login.register.it.anagroup.net Open in urlscan Pro
2400:b800:5::39 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://login.register.it.anagroup.net/
Effective URL:
https://login.register.it.anagroup.net/?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query5=4739&query6=7596&q...
Submission: On August 24 via manual (August 24th 2020, 7:21:13 am UTC) from IT

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 17 HTTP transactions. The main IP is 2400:b800:5::39, located in Australia and belongs to SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU. The main domain is login.register.it.anagroup.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 14th 2020. Valid for: 3 months.

This is the only time login.register.it.anagroup.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Register.it (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 3	2400:b800:5::39 2400:b800:5::39	45638 (SYNERGYWH...) (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD)
9	81.88.58.193 81.88.58.193	39729 (REGISTER-AS) (REGISTER-AS)
3	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
17	5

3 2400:b800:5::39 (Australia) 1 redirects

ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU)

login.register.it.anagroup.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 81.88.58.193 (Italy)

ASN39729 (REGISTER-AS, IT)

www.register.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
controlpanel.register.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

netdna.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	register.it www.register.it controlpanel.register.it	82 KB
3	gstatic.com fonts.gstatic.com	47 KB
3	anagroup.net 1 redirects login.register.it.anagroup.net	9 KB
1	bootstrapcdn.com netdna.bootstrapcdn.com	76 KB
17	4

	Domain	Requested by
7	www.register.it	login.register.it.anagroup.net
3	fonts.gstatic.com	login.register.it.anagroup.net
3	login.register.it.anagroup.net	1 redirects login.register.it.anagroup.net
2	controlpanel.register.it	login.register.it.anagroup.net
1	netdna.bootstrapcdn.com	login.register.it.anagroup.net
17	5

This site contains no links.

Subject Issuer	Validity	Valid
login.register.it.anagroup.net cPanel, Inc. Certification Authority	`2020-08-14` - `2020-11-12`	3 months	crt.sh
www.register.it Thawte EV RSA CA 2018	`2019-10-24` - `2021-12-22`	2 years	crt.sh
controlpanel.register.it Thawte EV RSA CA 2018	`2019-10-24` - `2021-12-22`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login.register.it.anagroup.net/?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query5=4739&query6=7596&query7=8729&query8=7576&query9=4842&query10=4124&query11=8940&query12=3656&query13=7190&query14=5284&query15=5862&query16=2776&query17=9786&query18=4862&query19=4941&query20=3394&query21=1703&query22=1592&query23=2027&query24=1748&query25=5544&query26=7131&query27=7323&query28=5534&query29=6856&query30=1923&query31=4421&query32=5943&query33=9371&query34=9561&query35=9580&query36=1136&query37=1577&query38=9741&query39=5292&query40=8112&query41=6311&query42=8715&query43=7470&query44=5459&query45=7305&query46=5009&query47=7497&query48=6887&query49=9826
Frame ID: 7F3A09CFC10FCC82F15D498D1A1B8137
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://login.register.it.anagroup.net/ HTTP 302
https://login.register.it.anagroup.net/?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query... Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

17
Requests

88 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

5
IPs

4
Countries

213 kB
Transfer

245 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://login.register.it.anagroup.net/ HTTP 302
https://login.register.it.anagroup.net/?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query5=4739&query6=7596&query7=8729&query8=7576&query9=4842&query10=4124&query11=8940&query12=3656&query13=7190&query14=5284&query15=5862&query16=2776&query17=9786&query18=4862&query19=4941&query20=3394&query21=1703&query22=1592&query23=2027&query24=1748&query25=5544&query26=7131&query27=7323&query28=5534&query29=6856&query30=1923&query31=4421&query32=5943&query33=9371&query34=9561&query35=9580&query36=1136&query37=1577&query38=9741&query39=5292&query40=8112&query41=6311&query42=8715&query43=7470&query44=5459&query45=7305&query46=5009&query47=7497&query48=6887&query49=9826 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
login.register.it.anagroup.net/
Redirect Chain

https://login.register.it.anagroup.net/
https://login.register.it.anagroup.net/?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query5=4739&query6=7596&query7=8729&query8=7576&query9=4842&query10=4124&query11=8940&q...

