www.federicanalesso.com Open in urlscan Pro
62.149.142.104 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Submission: On May 09 via automatic, source openphish (May 9th 2020, 12:47:19 pm UTC)

Summary HTTP 18 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 18 HTTP transactions. The main IP is 62.149.142.104, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.federicanalesso.com.

This is the only time www.federicanalesso.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Raiffeisen Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
15	62.149.142.104 62.149.142.104	31034 (ARUBA-ASN) (ARUBA-ASN)
1	2a00:1450:400... 2a00:1450:4001:825::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE)
18	3

15 62.149.142.104 (Arezzo, Italy)

ASN31034 (ARUBA-ASN, IT)
PTR: webx338.aruba.it

www.federicanalesso.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

translate.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	federicanalesso.com www.federicanalesso.com	2 MB
2	gstatic.com www.gstatic.com	3 KB
1	googleapis.com translate.googleapis.com	4 KB
18	3

	Domain	Requested by
15	www.federicanalesso.com	www.federicanalesso.com
2	www.gstatic.com	www.federicanalesso.com
1	translate.googleapis.com	www.federicanalesso.com
18	3

This site contains links to these domains. Also see Links.

Domain
raiffeisen.at

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Frame ID: EF25391ED674CF2B047D7C68870E82F1
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

18
Requests

17 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

2167 kB
Transfer

2178 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://raiffeisen.at/de/online-banking/login/hotline.html
Title: Hotline

Search URL Search Domain Scan URL

URL: https://raiffeisen.at/de/online-banking/login/faq.html
Title: Häufige Fragen (FAQ)

Search URL Search Domain Scan URL

URL: https://raiffeisen.at/de/online-banking/mein-elba/erklaervideos.html
Title: Demo

Search URL Search Domain Scan URL

URL: https://raiffeisen.at/de/online-banking/login/impressum.html
Title: Impressum

Search URL Search Domain Scan URL

URL: https://raiffeisen.at/de/online-banking/login/nutzungsbedingungen.html
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request sms.html Show response
www.federicanalesso.com/raif/index/identifier/verfueger/ 14 KB
15 KB 83ms
70ms Document
text/html 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash: 1deebddb9b79371224a5cb7d5a2efd2cb5c8853452bd223190fb84072e2ea65f

Request headers

Host: www.federicanalesso.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 09 May 2020 12:46:46 GMT
Server: Apache
Upgrade: h2
Connection: Upgrade, Keep-Alive
Last-Modified: Tue, 21 Apr 2020 18:57:41 GMT
ETag: "38f4-5a3d19717c747"
Accept-Ranges: bytes
Content-Length: 14580
Keep-Alive: timeout=5, max=100
Content-Type: text/html

GET
H/1.1 200
OK libs-551eb8c838.js Show response
www.federicanalesso.com/raif/index/identifier/verfueger/index_files/ 2 MB
2 MB 93ms
79ms Script
application/javascript 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/libs-551eb8c838.js
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash: 449fe5dbfeb0d9a83fb98f7602f07e920c73e38c98a2d6b7b9aa4d25295e6a06

Request headers

Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 09 May 2020 12:46:46 GMT
Last-Modified: Tue, 21 Apr 2020 18:57:41 GMT
Server: Apache
ETag: "18538f-5a3d19716e4c7"
Upgrade: h2
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 1594255

GET
H/1.1 200
OK scripts-c9262a7eb9.js Show response
www.federicanalesso.com/raif/index/identifier/verfueger/index_files/ 115 KB
115 KB 95ms
79ms Script
application/javascript 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/scripts-c9262a7eb9.js
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash: a3dffc2be04f3c3fd8c680eb6cc9291264373aa681e3a3c152673f9e2ea25a0f

Request headers

Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 09 May 2020 12:46:46 GMT
Last-Modified: Tue, 21 Apr 2020 18:57:41 GMT
Server: Apache
ETag: "1cc40-5a3d197173aa1"
Upgrade: h2
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 117824

GET
H/1.1 200
OK scripts-ea8df22a7e.js Show response
www.federicanalesso.com/raif/index/identifier/verfueger/index_files/ 115 KB
115 KB 93ms
77ms Script
application/javascript 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/scripts-ea8df22a7e.js
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash: 20cdb6d17a6d1628e655c44546bf932b96477abd695df6753ca5073d15476fe2

