115.217
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
ce2a90b7453d592f36994cf622a4c7a016e6050c5dc115c97127e15f9adb2bab
cf14403cba1a72760d541fc7331cd80e2d2dce2d16e5736fcb8003724a7f2e7e
ec8fc0eb875e88aea59abac992a87407ec3e9c42ea64b33924417c92868d0ddd
f4cce5773a90366bbd51f91ef7491bf337be862806c578c0efa027521d7dbec2