URL: http://monitoring.mawie.it/
Submission Tags: phishingrod
Submission: On April 24 via api from DE — Scanned from IT

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 5.10.161.27, located in Düsseldorf, Germany and belongs to VODANET International IP-Backbone of Vodafone, DE. The main domain is monitoring.mawie.it.
This is the only time monitoring.mawie.it was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 5.10.161.27 3209 (VODANET I...)
2 4 104.16.63.16 13335 (CLOUDFLAR...)
5 2
Apex Domain
Subdomains
Transfer
4 teamviewer.com
www.teamviewer.com — Cisco Umbrella Rank: 76163
18 KB
3 mawie.it
monitoring.mawie.it
11 KB
5 2
Domain Requested by
4 www.teamviewer.com 2 redirects monitoring.mawie.it
3 monitoring.mawie.it monitoring.mawie.it
5 2

This site contains links to these domains. Also see Links.

Domain
www.mawie.it
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://monitoring.mawie.it/
Frame ID: E13D4255D7118B541F42692621034F75
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

MaWie.IT - get IT done

Page URL History Show full URLs

  1. http://monitoring.mawie.it/ HTTP 307
    https://monitoring.mawie.it/ HTTP 307
    http://monitoring.mawie.it/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:<html [^>]*xmlns:w="urn:schemas-microsoft-com:office:word"|<w:WordDocument>|<div [^>]*class="?WordSection1[" >]|<style[^>]*>[^>]*@page WordSection1)

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

26 kB
Transfer

46 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://monitoring.mawie.it/ HTTP 307
    https://monitoring.mawie.it/ HTTP 307
    http://monitoring.mawie.it/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://www.teamviewer.com/link/?url=232691&id=1871028592 HTTP 301
  • https://www.teamviewer.com/link/?url=232691&id=1871028592
Request Chain 2
  • http://www.teamviewer.com/link/?url=985962&id=1871028592 HTTP 301
  • https://www.teamviewer.com/link/?url=985962&id=1871028592

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
monitoring.mawie.it/
Redirect Chain
  • http://monitoring.mawie.it/
  • https://monitoring.mawie.it/
  • http://monitoring.mawie.it/
25 KB
4 KB
Document
General
Full URL
http://monitoring.mawie.it/
Protocol
HTTP/1.1
Server
5.10.161.27 Düsseldorf, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE),
Reverse DNS
ip-005-010-161-027.um02.pools.vodafone-ip.de
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
66600cc1622f18c486da56bcdaf230971e7a710b4d6c06e6f5b4d3c54c5cd1d1

Request headers

Accept-Language
it-IT,it;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
4191
Content-Type
text/html
Date
Wed, 24 Apr 2024 02:18:38 GMT
ETag
"80aa998cfef3d31:0"
Last-Modified
Fri, 25 May 2018 08:01:13 GMT
Server
Microsoft-IIS/7.5
Vary
Accept-Encoding
X-Powered-By
ASP.NET

Redirect headers

Location
http://monitoring.mawie.it/
Non-Authoritative-Reason
HttpsUpgrades
image002.jpg
monitoring.mawie.it/image/
5 KB
6 KB
Image
General
Full URL
http://monitoring.mawie.it/image/image002.jpg
Requested by
Host: monitoring.mawie.it
URL: http://monitoring.mawie.it/
Protocol
HTTP/1.1
Server
5.10.161.27 Düsseldorf, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE),
Reverse DNS
ip-005-010-161-027.um02.pools.vodafone-ip.de
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
647fa637c354933584953009428860f611917de1d14daf26c5df6266556ddfaf

Request headers

Accept-Language
it-IT,it;q=0.9;q=0.9
Referer
http://monitoring.mawie.it/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Date
Wed, 24 Apr 2024 02:18:38 GMT
Last-Modified
Sun, 03 Apr 2011 15:04:30 GMT
Server
Microsoft-IIS/7.5
ETag
"aa2da76e10f2cb1:0"
X-Powered-By
ASP.NET
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
5615
/
www.teamviewer.com/link/
Redirect Chain
  • http://www.teamviewer.com/link/?url=232691&id=1871028592
  • https://www.teamviewer.com/link/?url=232691&id=1871028592
9 KB
10 KB
Image
General
Full URL
https://www.teamviewer.com/link/?url=232691&id=1871028592
Requested by
Host: monitoring.mawie.it
URL: http://monitoring.mawie.it/
Protocol
H2
Server
104.16.63.16 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d53fc44f8c8433da5a71d3a561754940de9e3f1b16795144d5d0d000ad4373a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
it-IT,it;q=0.9;q=0.9
Referer
http://monitoring.mawie.it/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date
Wed, 24 Apr 2024 02:18:42 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-polished
origSize=10608
alt-svc
h3=":443"; ma=86400
content-length
9475
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
cf-bgj
imgq:85,h2pri
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
cf-ray
87929aadde8f5a0d-MXP
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, X-Access-Token

Redirect headers

Date
Wed, 24 Apr 2024 02:18:42 GMT
Server
cloudflare
X-IsCloudflareRedirect
true
Vary
Accept-Encoding
Location
https://www.teamviewer.com/link/?url=232691&id=1871028592
Connection
keep-alive
CF-RAY
87929aad6c870d66-MXP
alt-svc
h3=":443"; ma=86400
Content-Length
0
/
www.teamviewer.com/link/
Redirect Chain
  • http://www.teamviewer.com/link/?url=985962&id=1871028592
  • https://www.teamviewer.com/link/?url=985962&id=1871028592
5 KB
6 KB
Image
General
Full URL
https://www.teamviewer.com/link/?url=985962&id=1871028592
Requested by
Host: monitoring.mawie.it
URL: http://monitoring.mawie.it/
Protocol
H2
Server
104.16.63.16 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
922fc739ca629536c35bbf3b2d470d39b868953f2c25d665e25be452ee708e0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
it-IT,it;q=0.9;q=0.9
Referer
http://monitoring.mawie.it/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date
Wed, 24 Apr 2024 02:18:42 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-polished
origSize=5947
alt-svc
h3=":443"; ma=86400
content-length
5393
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
cf-bgj
imgq:85,h2pri
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
cf-ray
87929aadde905a0d-MXP
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, X-Access-Token

Redirect headers

Date
Wed, 24 Apr 2024 02:18:42 GMT
Server
cloudflare
X-IsCloudflareRedirect
true
Vary
Accept-Encoding
Location
https://www.teamviewer.com/link/?url=985962&id=1871028592
Connection
keep-alive
CF-RAY
87929aad6a7a4c48-MXP
alt-svc
h3=":443"; ma=86400
Content-Length
0
favicon.ico
monitoring.mawie.it/
318 B
567 B
Other
General
Full URL
http://monitoring.mawie.it/favicon.ico
Protocol
HTTP/1.1
Server
5.10.161.27 Düsseldorf, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE),
Reverse DNS
ip-005-010-161-027.um02.pools.vodafone-ip.de
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
cd120711b981074a4ccc591ad10a2b9942b943778e214796c1f085d9693a2ca3

Request headers

Accept-Language
it-IT,it;q=0.9;q=0.9
Referer
http://monitoring.mawie.it/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Date
Wed, 24 Apr 2024 02:18:38 GMT
Last-Modified
Tue, 19 Feb 2008 15:00:04 GMT
Server
Microsoft-IIS/7.5
ETag
"2a85a91b873c81:0"
X-Powered-By
ASP.NET
Content-Type
image/x-icon
Accept-Ranges
bytes
Content-Length
318

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
.teamviewer.com/ Name: __cf_bm
Value: ux4TjJZdZoDICkdAuerxuyq4P6JWETU6HQ_IkrWiIAA-1713925122-1.0.1.1-XPAXTLtZ2nVjhrhWCorciKLYgtGK0YguscXXsxrQ7tK7JTw2LEgrCq4QGMU5CZ3hjU9PuYIoIfePQoe31.NLnA
.teamviewer.com/ Name: _cfuvid
Value: Q1Mx5SOqeMzMeH6F9jC4kCdblVQ_9m62m4nsQDeSjwM-1713925122270-0.0.1.1-604800000

4 Console Messages

Source Level URL
Text
other warning URL: http://monitoring.mawie.it/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: http://monitoring.mawie.it/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: http://monitoring.mawie.it/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: http://monitoring.mawie.it/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.