accesso-portale-web.dedyn.io Open in urlscan Pro
179.61.246.217 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://certifica-ora.eu/online
Effective URL:
https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498...
Submission: On June 07 via api (June 7th 2023, 2:59:11 pm UTC) from US — Scanned from IT

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 16 HTTP transactions. The main IP is 179.61.246.217, located in Meppel, Netherlands and belongs to AS-HOSTINGER, CY. The main domain is accesso-portale-web.dedyn.io.
TLS certificate: Issued by R3 on June 7th 2023. Valid for: 3 months.

This is the only time accesso-portale-web.dedyn.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNP Paribas (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3031::ac43:a685	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:303... 2606:4700:3035::6815:3afc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 13	179.61.246.217 179.61.246.217	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:7daf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	104.21.20.107 104.21.20.107	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	6

1 2606:4700:3031::ac43:a685 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

certifica-ora.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:3afc (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

certifica-ora.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 179.61.246.217 (Meppel, Netherlands) 1 redirects

ASN47583 (AS-HOSTINGER, CY)

accesso-portale-web.dedyn.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7daf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.20.107 (None, )

ASN13335 (CLOUDFLARENET, US)

api.inetstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	dedyn.io 1 redirects accesso-portale-web.dedyn.io	222 KB
2	certifica-ora.eu 2 redirects certifica-ora.eu	1 KB
1	inetstatic.com api.inetstatic.com — Cisco Umbrella Rank: 681682	764 B
1	gstatic.com fonts.gstatic.com	43 KB
1	unpkg.com unpkg.com — Cisco Umbrella Rank: 1018	4 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 67	1 KB
16	6

	Domain	Requested by
13	accesso-portale-web.dedyn.io	1 redirects accesso-portale-web.dedyn.io
2	certifica-ora.eu	2 redirects
1	api.inetstatic.com	accesso-portale-web.dedyn.io
1	fonts.gstatic.com	fonts.googleapis.com
1	unpkg.com	accesso-portale-web.dedyn.io
1	fonts.googleapis.com	accesso-portale-web.dedyn.io
16	6

This site contains no links.

Subject Issuer	Validity	Valid
accesso-portale-web.dedyn.io R3	`2023-06-07` - `2023-09-05`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
*.inetstatic.com GTS CA 1P5	`2023-04-12` - `2023-07-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
Frame ID: F634A607C6BF9108D68F23BD9F9B596D
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://certifica-ora.eu/online HTTP 301
https://certifica-ora.eu/online HTTP 302
https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php HTTP 302
https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e4... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

71 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

270 kB
Transfer

966 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://certifica-ora.eu/online HTTP 301
https://certifica-ora.eu/online HTTP 302
https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php HTTP 302
https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request index.php Show response
accesso-portale-web.dedyn.io/it/web/portal/04/
Redirect Chain

http://certifica-ora.eu/online
https://certifica-ora.eu/online
https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php
https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e

135 KB
58 KB

186ms
186ms

Document
text/html

179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

d8a0a58629a77ba0eba32d36ea3859acc32ec6aef8a034092d8878158701cb21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: it-IT,it;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 07 Jun 2023 14:59:07 GMT
server: LiteSpeed
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3-34=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-27=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 07 Jun 2023 14:59:06 GMT
location: index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
server: LiteSpeed
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 99ms
39ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400italic,400,600,700

Requested by

Host: accesso-portale-web.dedyn.io
URL: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e92acc863cc429072c2b2bae2b8270823a14572741bbd480d1b77065c1473436

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
date: Wed, 07 Jun 2023 14:59:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Wed, 07 Jun 2023 14:59:07 GMT

GET
H2 200 7NexZCzjXOKp.css
accesso-portale-web.dedyn.io/it/web/portal/04/css/ 130 KB
20 KB 94ms
91ms Stylesheet
text/css 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/css/7NexZCzjXOKp.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

6edcec851d1526ca1140df9c66cf9db24457d22766bc2608d4b3f338d318d104

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Jun 2023 14:59:07 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 14 Sep 2022 02:13:04 GMT
server: LiteSpeed
etag: "20815-632138b0-baf2bdd967f54b00;br"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 20706
x-xss-protection: 1; mode=block
expires: Wed, 14 Jun 2023 14:59:07 GMT

