montearea.me
Open in
urlscan Pro
199.188.201.126
Malicious Activity!
Public Scan
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 15th 2021. Valid for: a year.
This is the only time montearea.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banca Monte dei Paschi (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 199.188.201.126 199.188.201.126 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
2 | 2606:4700::68... 2606:4700::6810:5514 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
8 | 4 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server281-5.web-hosting.com
montearea.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
montearea.me
montearea.me |
22 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net |
41 KB |
1 |
jquery.com
code.jquery.com |
83 KB |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
8 | 4 |
Domain | Requested by | |
---|---|---|
4 | montearea.me |
montearea.me
|
2 | cdn.jsdelivr.net |
montearea.me
|
1 | code.jquery.com |
montearea.me
|
1 | fonts.googleapis.com |
montearea.me
|
8 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
montearea.me Sectigo RSA Domain Validation Secure Server CA |
2021-06-15 - 2022-06-15 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-03 - 2021-08-03 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://montearea.me/accedi/
Frame ID: 3E6C6344C1C90085F07F6F67D6372A03
Requests: 8 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
LiteSpeed (Web Servers) Expand
Detected patterns
- headers server /^LiteSpeed$/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
montearea.me/accedi/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.0-beta1/dist/css/ |
150 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
19 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.0-beta1/dist/js/ |
79 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.js
code.jquery.com/ |
281 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
montearea.me/accedi/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
quest.png
montearea.me/accedi/ |
945 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
info.svg
montearea.me/accedi/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banca Monte dei Paschi (Banking)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated number| uidEvent object| bootstrap function| $ function| jQuery function| hideAll function| showAccediBox function| showAuthBox function| showMobileBox function| showUpsBox function| showWaiting function| startSending0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
code.jquery.com
fonts.googleapis.com
montearea.me
199.188.201.126
2001:4de0:ac18::1:a:2b
2606:4700::6810:5514
2a00:1450:4001:829::200a
0267260045096457f26914277f49eef5da5ec54ac6aee8579be4810332e518b6
0723be3bac2e41d6d7aa267af24f45a7240d74ead82a130765f83fc6fbf19723
170cd45b0c968102d58d946db3d4cd81845a07f9747360fdacd23a1f8b1ea357
2973075abc50eee4ac4cd33ebcd209ac22c4e529f29bc3bad618599864642350
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
886a0d1005f4d663e11473c81ea20b2b9d618372313df55223d2c571dffc5698
9d4a057df28dc13e3f5bee21800869d961bd1b042cee7eb4b71715e062d3abaf
c429476b25e64c3f762e9f5610df93dac59bab7c305077eab66daab72a1ecfed