11 KB
3 KB

636ms
334ms

Document
text/html

2400:b800:5::39
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.register.it.anagroup.net/?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query5=4739&query6=7596&query7=8729&query8=7576&query9=4842&query10=4124&query11=8940&query12=3656&query13=7190&query14=5284&query15=5862&query16=2776&query17=9786&query18=4862&query19=4941&query20=3394&query21=1703&query22=1592&query23=2027&query24=1748&query25=5544&query26=7131&query27=7323&query28=5534&query29=6856&query30=1923&query31=4421&query32=5943&query33=9371&query34=9561&query35=9580&query36=1136&query37=1577&query38=9741&query39=5292&query40=8112&query41=6311&query42=8715&query43=7470&query44=5459&query45=7305&query46=5009&query47=7497&query48=6887&query49=9826
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2400:b800:5::39 , Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS
Software: LiteSpeed / PHP/7.3.21
Resource Hash: 0b4c7ffc6544cdbdebc05bb6dcd88cf88c3b0b3bcb40b6b81c7b97e0feb0e337

Request headers

:method: GET
:authority: login.register.it.anagroup.net
:scheme: https
:path: /?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query5=4739&query6=7596&query7=8729&query8=7576&query9=4842&query10=4124&query11=8940&query12=3656&query13=7190&query14=5284&query15=5862&query16=2776&query17=9786&query18=4862&query19=4941&query20=3394&query21=1703&query22=1592&query23=2027&query24=1748&query25=5544&query26=7131&query27=7323&query28=5534&query29=6856&query30=1923&query31=4421&query32=5943&query33=9371&query34=9561&query35=9580&query36=1136&query37=1577&query38=9741&query39=5292&query40=8112&query41=6311&query42=8715&query43=7470&query44=5459&query45=7305&query46=5009&query47=7497&query48=6887&query49=9826
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
x-powered-by: PHP/7.3.21
content-type: text/html; charset=UTF-8
content-length: 2777
content-encoding: br
vary: Accept-Encoding
date: Mon, 24 Aug 2020 07:20:56 GMT
server: LiteSpeed

Redirect headers

status: 302
x-powered-by: PHP/7.3.21
location: ?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query5=4739&query6=7596&query7=8729&query8=7576&query9=4842&query10=4124&query11=8940&query12=3656&query13=7190&query14=5284&query15=5862&query16=2776&query17=9786&query18=4862&query19=4941&query20=3394&query21=1703&query22=1592&query23=2027&query24=1748&query25=5544&query26=7131&query27=7323&query28=5534&query29=6856&query30=1923&query31=4421&query32=5943&query33=9371&query34=9561&query35=9580&query36=1136&query37=1577&query38=9741&query39=5292&query40=8112&query41=6311&query42=8715&query43=7470&query44=5459&query45=7305&query46=5009&query47=7497&query48=6887&query49=9826
content-type: text/html; charset=UTF-8
content-encoding: br
vary: Accept-Encoding
date: Mon, 24 Aug 2020 07:20:56 GMT
server: LiteSpeed
cache-control: no-cache, no-store, must-revalidate, max-age=0
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000

GET
H/2+Q/46 200 style.css
login.register.it.anagroup.net/css/ 35 KB
5 KB 304ms
304ms Stylesheet
text/css 2400:b800:5::39
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.register.it.anagroup.net/css/style.css
Requested by: Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query5=4739&query6=7596&query7=8729&query8=7576&query9=4842&query10=4124&query11=8940&query12=3656&query13=7190&query14=5284&query15=5862&query16=2776&query17=9786&query18=4862&query19=4941&query20=3394&query21=1703&query22=1592&query23=2027&query24=1748&query25=5544&query26=7131&query27=7323&query28=5534&query29=6856&query30=1923&query31=4421&query32=5943&query33=9371&query34=9561&query35=9580&query36=1136&query37=1577&query38=9741&query39=5292&query40=8112&query41=6311&query42=8715&query43=7470&query44=5459&query45=7305&query46=5009&query47=7497&query48=6887&query49=9826
Protocol: HTTP/2+QUIC/46
Security: QUIC, , AES_128_GCM
Server: 2400:b800:5::39 , Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: d7d6a8ebb176119775ea6f32fbc7a181c6ffcc2dc920c99a88b2a492eab2fcc6

