progvig.ir Open in urlscan Pro
185.18.215.15 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://progvig.ir/verifica-intesasanpaolo/
Submission: On March 14 via api (March 14th 2023, 12:13:39 pm UTC) from IT — Scanned from IT

Summary HTTP 16 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 16 HTTP transactions. The main IP is 185.18.215.15, located in Iran, Islamic Republic Of and belongs to SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR. The main domain is progvig.ir.
TLS certificate: Issued by R3 on February 7th 2023. Valid for: 3 months.

This is the only time progvig.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Intesa Sanpaolo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 14	185.18.215.15 185.18.215.15	48715 (SEFROYEKP...) (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
1	2a02:6ea0:c70... 2a02:6ea0:c700::18	60068 (CDN77 ^_^) (CDN77 ^_^)
1	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
16	4

14 185.18.215.15 (Iran, Islamic Republic Of) 1 redirects

ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR)
PTR: wh3.webalfa.net

progvig.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::18 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

assets.nicepagecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	progvig.ir 1 redirects progvig.ir	227 KB
1	gstatic.com fonts.gstatic.com	44 KB
1	nicepagecdn.com assets.nicepagecdn.com — Cisco Umbrella Rank: 538837	329 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	2 KB
16	4

	Domain	Requested by
14	progvig.ir	1 redirects progvig.ir
1	fonts.gstatic.com	fonts.googleapis.com
1	assets.nicepagecdn.com	progvig.ir
1	fonts.googleapis.com	progvig.ir
16	4

This site contains links to these domains. Also see Links.

Domain
nicepage.com
nicepage.cloud
facebook.com
twitter.com
instagram.com

Subject Issuer	Validity	Valid
www.khaninejad.progvig.ir R3	`2023-02-07` - `2023-05-08`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-02-20` - `2023-05-15`	3 months	crt.sh
1071178158.rsc.cdn77.org R3	`2023-01-24` - `2023-04-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-02-20` - `2023-05-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://progvig.ir/verifica-intesasanpaolo/
Frame ID: D1A7C4E4A6B2E1724E71377AAA54A301
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home

Page URL History Show full URLs

https://progvig.ir/verifica-intesasanpaolo HTTP 301
https://progvig.ir/verifica-intesasanpaolo/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

602 kB
Transfer

2221 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://nicepage.com/html-website-builder

Search URL Search Domain Scan URL

URL: https://nicepage.cloud/
Title: APRI XME CONTO

Search URL Search Domain Scan URL

URL: https://facebook.com/name

Search URL Search Domain Scan URL

URL: https://twitter.com/name

Search URL Search Domain Scan URL

URL: https://instagram.com/name

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://progvig.ir/verifica-intesasanpaolo HTTP 301
https://progvig.ir/verifica-intesasanpaolo/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
progvig.ir/verifica-intesasanpaolo/
Redirect Chain

https://progvig.ir/verifica-intesasanpaolo
https://progvig.ir/verifica-intesasanpaolo/

12 KB
3 KB

114ms
113ms

Document
text/html

185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to

Full URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: 01021c2ccadf15cab9984d352f3ed8baee53b19ca9693a2696a833ad519340fa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 14 Mar 2023 12:13:23 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
vary: Accept-Encoding,User-Agent

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 707
content-type: text/html
date: Tue, 14 Mar 2023 12:13:23 GMT
location: https://progvig.ir/verifica-intesasanpaolo/
vary: User-Agent

GET
H2 200 nicepage.css
progvig.ir/verifica-intesasanpaolo/ 1 MB
85 KB 169ms
168ms Stylesheet
text/css 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to

Full URL: https://progvig.ir/verifica-intesasanpaolo/nicepage.css
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: d76dca061840d1088812bf329e70a714307f2a673b2a9d2911317d047dd263bb

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:23 GMT
content-encoding: br
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 87041
expires: Tue, 21 Mar 2023 12:13:23 GMT

GET
H2 200 Home.css
progvig.ir/verifica-intesasanpaolo/ 2 KB
603 B 1616ms
1615ms Stylesheet
text/css 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to

Full URL: https://progvig.ir/verifica-intesasanpaolo/Home.css
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: e0fcab273e0c72094db26aa6a1dd0ba108d6df2a6a5ffbd8004c6435c3cfd33a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:23 GMT
content-encoding: br
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 571
expires: Tue, 21 Mar 2023 12:13:23 GMT

GET
H2 200 jquery-1.9.1.min.js Show response
progvig.ir/verifica-intesasanpaolo/ 90 KB
31 KB 1690ms
1688ms Script
application/javascript 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to