GET
H2 200 I0IrPBWTRE1u.css
accesso-portale-web.dedyn.io/it/web/portal/04/css/ 28 KB
6 KB 97ms
94ms Stylesheet
text/css 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/css/I0IrPBWTRE1u.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

c828699ea890de830bf79ee3b1333d2710b29e2a94e7641874f0b81974d5d248

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Jun 2023 14:59:07 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 14 Sep 2022 02:13:04 GMT
server: LiteSpeed
etag: "7134-632138b0-9be32fe826944b09;br"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 6344
x-xss-protection: 1; mode=block
expires: Wed, 14 Jun 2023 14:59:07 GMT

GET
H2 200 wO3kq5OoEA51.css
accesso-portale-web.dedyn.io/it/web/portal/04/css/ 184 KB
30 KB 97ms
95ms Stylesheet
text/css 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/css/wO3kq5OoEA51.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

4b3b88479bb3e33355c926b62f13ad9152dd2a938c5d3dee7e603286f34c92a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Jun 2023 14:59:07 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 14 Sep 2022 02:13:04 GMT
server: LiteSpeed
etag: "2e16c-632138b0-7801beeae490986e;br"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 31114
x-xss-protection: 1; mode=block
expires: Wed, 14 Jun 2023 14:59:07 GMT

GET
H2 200 ROd7BCFhUPhK.css
accesso-portale-web.dedyn.io/it/web/portal/04/css/ 101 KB
16 KB 133ms
131ms Stylesheet
text/css 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/css/ROd7BCFhUPhK.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

9a464c19634738218499b9146ac50c14727982688c8965ee0cad0ec681e08e72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Jun 2023 14:59:07 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 14 Sep 2022 02:13:04 GMT
server: LiteSpeed
etag: "194fd-632138b0-5bcef7b8e208d241;br"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 16272
x-xss-protection: 1; mode=block
expires: Wed, 14 Jun 2023 14:59:07 GMT

GET
H2 200 7hufCzTCYWCu.js Show response
accesso-portale-web.dedyn.io/it/web/portal/04/js/ 88 KB
30 KB 134ms
132ms Script
application/x-javascript 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/js/7hufCzTCYWCu.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

aa12b3f6d556139df4a6fc9d7ba400595d27db35d21782d6735366c29eb690c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Jun 2023 14:59:07 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 14 Sep 2022 02:13:04 GMT
server: LiteSpeed
etag: "15f13-632138b0-5bfd473e3572e6e4;br"
vary: Accept-Encoding
content-type: application/x-javascript; charset=UTF-8
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 30549
x-xss-protection: 1; mode=block
expires: Wed, 14 Jun 2023 14:59:07 GMT

GET
H2 200 pure-min.css
unpkg.com/purecss@2.0.5/build/ 16 KB
4 KB 73ms
33ms Stylesheet
text/css 2606:4700::6810:7daf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/purecss@2.0.5/build/pure-min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d0b11cc95b046dabdab9a5bbe9c3035d2db1d7036e644acbb9e00b7c639f3f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Jun 2023 14:59:07 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 30181183
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01G67PW15P5J00F32MTZKGF6R2-cdg
server: cloudflare
etag: W/"4195-XLNKX4yxaMYG7+jslQdUA8knpHQ"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7d39c1d17c6ebadb-MXP

GET
H2 200 jquery-latest.min.js Show response
accesso-portale-web.dedyn.io/it/web/portal/04/ 84 KB
29 KB 136ms
134ms Script
application/x-javascript 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/jquery-latest.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Jun 2023 14:59:07 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 26 Jan 2021 12:41:20 GMT
server: LiteSpeed
etag: "14e4a-60100df0-394b4fa6bf3ae2fe;br"
vary: Accept-Encoding
content-type: application/x-javascript; charset=UTF-8
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 29167
x-xss-protection: 1; mode=block
expires: Wed, 14 Jun 2023 14:59:07 GMT