Request headers

Referer: https://login.register.it.anagroup.net/?gets=true&query0=2217&query1=7497&query2=3517&query3=7195&query4=4793&query5=4739&query6=7596&query7=8729&query8=7576&query9=4842&query10=4124&query11=8940&query12=3656&query13=7190&query14=5284&query15=5862&query16=2776&query17=9786&query18=4862&query19=4941&query20=3394&query21=1703&query22=1592&query23=2027&query24=1748&query25=5544&query26=7131&query27=7323&query28=5534&query29=6856&query30=1923&query31=4421&query32=5943&query33=9371&query34=9561&query35=9580&query36=1136&query37=1577&query38=9741&query39=5292&query40=8112&query41=6311&query42=8715&query43=7470&query44=5459&query45=7305&query46=5009&query47=7497&query48=6887&query49=9826
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 07:20:57 GMT
content-encoding: br
last-modified: Thu, 13 Aug 2020 16:33:56 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 5292
expires: Mon, 31 Aug 2020 07:20:57 GMT

GET
H/1.1 200
OK back-all-light.png
www.register.it/_img/header/ 3 KB
4 KB 182ms
35ms Image
image/png 81.88.58.193
REGISTER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.register.it/_img/header/back-all-light.png

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

81.88.58.193 , Italy, ASN39729 (REGISTER-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

8761ee755465fca3947f792fade09cbb6524765c7726559b4caef9e2a71c8af6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000;
Last-Modified: Fri, 17 Apr 2020 07:33:43 GMT
Server: Apache
ETag: "6aafea91-c7e-5a377919d63c0"
Vary: X-Forwarded-Proto
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/png
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Accept-Ranges: bytes, bytes
Content-Length: 3198
Date: Mon, 24 Aug 2020 07:20:57 GMT

GET
H/1.1 200
OK register.it_logo.png
www.register.it/_img/header/ 1 KB
2 KB 182ms
35ms Image
image/png 81.88.58.193
REGISTER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.register.it/_img/header/register.it_logo.png

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

81.88.58.193 , Italy, ASN39729 (REGISTER-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

3de0381e6599a1f075d7560a0044700ed4a98d2fb2f8c28f6a126cb123445e9e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000;
Last-Modified: Tue, 07 May 2019 08:18:05 GMT
Server: Apache
ETag: "6fb7695a-40d-58847db36b4e1"
Vary: X-Forwarded-Proto
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/png
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Accept-Ranges: bytes, bytes
Content-Length: 1037
Date: Mon, 24 Aug 2020 07:20:57 GMT

GET
H/1.1 200
OK topnav-icon-blog.png
www.register.it/_img/header/topnav-icon/ 332 B
952 B 187ms
37ms Image
image/png 81.88.58.193
REGISTER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.register.it/_img/header/topnav-icon/topnav-icon-blog.png

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

81.88.58.193 , Italy, ASN39729 (REGISTER-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

82792c8f0a04ed05d3adc0871584c1236a9f016708909f84f327ed124237ea45

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000;
Last-Modified: Fri, 17 Apr 2020 07:33:42 GMT
Server: Apache
ETag: "6c956e1d-14c-5a377918e2180"
Vary: X-Forwarded-Proto
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/png
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Accept-Ranges: bytes, bytes
Content-Length: 332
Date: Mon, 24 Aug 2020 07:20:57 GMT

GET
H/1.1 200
OK icons.png
www.register.it/_img/header/ 2 KB
3 KB 188ms
37ms Image
image/png 81.88.58.193
REGISTER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.register.it/_img/header/icons.png

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

81.88.58.193 , Italy, ASN39729 (REGISTER-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

338bdf9c4446455369ed41fbcbee7cdb1944b938225e7b5600cd79d689b4e167

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000;
Last-Modified: Fri, 17 Apr 2020 07:33:43 GMT
Server: Apache
ETag: "6aafea90-99e-5a377919d63c0"
Vary: X-Forwarded-Proto
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/png
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Accept-Ranges: bytes, bytes
Content-Length: 2462
Date: Mon, 24 Aug 2020 07:20:57 GMT

