urlscan.io logo urlscan.io
SecurityTrails logo

app.94-156-6-129.cprapid.com Open in urlscan Pro
94.156.6.129  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://wbze.de/ragusa-it
Effective URL: https://app.94-156-6-129.cprapid.com/ragusa/
Submission: On September 12 via api from US — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 4 countries across 4 domains to perform 10 HTTP transactions. The main IP is 94.156.6.129, located in Amsterdam, Netherlands and belongs to AS_DELIS, US. The main domain is app.94-156-6-129.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 11th 2023. Valid for: 3 months.
This is the only time app.94-156-6-129.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Agricola Popolare di Ragusa (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 109.71.253.25 44486 (SYNLINQ s...)
7 94.156.6.129 211252 (AS_DELIS)
1 193.41.84.72 15981 (CSEBO-NET)
2 2600:9000:206... 16509 (AMAZON-02)
10 3
Apex Domain
Subdomains		 Transfer
7 cprapid.com
app.94-156-6-129.cprapid.com
1 MB
2 bapr.it
www.bapr.it
791 KB
1 banking4you.it
www.banking4you.it
1 wbze.de
wbze.de
301 B
10 4
Domain Requested by
7 app.94-156-6-129.cprapid.com app.94-156-6-129.cprapid.com
2 www.bapr.it
1 www.banking4you.it app.94-156-6-129.cprapid.com
1 wbze.de 1 redirects
10 4

This site contains links to these domains. Also see Links.

Domain
un-pac-e-vinci.eurizoncapital.com
Subject Issuer Validity Valid
app.94-156-6-129.cprapid.com
cPanel, Inc. Certification Authority		 2023-09-11 -
2023-12-10		 3 months crt.sh
www.banking4you.it
DigiCert EV RSA CA G2		 2023-04-04 -
2024-04-30		 a year crt.sh
www.bapr.it
Amazon RSA 2048 M02		 2022-12-27 -
2024-01-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://app.94-156-6-129.cprapid.com/ragusa/
Frame ID: E2CDA324934A55D65901CCCF6C549990
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

PIB - Personal Internet Banking

Page URL History Show full URLs

  1. https://wbze.de/ragusa-it HTTP 302
    https://app.94-156-6-129.cprapid.com/ragusa/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

10
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

4
Countries

2034 kB
Transfer

2031 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://wbze.de/ragusa-it HTTP 302
    https://app.94-156-6-129.cprapid.com/ragusa/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
app.94-156-6-129.cprapid.com/ragusa/
Redirect Chain
  • https://wbze.de/ragusa-it
  • https://app.94-156-6-129.cprapid.com/ragusa/
91 KB
91 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://app.94-156-6-129.cprapid.com/ragusa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
94.156.6.129 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
Apache /
Resource Hash
b57910820c90d33dc14ce84621329d8a37c08786a858308478d7851b682defbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
it-IT,it;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Tue, 12 Sep 2023 11:18:05 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Connection
Keep-Alive
Content-Length
132
Content-Type
text/html; charset=utf-8
Date
Tue, 12 Sep 2023 11:18:05 GMT
Keep-Alive
timeout=5, max=100
Location
https://app.94-156-6-129.cprapid.com/ragusa/
Server
Apache/2.4.38 (Debian)
Vary
Accept
X-Powered-By
Express
styles.efb08ee55d4716b9f06f.css
app.94-156-6-129.cprapid.com/ragusa/index_files/ 		519 KB
519 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app.94-156-6-129.cprapid.com/ragusa/index_files/styles.efb08ee55d4716b9f06f.css
Requested by
Host: app.94-156-6-129.cprapid.com
URL: https://app.94-156-6-129.cprapid.com/ragusa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
94.156.6.129 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
Apache /
Resource Hash
dafc8e4428f8839c71b2aed2e0c16fc1202b07f8722b02af5cf525cb79648d76

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://app.94-156-6-129.cprapid.com/ragusa/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 12 Sep 2023 11:18:05 GMT
Last-Modified
Wed, 24 Aug 2022 18:11:44 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
531042
public-light-theme-header-logo.png
app.94-156-6-129.cprapid.com/ragusa/index_files/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app.94-156-6-129.cprapid.com/ragusa/index_files/public-light-theme-header-logo.png
Requested by
Host: app.94-156-6-129.cprapid.com
URL: https://app.94-156-6-129.cprapid.com/ragusa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
94.156.6.129 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
Apache /
Resource Hash
28116eebaac6133dc16346af3de0098d9839b392d9b458990c0e073090ca071d

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://app.94-156-6-129.cprapid.com/ragusa/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 12 Sep 2023 11:18:05 GMT
Last-Modified
Wed, 24 Aug 2022 18:11:44 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
10274
/
www.banking4you.it/apps/pib2/05036brand0/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.banking4you.it/apps/pib2/05036brand0/
Requested by
Host: app.94-156-6-129.cprapid.com
URL: https://app.94-156-6-129.cprapid.com/ragusa/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.41.84.72 , Italy, ASN15981 (CSEBO-NET, IT),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://app.94-156-6-129.cprapid.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers
loginBannerMobile1.png
www.bapr.it/wp-content/uploads/ 		609 KB
610 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bapr.it/wp-content/uploads/loginBannerMobile1.png
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:1000:6:41ef:ff00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
5efe3da3b1aff21ceff1298af1969b612d4a302cefc60a620716ba152e6dfb9c