GET
H2 200 fo192ypnVeLP.js Show response
accesso-portale-web.dedyn.io/it/web/portal/04/js/ 87 KB
30 KB 142ms
140ms Script
application/x-javascript 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/js/fo192ypnVeLP.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Jun 2023 14:59:07 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 14 Sep 2022 02:13:04 GMT
server: LiteSpeed
etag: "15d84-632138b0-6cf59d36cc3b6376;br"
vary: Accept-Encoding
content-type: application/x-javascript; charset=UTF-8
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 30280
x-xss-protection: 1; mode=block
expires: Wed, 14 Jun 2023 14:59:07 GMT

GET
DATA 200
OK truncated
/ 44 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8346dc67d649ce22e339608189ffe427e6efa7cd5ea1be6833a1deedab91ea6d

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/jpeg

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
fonts.gstatic.com/s/opensans/v35/ 42 KB
43 KB 134ms
40ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400italic,400,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba3783050d8a2d02e1cdc8463b635dc21ac2a84da9ebd33bf362ed83ee53a2b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://accesso-portale-web.dedyn.io
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 03 Jun 2023 03:39:24 GMT
x-content-type-options: nosniff
age: 386383
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43120
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:11:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 02 Jun 2024 03:39:24 GMT

GET
DATA 200
OK truncated
/ 13 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: facbfbb9dc3df3ccaa2f3a25c3110095f936fe90bbf429791c514ba0e9cd8df3

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
H2 404 logo2.png
accesso-portale-web.dedyn.io/it/web/portal/04/ 1 KB
1 KB 61ms
61ms Image
text/html 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/logo2.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Wed, 07 Jun 2023 14:59:07 GMT
x-content-type-options: nosniff
server: LiteSpeed
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 1238
x-xss-protection: 1; mode=block

GET
H2 404 zKF7XvdNweOB.jpg
accesso-portale-web.dedyn.io/it/web/portal/04/images/ 1 KB
1 KB 64ms
62ms Image
text/html 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/images/zKF7XvdNweOB.jpg

Requested by

Host: accesso-portale-web.dedyn.io
URL: https://accesso-portale-web.dedyn.io/it/web/portal/04/css/wO3kq5OoEA51.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/css/wO3kq5OoEA51.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Wed, 07 Jun 2023 14:59:07 GMT
x-content-type-options: nosniff
server: LiteSpeed
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 1238
x-xss-protection: 1; mode=block

GET
H2 404 ejPSXQlPHIRo.woff
accesso-portale-web.dedyn.io/it/web/portal/04/fonts/ 0
0 58ms
58ms Font
text/html 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/fonts/ejPSXQlPHIRo.woff

Requested by

Host: accesso-portale-web.dedyn.io
URL: https://accesso-portale-web.dedyn.io/it/web/portal/04/css/wO3kq5OoEA51.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/css/wO3kq5OoEA51.css
Origin: https://accesso-portale-web.dedyn.io
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Wed, 07 Jun 2023 14:59:07 GMT
x-content-type-options: nosniff
server: LiteSpeed
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 1238
x-xss-protection: 1; mode=block

GET
H2 404 I2Wx2CoZfbwR.ttf
accesso-portale-web.dedyn.io/it/web/portal/04/fonts/ 0
0 42ms
41ms Font
text/html 179.61.246.217
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://accesso-portale-web.dedyn.io/it/web/portal/04/fonts/I2Wx2CoZfbwR.ttf

Requested by

Host: accesso-portale-web.dedyn.io
URL: https://accesso-portale-web.dedyn.io/it/web/portal/04/css/wO3kq5OoEA51.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

179.61.246.217 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://accesso-portale-web.dedyn.io/it/web/portal/04/css/wO3kq5OoEA51.css
Origin: https://accesso-portale-web.dedyn.io
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Wed, 07 Jun 2023 14:59:07 GMT
x-content-type-options: nosniff
server: LiteSpeed
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 1238
x-xss-protection: 1; mode=block