GET
H/1.1 200
OK arrows.png
www.register.it/_img/header/ 246 B
865 B 188ms
38ms Image
image/png 81.88.58.193
REGISTER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.register.it/_img/header/arrows.png

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

81.88.58.193 , Italy, ASN39729 (REGISTER-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

28e56b80ff8f737648c27d108b8d66375c59d41dc99fbe04c4f1e8a28d56281d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000;
Last-Modified: Fri, 17 Apr 2020 07:33:42 GMT
Server: Apache
ETag: "6b60f214-f6-5a377918e2180"
Vary: X-Forwarded-Proto
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/png
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Accept-Ranges: bytes, bytes
Content-Length: 246
Date: Mon, 24 Aug 2020 07:20:57 GMT

GET
H/1.1 200
OK welcome.jpg
controlpanel.register.it/static/img/ 65 KB
65 KB 220ms
61ms Image
image/jpeg 81.88.58.193
REGISTER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.register.it/static/img/welcome.jpg

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

81.88.58.193 , Italy, ASN39729 (REGISTER-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

e6584f14d4039a010b9e2b3d1ec27c6dbf47ee65d9eea3412f4146d64e1b5f93

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.register.it/ https://www.amen.fr/ https://www.amen.pt/ https://www.nominalia.com/ https://www.amenworld.nl/
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000;
Last-Modified: Tue, 30 May 2017 13:53:12 GMT
Server: Apache
ETag: "6e99d0b6-1032f-550be1fdae200"
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/jpeg
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'self' https://www.register.it/ https://www.amen.fr/ https://www.amen.pt/ https://www.nominalia.com/ https://www.amenworld.nl/
Accept-Ranges: bytes, bytes
Content-Length: 66351
Date: Mon, 24 Aug 2020 07:20:57 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 16 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v13/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://login.register.it.anagroup.net
Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 10 Aug 2020 18:47:39 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:45:56 GMT
server: sffe
age: 1168398
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16064
x-xss-protection: 0
expires: Tue, 10 Aug 2021 18:47:39 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 16 KB
16 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v13/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://login.register.it.anagroup.net
Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 03:18:56 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:45:50 GMT
server: sffe
age: 1051321
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
expires: Thu, 12 Aug 2021 03:18:56 GMT

GET
H/1.1 200
OK flags_lng.png
www.register.it/_img/header/ 2 KB
2 KB 184ms
38ms Image
image/png 81.88.58.193
REGISTER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.register.it/_img/header/flags_lng.png

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

81.88.58.193 , Italy, ASN39729 (REGISTER-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

241f66d5c8c6c6e5f00120a372889348381a3b653270f4a34570eaae9309e9ed

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000;
Last-Modified: Fri, 17 Apr 2020 07:33:43 GMT
Server: Apache
ETag: "6aafea88-673-5a377919d63c0"
Vary: X-Forwarded-Proto
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/png
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Accept-Ranges: bytes, bytes
Content-Length: 1651
Date: Mon, 24 Aug 2020 07:20:57 GMT

GET
H/1.1 200
OK arrow_cnglng.png
www.register.it/_img/header/ 113 B
732 B 37ms
37ms Image
image/png 81.88.58.193
REGISTER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.register.it/_img/header/arrow_cnglng.png

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

81.88.58.193 , Italy, ASN39729 (REGISTER-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

caef9b5b0ad73fe4ee1bf95c2c6057fabd48c589d32f0199e561910601fa206f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000;
Last-Modified: Fri, 17 Apr 2020 07:33:43 GMT
Server: Apache
ETag: "6aafea98-71-5a377919d63c0"
Vary: X-Forwarded-Proto
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/png
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'self' https://controlpanel.register.it/ https://controlpanel.amen.fr/ https://controlpanel.amen.pt/ https://controlpanel.nominalia.com/ https://controlpanel.amenworld.nl/
Accept-Ranges: bytes, bytes
Content-Length: 113
Date: Mon, 24 Aug 2020 07:20:57 GMT

