www.controllotransazioni.com
Open in
urlscan Pro
198.54.115.150
Malicious Activity!
Public Scan
Submission: On March 30 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 30th 2022. Valid for: a year.
This is the only time www.controllotransazioni.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banca Monte dei Paschi (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 198.54.115.150 198.54.115.150 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
2 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
8 | 4 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server210-3.web-hosting.com
www.controllotransazioni.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
controllotransazioni.com
www.controllotransazioni.com |
22 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 431 |
46 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 652 |
83 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 45 |
2 KB |
8 | 4 |
Domain | Requested by | |
---|---|---|
4 | www.controllotransazioni.com |
www.controllotransazioni.com
|
2 | cdn.jsdelivr.net |
www.controllotransazioni.com
|
1 | code.jquery.com |
www.controllotransazioni.com
|
1 | fonts.googleapis.com |
www.controllotransazioni.com
|
8 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
controllotransazioni.com Sectigo RSA Domain Validation Secure Server CA |
2022-03-30 - 2023-03-30 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-03 - 2022-07-02 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-03-17 - 2022-06-09 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.controllotransazioni.com/
Frame ID: E730124DD61BCA81963833F33C0ACF76
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Βаncа МРЅDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.controllotransazioni.com/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.0-beta1/dist/css/ |
150 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
19 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.0-beta1/dist/js/ |
79 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.js
code.jquery.com/ |
281 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
www.controllotransazioni.com/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
quest.png
www.controllotransazioni.com/ |
945 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
info.svg
www.controllotransazioni.com/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banca Monte dei Paschi (Banking)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails number| uidEvent object| bootstrap function| $ function| jQuery function| hideAll function| showAccediBox function| showAuthBox function| showMobileBox function| showUpsBox function| showWaiting function| startSending0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
code.jquery.com
fonts.googleapis.com
www.controllotransazioni.com
198.54.115.150
2001:4de0:ac18::1:a:3a
2606:4700::6810:5814
2a00:1450:4001:811::200a
0267260045096457f26914277f49eef5da5ec54ac6aee8579be4810332e518b6
0723be3bac2e41d6d7aa267af24f45a7240d74ead82a130765f83fc6fbf19723
10a24113b42783555f9bd095d73f2574b2d8d1708988f0d22d3eb46dc8638b20
170cd45b0c968102d58d946db3d4cd81845a07f9747360fdacd23a1f8b1ea357
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
886a0d1005f4d663e11473c81ea20b2b9d618372313df55223d2c571dffc5698
9d4a057df28dc13e3f5bee21800869d961bd1b042cee7eb4b71715e062d3abaf
c429476b25e64c3f762e9f5610df93dac59bab7c305077eab66daab72a1ecfed