GET
H2 200 script.js Show response
api.inetstatic.com/tracking/ 205 B
764 B 138ms
87ms Script
text/html 104.21.20.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.inetstatic.com/tracking/script.js?referrer=https://accesso-portale-web.dedyn.io/it/web/portal/04/index.php?siccura=b6a800fb955ea7c8966945b7477e84ee8ccf6e0e47773&vox=aaae22fa498cb48f480ba61ebd7d1f056e8a243e
Requested by: Host: accesso-portale-web.dedyn.io
URL: https://accesso-portale-web.dedyn.io/it/web/portal/04/js/7hufCzTCYWCu.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.20.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.21
Resource Hash: 70c44b4ff69e696f5c1a9cbbbea06cb648720ba20dc04d2e15aa1de7bb4a321c

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://accesso-portale-web.dedyn.io/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Jun 2023 14:59:08 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.2.21
vary: Accept-Encoding
access-control-allow-methods: GET, POST
content-type: text/html; charset=utf-8
access-control-allow-origin: https://accesso-portale-web.dedyn.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KxuYda0mGLyDt288it1GdM1rA055zBihy6BEIzddY77LQSq%2B6bUd6%2Bmm%2B7TP%2BbkAI1nbh466oRv%2BoGG1wrhDEDWXm9dU1qLtqOfj3zRCccph5zD2ia1EpdsjNz8AbESlMjPq8Ys%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 7d39c1d92d5483ac-MXP
access-control-allow-headers: X-Requested-With,content-type
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNP Paribas (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			accesso-portale-web.dedyn.io/it/web/portal/04	1970-01-20 21:58:29	Name: COOKIE_KEY Value: 168614994736
			accesso-portale-web.dedyn.io/it/web/portal/04	1970-01-20 12:23:09	Name: PHPREFS Value: full

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://accesso-portale-web.dedyn.io/it/web/portal/04/logo2.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://accesso-portale-web.dedyn.io/it/web/portal/04/fonts/ejPSXQlPHIRo.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://accesso-portale-web.dedyn.io/it/web/portal/04/images/zKF7XvdNweOB.jpg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://accesso-portale-web.dedyn.io/it/web/portal/04/fonts/I2Wx2CoZfbwR.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accesso-portale-web.dedyn.io
api.inetstatic.com
certifica-ora.eu
fonts.googleapis.com
fonts.gstatic.com
unpkg.com
104.21.20.107
179.61.246.217
2606:4700:3031::ac43:a685
2606:4700:3035::6815:3afc
2606:4700::6810:7daf
2a00:1450:4001:80f::2003
2a00:1450:4001:831::200a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2d0b11cc95b046dabdab9a5bbe9c3035d2db1d7036e644acbb9e00b7c639f3f6
4b3b88479bb3e33355c926b62f13ad9152dd2a938c5d3dee7e603286f34c92a7
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
6edcec851d1526ca1140df9c66cf9db24457d22766bc2608d4b3f338d318d104
70c44b4ff69e696f5c1a9cbbbea06cb648720ba20dc04d2e15aa1de7bb4a321c
8346dc67d649ce22e339608189ffe427e6efa7cd5ea1be6833a1deedab91ea6d
9a464c19634738218499b9146ac50c14727982688c8965ee0cad0ec681e08e72
aa12b3f6d556139df4a6fc9d7ba400595d27db35d21782d6735366c29eb690c5
ba3783050d8a2d02e1cdc8463b635dc21ac2a84da9ebd33bf362ed83ee53a2b5
c828699ea890de830bf79ee3b1333d2710b29e2a94e7641874f0b81974d5d248
d8a0a58629a77ba0eba32d36ea3859acc32ec6aef8a034092d8878158701cb21
e92acc863cc429072c2b2bae2b8270823a14572741bbd480d1b77065c1473436
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
facbfbb9dc3df3ccaa2f3a25c3110095f936fe90bbf429791c514ba0e9cd8df3

accesso-portale-web.dedyn.io Open in urlscan Pro 179.61.246.217 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

71 %IPv6

6 Domains

6 Subdomains

6 IPs

4 Countries

270 kBTransfer

966 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

2 Cookies

4 Console Messages

Security Headers

Indicators

accesso-portale-web.dedyn.io Open in urlscan Pro
179.61.246.217 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

71 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

270 kB
Transfer

966 kB
Size

2
Cookies

16 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!