urlscan.io logo urlscan.io
SecurityTrails logo

consumocliente.azurewebsites.net Open in urlscan Pro
20.105.216.20  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://tarzanwetnwild.com/gallery/about.html
Effective URL: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Submission Tags: falconsandbox
Submission: On September 20 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 11 HTTP transactions. The main IP is 20.105.216.20, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is consumocliente.azurewebsites.net.
TLS certificate: Issued by Microsoft Azure TLS Issuing CA 02 on March 10th 2023. Valid for: a year.
This is the only time consumocliente.azurewebsites.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BRT S.p.A (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 2a02:4780:11:... 47583 (AS-HOSTINGER)
2 9 20.105.216.20 8075 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
11 5
1    2a02:4780:11:978:0:3650:5165:10 (Mumbai, India)

ASN47583 (AS-HOSTINGER, CY)
tarzanwetnwild.com
9    20.105.216.20 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
consumocliente.azurewebsites.net
1    2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700:4400::ac40:9242 (United States)

ASN13335 (CLOUDFLARENET, US)
www.brt.it
1    2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
9 azurewebsites.net
consumocliente.azurewebsites.net
371 KB
1 gstatic.com
fonts.gstatic.com
46 KB
1 brt.it
www.brt.it
339 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 113
1 KB
1 tarzanwetnwild.com
tarzanwetnwild.com
503 B
11 5
Domain Requested by
9 consumocliente.azurewebsites.net 2 redirects consumocliente.azurewebsites.net
1 fonts.gstatic.com fonts.googleapis.com
1 www.brt.it consumocliente.azurewebsites.net
1 fonts.googleapis.com consumocliente.azurewebsites.net
1 tarzanwetnwild.com
11 5

This site contains no links.

Subject Issuer Validity Valid
tarzanwetnwild.com
R3		 2023-09-17 -
2023-12-16		 3 months crt.sh
*.azurewebsites.net
Microsoft Azure TLS Issuing CA 02		 2023-03-10 -
2024-03-04		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-09-04 -
2023-11-27		 3 months crt.sh
*.brt.it
GeoTrust TLS RSA CA G1		 2023-06-26 -
2024-07-24		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-09-04 -
2023-11-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Frame ID: 4F5B1D8071FD2A2FF14252B4E89EAAD3
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://tarzanwetnwild.com/gallery/about.html Page URL
  2. https://consumocliente.azurewebsites.net/ HTTP 302
    https://consumocliente.azurewebsites.net/post/index.php HTTP 302
    https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

11
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

757 kB
Transfer

761 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://tarzanwetnwild.com/gallery/about.html Page URL
  2. https://consumocliente.azurewebsites.net/ HTTP 302
    https://consumocliente.azurewebsites.net/post/index.php HTTP 302
    https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
about.html
tarzanwetnwild.com/gallery/ 		185 B
503 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tarzanwetnwild.com/gallery/about.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:4780:11:978:0:3650:5165:10 Mumbai, India, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
8aa21f01c7f3074ae31b2172f8960e6c3c2a1e018fc1b8e74130bbfa1745d854
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
185
content-security-policy
upgrade-insecure-requests
content-type
text/html
date
Wed, 20 Sep 2023 09:24:16 GMT
etag
"b9-650ab600-8a3f13592934d991;;;"
last-modified
Wed, 20 Sep 2023 09:06:08 GMT
platform
hostinger
server
LiteSpeed
Primary Request 650aba4070bf1-71996.php
consumocliente.azurewebsites.net/post/
Redirect Chain
  • https://consumocliente.azurewebsites.net/
  • https://consumocliente.azurewebsites.net/post/index.php
  • https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
8 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.105.216.20 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.24.0 / PHP/8.0.29
Resource Hash
0d71036fb30272e55dabaa304d9962b5742271bf8b237f721add114c3ae2ff57

Request headers

Referer
https://tarzanwetnwild.com/gallery/about.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Wed, 20 Sep 2023 09:24:16 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx/1.24.0
Transfer-Encoding
chunked
X-Powered-By
PHP/8.0.29