Request headers

Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 09 May 2020 12:46:46 GMT
Last-Modified: Tue, 21 Apr 2020 18:57:41 GMT
Server: Apache
ETag: "1cc40-5a3d197174dfe"
Upgrade: h2
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 117824

GET
H/1.1 200
OK bundles-metadata-0b0b603407.js Show response
www.federicanalesso.com/raif/index/identifier/verfueger/index_files/ 494 B
775 B 66ms
45ms Script
application/javascript 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/bundles-metadata-0b0b603407.js
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash: 121b297c530938613a52d58e2cb0a724f3bf0a8c0d305b8419e7283a17021c7f

Request headers

Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 09 May 2020 12:46:46 GMT
Last-Modified: Tue, 21 Apr 2020 18:57:41 GMT
Server: Apache
ETag: "1ee-5a3d197163516"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 494

GET
H/1.1 200
OK libs-f423ea7dec.css
www.federicanalesso.com/raif/index/identifier/verfueger/index_files/ 20 KB
20 KB 89ms
77ms Stylesheet
text/css 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/libs-f423ea7dec.css
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash: 1884298feb141aef339390c404abb38ffe06eef737a56c8c000e513ca975b272

Request headers

Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 09 May 2020 12:46:46 GMT
Last-Modified: Tue, 21 Apr 2020 18:57:41 GMT
Server: Apache
ETag: "50af-5a3d19716f056"
Upgrade: h2
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 20655

GET
H/1.1 200
OK rbg.css
www.federicanalesso.com/raif/index/identifier/verfueger/index_files/ 333 KB
334 KB 76ms
63ms Stylesheet
text/css 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/rbg.css
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash: 428c46a7f1a55ae7a0ba390c7d076f793627fa70fb2290bf02d8c84f4ec46260

Request headers

Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 09 May 2020 12:46:46 GMT
Last-Modified: Tue, 21 Apr 2020 18:57:41 GMT
Server: Apache
ETag: "53546-5a3d197172acb"
Upgrade: h2
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 341318

GET
H2 200 translateelement.css
translate.googleapis.com/translate_static/css/ 18 KB
4 KB 29ms
6ms Stylesheet
text/css 2a00:1450:4001:825::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.googleapis.com/translate_static/css/translateelement.css

Requested by

Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6149f95c1ebdde5391898e22a79821a810336f6bd74318291b4f49f23fbf0fa8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 09 May 2020 12:05:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2499
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3619
x-xss-protection: 0
last-modified: Wed, 12 Feb 2020 21:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sat, 09 May 2020 13:05:07 GMT

GET
H/1.1 200
OK logo.png
www.federicanalesso.com/raif/index/identifier/verfueger/index_files/ 2 KB
2 KB 50ms
50ms Image
image/png 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/logo.png
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash: 6c2ed8fc13478bb9f816a19ab2dc95ffd83846731d0aac687c907bcaf357a33b

Request headers

Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 09 May 2020 12:46:47 GMT
Last-Modified: Tue, 21 Apr 2020 18:57:41 GMT
Server: Apache
ETag: "7a7-5a3d19716f810"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1959

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/1x/ 825 B
946 B 6ms
5ms Image
image/png 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/1x/translate_24dp.png

Requested by

Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 05:40:14 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 111993
vary: Origin
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 825
x-xss-protection: 0
expires: Sat, 08 May 2021 05:40:14 GMT

GET
H/1.1 404
Not Found config Show response
www.federicanalesso.com/raif/index/identifier/kunde-login-ui-services/rest/meta/ 260 B
460 B 47ms
46ms XHR
text/html 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/kunde-login-ui-services/rest/meta/config
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/libs-551eb8c838.js
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash: d789d0930e127111e3c0eb4bf8011bf75dd92d09f6176e6520f84b658e665ab2

Request headers

Accept: */*
Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 09 May 2020 12:46:47 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 260
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe03bfd95a2d4e640ed7d04dcb08ef991c327a5ab6f6fdb9eb06e1efc76af30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://translate.googleapis.com/translate_static/css/translateelement.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 07:53:54 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 103973
vary: Origin
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1847
x-xss-protection: 0
expires: Sat, 08 May 2021 07:53:54 GMT