Full URL: https://progvig.ir/verifica-intesasanpaolo/jquery-1.9.1.min.js
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:24 GMT
content-encoding: br
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 31809
expires: Tue, 21 Mar 2023 12:13:24 GMT

GET
H2 200 nicepage.js Show response
progvig.ir/verifica-intesasanpaolo/ 284 KB
83 KB 1787ms
1785ms Script
application/javascript 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to

Full URL: https://progvig.ir/verifica-intesasanpaolo/nicepage.js
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: c9e0f616e448b649e438ead855c895ab69ea7000d1d9208bd2bf4fd226270309

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:24 GMT
content-encoding: br
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 85210
expires: Tue, 21 Mar 2023 12:13:24 GMT

GET
H2 200 css
fonts.googleapis.com/ 55 KB
2 KB 117ms
35ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i

Requested by

Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

04885833d94238efe955cbbec83cfb9340cc2d5ebd17d3dcc9556ef4ff644d53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 14 Mar 2023 12:13:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 12:09:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Mar 2023 12:13:23 GMT

GET
H2 200 ico-parla-con-noi.png
progvig.ir/verifica-intesasanpaolo/images/ 2 KB
2 KB 2370ms
2368ms Image
image/png 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://progvig.ir/verifica-intesasanpaolo/images/ico-parla-con-noi.png
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: 9e5f7acbc049c135bfae2d725aa23aeced8e05320aadf2629ca8fa11f5dafb14

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:24 GMT
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1925
expires: Tue, 21 Mar 2023 12:13:24 GMT

GET
H2 200 1828859-233e7caf.png
progvig.ir/verifica-intesasanpaolo/images/ 1 KB
1 KB 2371ms
2369ms Image
image/png 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://progvig.ir/verifica-intesasanpaolo/images/1828859-233e7caf.png
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: 5b6c388830606607beac52792986c99b7b846afa5161eafb78686e234b99801e

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:24 GMT
last-modified: Mon, 27 Feb 2023 13:56:36 GMT
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1085
expires: Tue, 21 Mar 2023 12:13:24 GMT

GET
H2 200 748137-f23d1f36.png
progvig.ir/verifica-intesasanpaolo/images/ 4 KB
4 KB 2371ms
2370ms Image
image/png 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://progvig.ir/verifica-intesasanpaolo/images/748137-f23d1f36.png
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: cd71438b112b2484de48757ce5bc6c3e1c16526daf566178eacd9cd13e4413ed

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:24 GMT
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 4027
expires: Tue, 21 Mar 2023 12:13:24 GMT

GET
H2 200 2889676-60620c2c.png
progvig.ir/verifica-intesasanpaolo/images/ 3 KB
3 KB 2372ms
2370ms Image
image/png 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://progvig.ir/verifica-intesasanpaolo/images/2889676-60620c2c.png
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: 6b06689bccae390944f9971ce567fd14166aeb03aeb661523781cec0b3deb96d

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:24 GMT
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3124
expires: Tue, 21 Mar 2023 12:13:24 GMT

GET
H2 200 logo-intesasanpaolo.png
progvig.ir/verifica-intesasanpaolo/images/ 5 KB
5 KB 2372ms
2371ms Image
image/png 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://progvig.ir/verifica-intesasanpaolo/images/logo-intesasanpaolo.png
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: 559bde803d8dedb905509859f3c1d14c9837788f2d5cf6ee26f1518f528d0cf8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:24 GMT
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 5229
expires: Tue, 21 Mar 2023 12:13:24 GMT

GET
H2 200 3031293-f17c21bf.png
progvig.ir/verifica-intesasanpaolo/images/ 4 KB
4 KB 2373ms
2371ms Image
image/png 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://progvig.ir/verifica-intesasanpaolo/images/3031293-f17c21bf.png
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: eef5f470f57578ce3b764fcc38d784627dcd7e193e5990fb3dcc71f522c35483

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:24 GMT
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3873
expires: Tue, 21 Mar 2023 12:13:24 GMT

GET
H2 200 utente_ok_green.png
progvig.ir/verifica-intesasanpaolo/images/ 2 KB
2 KB 2373ms
2372ms Image
image/png 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://progvig.ir/verifica-intesasanpaolo/images/utente_ok_green.png
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: af48163da7ed2b30cde51f80f1000ea670cedfe33ae6c9fbbb020c3e90da9727

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:25 GMT
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2375
expires: Tue, 21 Mar 2023 12:13:25 GMT