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Content-Length
0
Content-Type
text/html; charset=utf-8
Date
Wed, 20 Sep 2023 09:24:16 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Location
650aba4070bf1-71996.php
Pragma
no-cache
Server
nginx/1.24.0
X-Powered-By
PHP/8.0.29
css2
fonts.googleapis.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Almarai&family=Raleway&display=swap
Requested by
Host: consumocliente.azurewebsites.net
URL: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
92c2d89ea6c08e505449442788f3325ed76022dd7f6b73ccede536bb77ffd706
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://consumocliente.azurewebsites.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 20 Sep 2023 09:24:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 20 Sep 2023 09:24:16 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 20 Sep 2023 09:24:16 GMT
style.css
consumocliente.azurewebsites.net/post/res/css/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://consumocliente.azurewebsites.net/post/res/css/style.css
Requested by
Host: consumocliente.azurewebsites.net
URL: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.105.216.20 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
b546c3a69e8ff1b4b9c3fb67c0da55f98fbbc0ebd32025c60dd1aebdb2faa3e7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 09:24:16 GMT
Last-Modified
Wed, 20 Sep 2023 07:06:45 GMT
Server
nginx/1.24.0
Accept-Ranges
bytes
ETag
"650a9a05-c76"
Content-Length
3190
Content-Type
text/css
BRT_logo_cropped.png
www.brt.it/wp-content/uploads/sites/275/2021/07/ 		338 KB
339 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.brt.it/wp-content/uploads/sites/275/2021/07/BRT_logo_cropped.png
Requested by
Host: consumocliente.azurewebsites.net
URL: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9242 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b8bcb8f77668bec2cdf00ed339c7d544ae3ffe477f81a9db2ea8a35c83a9d3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://consumocliente.azurewebsites.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 09:24:16 GMT
strict-transport-security
max-age=31536000; includeSubdomains
x-content-type-options
nosniff
cf-cache-status
HIT
age
8531
cf-polished
status=input_too_large
content-length
346310
x-xss-protection
1; mode=block
cms-200
TRUE
cf-bgj
imgq:100,h2pri
last-modified
Wed, 28 Jul 2021 15:02:37 GMT
server
cloudflare
etag
"548c6-5c83046f1c1fc"
vary
User-Agent, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=2678400, s-maxage=200
accept-ranges
bytes
cf-ray
809903b519d73a64-FRA
expires
Sat, 21 Oct 2023 07:02:05 GMT
search.png
consumocliente.azurewebsites.net/post/res/img/ 		661 B
875 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://consumocliente.azurewebsites.net/post/res/img/search.png
Requested by
Host: consumocliente.azurewebsites.net
URL: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.105.216.20 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
f6b4fc3a20dd4afa3188f3e46132fbf05b260fea7138dc9f292092f4d578aa1b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 09:24:16 GMT
Last-Modified
Wed, 20 Sep 2023 07:06:52 GMT
Server
nginx/1.24.0
Accept-Ranges
bytes
ETag
"650a9a0c-295"
Content-Length
661
Content-Type
image/png
loader.gif
consumocliente.azurewebsites.net/post/res/img/ 		40 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://consumocliente.azurewebsites.net/post/res/img/loader.gif
Requested by
Host: consumocliente.azurewebsites.net
URL: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.105.216.20 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
b360359ffe7d46d32329b6a454b0540e6d34bd444a6f9ecface6663e1cb98aba

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 09:24:16 GMT
Last-Modified
Wed, 20 Sep 2023 07:06:51 GMT
Server
nginx/1.24.0
Accept-Ranges
bytes
ETag
"650a9a0b-9ffd"
Content-Length
40957
Content-Type
image/gif
vbvmcs.png
consumocliente.azurewebsites.net/post/res/img/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://consumocliente.azurewebsites.net/post/res/img/vbvmcs.png
Requested by
Host: consumocliente.azurewebsites.net
URL: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.105.216.20 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
022920b873a68b6421753a0004b8e7ebc8127391be76d1a73a93d7d061fb873b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 09:24:16 GMT
Last-Modified
Wed, 20 Sep 2023 07:06:54 GMT
Server
nginx/1.24.0
Accept-Ranges
bytes
ETag
"650a9a0e-3414"
Content-Length
13332
Content-Type
image/png
jq.js
consumocliente.azurewebsites.net/post/res/cdns/ 		287 KB
287 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://consumocliente.azurewebsites.net/post/res/cdns/jq.js
Requested by
Host: consumocliente.azurewebsites.net
URL: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.105.216.20 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 09:24:16 GMT
Last-Modified
Wed, 20 Sep 2023 07:06:38 GMT
Server
nginx/1.24.0
Accept-Ranges
bytes
ETag
"650a99fe-47b27"
Content-Length
293671
Content-Type
application/javascript
m.js
consumocliente.azurewebsites.net/post/res/cdns/ 		23 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://consumocliente.azurewebsites.net/post/res/cdns/m.js
Requested by
Host: consumocliente.azurewebsites.net
URL: https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.105.216.20 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://consumocliente.azurewebsites.net/post/650aba4070bf1-71996.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 09:24:16 GMT
Last-Modified
Wed, 20 Sep 2023 07:06:38 GMT
Server
nginx/1.24.0
Accept-Ranges
bytes
ETag
"650a99fe-5a88"
Content-Length
23176
Content-Type
application/javascript
tsstApxBaigK_hnnQ1iFow.woff2
fonts.gstatic.com/s/almarai/v12/ 		46 KB
46 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/almarai/v12/tsstApxBaigK_hnnQ1iFow.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Almarai&family=Raleway&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2a6bda3553569fc700de73f81edc96180d144db1e05a702bc9854dbe14961c5e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://consumocliente.azurewebsites.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Sat, 16 Sep 2023 21:24:14 GMT
x-content-type-options
nosniff
age
302402
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
46804
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:10:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 15 Sep 2024 21:24:14 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BRT S.p.A (Transportation)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery number| seconds undefined| allowSubmit boolean| abortVal function| validate number| tries number| max_tries function| sendOtp function| doPay function| showPayment

1 Cookies

Domain/Path Name / Value
consumocliente.azurewebsites.net/ Name: PHPSESSID
Value: 744cc05fc5d78dbffffd89c58354e798

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests