rpdalmiaemporio.com
Open in
urlscan Pro
166.62.27.64
Malicious Activity!
Public Scan
Effective URL: http://rpdalmiaemporio.com/wp-includes/certificates/themes/web/
Submission: On August 25 via manual from PL — Scanned from DE
Summary
This is the only time rpdalmiaemporio.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNP Paribas (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 198.57.150.102 198.57.150.102 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 6 | 166.62.27.64 166.62.27.64 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:806::2003 | 15169 (GOOGLE) (GOOGLE) | |
9 | 4 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: cayugacountryhomes.com
anacetina.com |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-27-64.ip.secureserver.net
rpdalmiaemporio.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
rpdalmiaemporio.com
1 redirects
rpdalmiaemporio.com |
618 KB |
2 |
gstatic.com
fonts.gstatic.com |
55 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 54 |
1 KB |
1 |
anacetina.com
anacetina.com |
380 B |
9 | 4 |
Domain | Requested by | |
---|---|---|
6 | rpdalmiaemporio.com |
1 redirects
rpdalmiaemporio.com
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
rpdalmiaemporio.com
|
1 | anacetina.com | |
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
upload.video.google.com GTS CA 1C3 |
2022-08-01 - 2022-10-24 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-08-01 - 2022-10-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://rpdalmiaemporio.com/wp-includes/certificates/themes/web/
Frame ID: ABCA713082E81432074318CAF25AC7A9
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
index - homePage URL History Show full URLs
- http://anacetina.com/readme.php Page URL
-
http://rpdalmiaemporio.com/wp-includes/certificates/themes/web
HTTP 301
http://rpdalmiaemporio.com/wp-includes/certificates/themes/web/ Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://anacetina.com/readme.php Page URL
-
http://rpdalmiaemporio.com/wp-includes/certificates/themes/web
HTTP 301
http://rpdalmiaemporio.com/wp-includes/certificates/themes/web/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
readme.php
anacetina.com/ |
108 B 380 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
rpdalmiaemporio.com/wp-includes/certificates/themes/web/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
rpdalmiaemporio.com/wp-includes/certificates/themes/web/assets/bootstrap/css/ |
187 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.svg
rpdalmiaemporio.com/wp-includes/certificates/themes/web/assets/img/ |
22 KB 22 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
underlogin.png
rpdalmiaemporio.com/wp-includes/certificates/themes/web/assets/img/ |
75 KB 75 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-bg.jpg
rpdalmiaemporio.com/wp-includes/certificates/themes/web/assets/img/ |
490 KB 491 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ |
30 KB 30 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2
fonts.gstatic.com/s/montserrat/v25/ |
24 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNP Paribas (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
anacetina.com
fonts.googleapis.com
fonts.gstatic.com
rpdalmiaemporio.com
166.62.27.64
198.57.150.102
2a00:1450:4001:806::2003
2a00:1450:4001:813::200a
3c43b1e9548a9dfafc2ffa2b39597527212f38a643c8e5222bcfb682af370fbe
6162e99444d7864fc5dc0d43f924d9a8e56d9964987f14f3345fdb247ae20349
88f246e3938e92d4b1a93b93cf636c856a302f4ace772ef42591d877ee5ef5d5
88f2f32e046ea812a5607ebcc895f0bab1561cd09346e5f1b20f90fd813a6268
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
b3cd66080f16d0be6cf4c8fcf24709d0c7909c0ff4ea95ee49c84424dbf7f8b2
b961da7f0c3e3862616f580dc7b7ab95a8ce86508e7e2b8bef2b3c52d54fb5fb
cffe139366b3882387dddbd10d59e7d9aa29345793fdbf51ddde809ca6a0bec2
ec2914526d5fcd5d9895c04fdeb3a505f46141245f08c6641f03f002ecb6d9e0