GET
H2 200 2889676.png
progvig.ir/verifica-intesasanpaolo/images/ 2 KB
2 KB 2373ms
2372ms Image
image/png 185.18.215.15
SEFROYEKPARDAZENG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://progvig.ir/verifica-intesasanpaolo/images/2889676.png
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 185.18.215.15 , Iran, Islamic Republic Of, ASN48715 (SEFROYEKPARDAZENG-AS Sefroyek Pardaz Engineering Company, IR),
Reverse DNS: wh3.webalfa.net
Software: /
Resource Hash: f55464945c202f9b96ab6bd1ebeae218637b435e1fb5944e9105d50e05ef23c0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/verifica-intesasanpaolo/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 14 Mar 2023 12:13:25 GMT
last-modified: Mon, 27 Feb 2023 13:56:38 GMT
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2103
expires: Tue, 21 Mar 2023 12:13:25 GMT

GET
H2 200 pexels-andrea-piacquadio-3791666.jpg
assets.nicepagecdn.com/27ffa556/4204576/images/ 328 KB
329 KB 219ms
46ms Image
image/jpeg 2a02:6ea0:c700::18
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nicepagecdn.com/27ffa556/4204576/images/pexels-andrea-piacquadio-3791666.jpg
Requested by: Host: progvig.ir
URL: https://progvig.ir/verifica-intesasanpaolo/Home.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::18 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: b9713aa2709fe26ac3ba42dd3ece508112c3684422bc8ab6f38f6304f7012262

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://progvig.ir/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 14 Mar 2023 12:13:25 GMT
x-amz-version-id: YohCOibKuCKkbxp5qQgCyEXPOjVohpHr
x-amz-request-id: MY4GGSGWVVFPPF36
x-cache: HIT
x-77-cache: HIT
x-age: 70077
content-length: 335608
x-amz-id-2: 03eNDfBa6d0OprjDvaGsd+4rsWPbba9Cr9a2m2+d4iFRIbFXu5/a9aTn4t5GufAaSYSKwzpenQE=
x-77-nzt: AZySIRndG/T/vREBAA
x-accel-expires: @1679762728
last-modified: Mon, 27 Feb 2023 16:22:24 GMT
server: CDN77-Turbo
etag: "07302a1edc5c756ac44a27402a68d17f"
x-77-nzt-ray: cf8787273faa1ab4e5641064af73c02d
content-type: image/jpeg
accept-ranges: bytes

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 117ms
35ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://progvig.ir
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 05:05:33 GMT
x-content-type-options: nosniff
age: 457672
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Mar 2024 05:05:33 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Intesa Sanpaolo (Banking)

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			progvig.ir/	1969-12-31 23:59:59	Name: PHPSESSID Value: be330b39041a9b399dea3c480d6088b7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nicepagecdn.com
fonts.googleapis.com
fonts.gstatic.com
progvig.ir
185.18.215.15
2a00:1450:4001:809::2003
2a00:1450:4001:80b::200a
2a02:6ea0:c700::18
01021c2ccadf15cab9984d352f3ed8baee53b19ca9693a2696a833ad519340fa
04885833d94238efe955cbbec83cfb9340cc2d5ebd17d3dcc9556ef4ff644d53
559bde803d8dedb905509859f3c1d14c9837788f2d5cf6ee26f1518f528d0cf8
5b6c388830606607beac52792986c99b7b846afa5161eafb78686e234b99801e
6b06689bccae390944f9971ce567fd14166aeb03aeb661523781cec0b3deb96d
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
9e5f7acbc049c135bfae2d725aa23aeced8e05320aadf2629ca8fa11f5dafb14
af48163da7ed2b30cde51f80f1000ea670cedfe33ae6c9fbbb020c3e90da9727
b9713aa2709fe26ac3ba42dd3ece508112c3684422bc8ab6f38f6304f7012262
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c9e0f616e448b649e438ead855c895ab69ea7000d1d9208bd2bf4fd226270309
cd71438b112b2484de48757ce5bc6c3e1c16526daf566178eacd9cd13e4413ed
d76dca061840d1088812bf329e70a714307f2a673b2a9d2911317d047dd263bb
e0fcab273e0c72094db26aa6a1dd0ba108d6df2a6a5ffbd8004c6435c3cfd33a
eef5f470f57578ce3b764fcc38d784627dcd7e193e5990fb3dcc71f522c35483
f55464945c202f9b96ab6bd1ebeae218637b435e1fb5944e9105d50e05ef23c0

progvig.ir Open in urlscan Pro 185.18.215.15 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

602 kBTransfer

2221 kBSize

1 Cookies

5 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

42 JavaScript Global Variables

1 Cookies

Indicators

progvig.ir Open in urlscan Pro
185.18.215.15 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

602 kB
Transfer

2221 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!