GET
H/1.1 404
Not Found OpenSans-Semibold.woff
www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/open-sans/Semibold/ 0
0 42ms
42ms Font
text/html 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/open-sans/Semibold/OpenSans-Semibold.woff?v=1.1.0
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/rbg.css
Origin: http://www.federicanalesso.com

Response headers

Date: Sat, 09 May 2020 12:46:47 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 284
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found OpenSans-Regular.woff
www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/open-sans/Regular/ 0
0 48ms
48ms Font
text/html 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/open-sans/Regular/OpenSans-Regular.woff?v=1.1.0
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/rbg.css
Origin: http://www.federicanalesso.com

Response headers

Date: Sat, 09 May 2020 12:46:47 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 282
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found drb-iconfont.woff
www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/drb-iconfont/ 0
0 46ms
46ms Font
text/html 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/drb-iconfont/drb-iconfont.woff?v=1.1.0
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/rbg.css
Origin: http://www.federicanalesso.com

Response headers

Date: Sat, 09 May 2020 12:46:47 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 273
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found OpenSans-Semibold.ttf
www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/open-sans/Semibold/ 0
0 51ms
49ms Font
text/html 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/open-sans/Semibold/OpenSans-Semibold.ttf?v=1.1.0
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/rbg.css
Origin: http://www.federicanalesso.com

Response headers

Date: Sat, 09 May 2020 12:46:47 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 283
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found drb-iconfont.ttf
www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/drb-iconfont/ 0
0 57ms
56ms Font
text/html 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/drb-iconfont/drb-iconfont.ttf?v=1.1.0
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/rbg.css
Origin: http://www.federicanalesso.com

Response headers

Date: Sat, 09 May 2020 12:46:47 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 272
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found OpenSans-Regular.ttf
www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/open-sans/Regular/ 0
0 49ms
48ms Font
text/html 62.149.142.104
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/assets/fonts/open-sans/Regular/OpenSans-Regular.ttf?v=1.1.0
Requested by: Host: www.federicanalesso.com
URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/sms.html
Protocol: HTTP/1.1
Server: 62.149.142.104 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx338.aruba.it
Software: Apache /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/rbg.css
Origin: http://www.federicanalesso.com

Response headers

Date: Sat, 09 May 2020 12:46:47 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 281
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Raiffeisen Bank (Banking)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: http://www.federicanalesso.com/raif/index/identifier/verfueger/index_files/libs-551eb8c838.js(Line 21) Message: error loading configuration: error <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /raif/index/identifier/kunde-login-ui-services/rest/meta/config was not found on this server.</p> </body></html>

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

translate.googleapis.com
www.federicanalesso.com
www.gstatic.com
2a00:1450:4001:819::2003
2a00:1450:4001:825::200a
62.149.142.104
121b297c530938613a52d58e2cb0a724f3bf0a8c0d305b8419e7283a17021c7f
1884298feb141aef339390c404abb38ffe06eef737a56c8c000e513ca975b272
1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213
1deebddb9b79371224a5cb7d5a2efd2cb5c8853452bd223190fb84072e2ea65f
20cdb6d17a6d1628e655c44546bf932b96477abd695df6753ca5073d15476fe2
428c46a7f1a55ae7a0ba390c7d076f793627fa70fb2290bf02d8c84f4ec46260
449fe5dbfeb0d9a83fb98f7602f07e920c73e38c98a2d6b7b9aa4d25295e6a06
5fe03bfd95a2d4e640ed7d04dcb08ef991c327a5ab6f6fdb9eb06e1efc76af30
6149f95c1ebdde5391898e22a79821a810336f6bd74318291b4f49f23fbf0fa8
6c2ed8fc13478bb9f816a19ab2dc95ffd83846731d0aac687c907bcaf357a33b
a3dffc2be04f3c3fd8c680eb6cc9291264373aa681e3a3c152673f9e2ea25a0f
d789d0930e127111e3c0eb4bf8011bf75dd92d09f6176e6520f84b658e665ab2

www.federicanalesso.com Open in urlscan Pro 62.149.142.104 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

18 Requests

17 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

2167 kBTransfer

2178 kBSize

0 Cookies

5 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

32 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.federicanalesso.com Open in urlscan Pro
62.149.142.104 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

17 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

2167 kB
Transfer

2178 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!