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://app.94-156-6-129.cprapid.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 12 Sep 2023 11:13:30 GMT
Via
1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
Last-Modified
Fri, 05 Aug 2022 08:11:11 GMT
X-Amz-Cf-Pop
FRA56-C1
Age
276
ETag
"62ecd09f-9834b"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
max-age=2592000, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
623435
X-Amz-Cf-Id
dz7GWuQL0x3My5KTOc3ELG2oTn9Mb5xy3-x-mKt-T82i77c7ZkhkuQ==
Expires
Thu, 12 Oct 2023 11:13:30 GMT
LoginBannerMobile2.jpg
www.bapr.it/wp-content/uploads/ 		180 KB
181 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bapr.it/wp-content/uploads/LoginBannerMobile2.jpg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:1000:6:41ef:ff00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
adb3ba0cb6989aa9fc95c21251db80165a6a28bcd7bb8ff1e023af2f9aa203b6

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://app.94-156-6-129.cprapid.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 12 Sep 2023 11:13:30 GMT
Via
1.1 29d33c5cd70a6501fde7bc2dba557906.cloudfront.net (CloudFront)
Last-Modified
Thu, 19 May 2022 16:00:10 GMT
X-Amz-Cf-Pop
FRA56-C1
Age
276
ETag
"6286698a-2d050"
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Cache-Control
max-age=2592000, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
184400
X-Amz-Cf-Id
U3A-__UaEb_yaOU5DuDb_WeEdQ6TM2cRzWZC7nx7BVZKZQKq5tTesA==
Expires
Thu, 12 Oct 2023 11:13:30 GMT
public-light-theme-footer-logo.png
app.94-156-6-129.cprapid.com/ragusa/index_files/assets/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app.94-156-6-129.cprapid.com/ragusa/index_files/assets/public-light-theme-footer-logo.png
Requested by
Host: app.94-156-6-129.cprapid.com
URL: https://app.94-156-6-129.cprapid.com/ragusa/index_files/styles.efb08ee55d4716b9f06f.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
94.156.6.129 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://app.94-156-6-129.cprapid.com/ragusa/index_files/styles.efb08ee55d4716b9f06f.css
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 12 Sep 2023 11:18:06 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
Lato-Bold.89b618086a797a8be0f4.woff
app.94-156-6-129.cprapid.com/ragusa/index_files/ 		302 KB
303 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://app.94-156-6-129.cprapid.com/ragusa/index_files/Lato-Bold.89b618086a797a8be0f4.woff
Requested by
Host: app.94-156-6-129.cprapid.com
URL: https://app.94-156-6-129.cprapid.com/ragusa/index_files/styles.efb08ee55d4716b9f06f.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
94.156.6.129 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
Apache /
Resource Hash
0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e

Request headers

Referer
https://app.94-156-6-129.cprapid.com/ragusa/index_files/styles.efb08ee55d4716b9f06f.css
Origin
https://app.94-156-6-129.cprapid.com
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 12 Sep 2023 11:18:06 GMT
Last-Modified
Wed, 24 Aug 2022 18:16:04 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
309728
iconfont.970f44aa80e156c05b48.woff2
app.94-156-6-129.cprapid.com/ragusa/index_files/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://app.94-156-6-129.cprapid.com/ragusa/index_files/iconfont.970f44aa80e156c05b48.woff2?t=1659610353361
Requested by
Host: app.94-156-6-129.cprapid.com
URL: https://app.94-156-6-129.cprapid.com/ragusa/index_files/styles.efb08ee55d4716b9f06f.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
94.156.6.129 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
Apache /
Resource Hash
fec3e742b0e58731a919c2957f8845f2c2de64e3cfe6e99d82d91c4132e661d0

Request headers

Referer
https://app.94-156-6-129.cprapid.com/ragusa/index_files/styles.efb08ee55d4716b9f06f.css
Origin
https://app.94-156-6-129.cprapid.com
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 12 Sep 2023 11:18:06 GMT
Last-Modified
Wed, 24 Aug 2022 18:15:52 GMT
Server
Apache
Content-Type
font/woff2
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
18496
Lato-Regular.1d2ca94dfba6f8d87cfd.woff
app.94-156-6-129.cprapid.com/ragusa/index_files/ 		302 KB
302 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://app.94-156-6-129.cprapid.com/ragusa/index_files/Lato-Regular.1d2ca94dfba6f8d87cfd.woff
Requested by
Host: app.94-156-6-129.cprapid.com
URL: https://app.94-156-6-129.cprapid.com/ragusa/index_files/styles.efb08ee55d4716b9f06f.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
94.156.6.129 Amsterdam, Netherlands, ASN211252 (AS_DELIS, US),
Reverse DNS
Software
Apache /
Resource Hash
5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e

Request headers

Referer
https://app.94-156-6-129.cprapid.com/ragusa/index_files/styles.efb08ee55d4716b9f06f.css
Origin
https://app.94-156-6-129.cprapid.com
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 12 Sep 2023 11:18:06 GMT
Last-Modified
Wed, 24 Aug 2022 18:16:04 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
309192

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Agricola Popolare di Ragusa (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

2 Cookies

Domain/Path Name / Value
app.94-156-6-129.cprapid.com/ragusa Name: COOKIE_KEY
Value: 169451748594
www.bapr.it/ Name: AWSALBCORS
Value: rHmqTXpgMpWR/nl5VJxxopzuq65HgFACJ9zvDqGEM4LHpFulHhsFYacvmj1cBDkAf4EeEd6LA8Qr/RerQwliBGaiCyXSVgzAX4/mDEIO8f1mF4aoR7zkaN0vsFPq

1 Console Messages

Source Level URL
Text
network error URL: https://app.94-156-6-129.cprapid.com/ragusa/index_files/assets/public-light-theme-footer-logo.png
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)