GET
H/1.1 200
OK footer-social-network.png
controlpanel.register.it/static/img/ 3 KB
4 KB 192ms
38ms Image
image/png 81.88.58.193
REGISTER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.register.it/static/img/footer-social-network.png

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

81.88.58.193 , Italy, ASN39729 (REGISTER-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

353bffc460025a9d4777452db8b7b0df21cbf5851fcac147b925bbaedb4a8cb7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.register.it/ https://www.amen.fr/ https://www.amen.pt/ https://www.nominalia.com/ https://www.amenworld.nl/
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000;
Last-Modified: Wed, 11 Jun 2014 06:50:59 GMT
Server: Apache
ETag: "6ed9ecc5-d6a-4fb89dde97ac0"
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/png
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'self' https://www.register.it/ https://www.amen.fr/ https://www.amen.pt/ https://www.nominalia.com/ https://www.amenworld.nl/
Accept-Ranges: bytes, bytes
Content-Length: 3434
Date: Mon, 24 Aug 2020 07:20:57 GMT

GET glyphicons-halflings-regular.woff
controlpanel.register.it/static/fonts/ 0
0

GET
H/2+Q/46 200 6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v13/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

HTTP/2+QUIC/46

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://login.register.it.anagroup.net
Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 20:25:31 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:46:05 GMT
server: sffe
age: 1076126
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15316
x-xss-protection: 0
expires: Wed, 11 Aug 2021 20:25:31 GMT

GET
H2 200 fontawesome-webfont.woff2
netdna.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 75 KB
76 KB 26ms
9ms Font
font/woff2 2001:4de0:ac19::1:b:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: login.register.it.anagroup.net
URL: https://login.register.it.anagroup.net/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://login.register.it.anagroup.net
Referer: https://login.register.it.anagroup.net/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 07:20:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:36:18 GMT
status: 200
etag: "1544639778"
vary: Accept-Encoding
x-cache: HIT
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 77171

GET glyphicons-halflings-regular.ttf
controlpanel.register.it/static/fonts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: controlpanel.register.it
URL: https://controlpanel.register.it/static/fonts/glyphicons-halflings-regular.woff

Domain: controlpanel.register.it
URL: https://controlpanel.register.it/static/fonts/glyphicons-halflings-regular.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Register.it (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

controlpanel.register.it
fonts.gstatic.com
login.register.it.anagroup.net
netdna.bootstrapcdn.com
www.register.it
controlpanel.register.it
2001:4de0:ac19::1:b:2b
2400:b800:5::39
2a00:1450:4001:81a::2003
81.88.58.193
0b4c7ffc6544cdbdebc05bb6dcd88cf88c3b0b3bcb40b6b81c7b97e0feb0e337
241f66d5c8c6c6e5f00120a372889348381a3b653270f4a34570eaae9309e9ed
28e56b80ff8f737648c27d108b8d66375c59d41dc99fbe04c4f1e8a28d56281d
338bdf9c4446455369ed41fbcbee7cdb1944b938225e7b5600cd79d689b4e167
353bffc460025a9d4777452db8b7b0df21cbf5851fcac147b925bbaedb4a8cb7
3de0381e6599a1f075d7560a0044700ed4a98d2fb2f8c28f6a126cb123445e9e
82792c8f0a04ed05d3adc0871584c1236a9f016708909f84f327ed124237ea45
8761ee755465fca3947f792fade09cbb6524765c7726559b4caef9e2a71c8af6
caef9b5b0ad73fe4ee1bf95c2c6057fabd48c589d32f0199e561910601fa206f
d7d6a8ebb176119775ea6f32fbc7a181c6ffcc2dc920c99a88b2a492eab2fcc6
e6584f14d4039a010b9e2b3d1ec27c6dbf47ee65d9eea3412f4146d64e1b5f93

login.register.it.anagroup.net Open in urlscan Pro 2400:b800:5::39 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

88 %HTTPS

75 %IPv6

4 Domains

5 Subdomains

5 IPs

4 Countries

213 kBTransfer

245 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

login.register.it.anagroup.net Open in urlscan Pro
2400:b800:5::39 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

88 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

5
IPs

4
Countries

213 kB
Transfer

245 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!