bancapassadore.info Open in urlscan Pro
68.65.123.36 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://bancapassadore.info/
Submission: On October 22 via manual (October 22nd 2021, 10:08:15 am UTC) from IT — Scanned from DE

Summary HTTP 19 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 19 HTTP transactions. The main IP is 68.65.123.36, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is bancapassadore.info.

This is the only time bancapassadore.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Passadore (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	68.65.123.36 68.65.123.36	22612 (NAMECHEAP...) (NAMECHEAP-NET)
12	91.216.127.98 91.216.127.98	51065 (PASSADORE-AS) (PASSADORE-AS)
2	142.250.184.234 142.250.184.234	15169 (GOOGLE) (GOOGLE)
1	142.250.185.106 142.250.185.106	15169 (GOOGLE) (GOOGLE)
1	142.250.185.99 142.250.185.99	15169 (GOOGLE) (GOOGLE)
2	72.140.233.34 72.140.233.34	54412 (RCC-GRANI...) (RCC-GRANITE-1)
19	6

1 68.65.123.36 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server272-1.web-hosting.com

bancapassadore.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 91.216.127.98 (Italy)

ASN51065 (PASSADORE-AS, IT)
PTR: bpweb.bancapassadore.it

bpweb.bancapassadore.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.234 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.140.233.34 (Canada)

ASN54412 (RCC-GRANITE-1, CA)
PTR: unallocated-static.datacentres.rogers.com

seal.entrust.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	bancapassadore.it bpweb.bancapassadore.it	280 KB
3	googleapis.com fonts.googleapis.com ajax.googleapis.com	33 KB
2	entrust.net seal.entrust.net	12 KB
1	gstatic.com fonts.gstatic.com	44 KB
1	bancapassadore.info bancapassadore.info	5 KB
19	5

	Domain	Requested by
12	bpweb.bancapassadore.it	bancapassadore.info bpweb.bancapassadore.it
2	seal.entrust.net	bpweb.bancapassadore.it
2	fonts.googleapis.com	bancapassadore.info
1	fonts.gstatic.com	fonts.googleapis.com
1	ajax.googleapis.com	bancapassadore.info
1	bancapassadore.info
19	6

This site contains links to these domains. Also see Links.

Domain
www.bancapassadore.it
www.entrustdatacard.com

Subject Issuer	Validity	Valid
bpweb.bancapassadore.it Entrust Certification Authority - L1M	`2021-09-14` - `2022-10-10`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
seal.entrust.net Entrust Certification Authority - L1M	`2020-03-03` - `2022-06-02`	2 years	crt.sh

This page contains 2 frames:

Primary Page: http://bancapassadore.info/
Frame ID: 531EC3FB4FFF2BF9A4DF5261D706A26B
Requests: 16 HTTP requests in this frame

Frame: https://bpweb.bancapassadore.it/NortonSecuritySeal/securitySeal_prod.htm
Frame ID: A4720A0FEC0366CDCB4CD21A67D5CC07
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

95 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

374 kB
Transfer

460 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bancapassadore.it/it/so_internetBanking.html
Title: "Supporto tecnico"

Search URL Search Domain Scan URL

URL: https://www.entrustdatacard.com/
Title: Certificati SSL Entrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
bancapassadore.info/ 24 KB
5 KB 573ms
184ms Document
text/html 68.65.123.36
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Server: 68.65.123.36 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server272-1.web-hosting.com
Software: LiteSpeed /
Resource Hash: 9642af1a1336ba645839dcda4e582c8d1f20698271801023bfffbfb3da7ad9a4

Request headers

Host: bancapassadore.info
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

keep-alive: timeout=5, max=100
content-type: text/html
last-modified: Wed, 20 Oct 2021 08:37:31 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 4997
date: Fri, 22 Oct 2021 10:08:10 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed

GET
H/1.1 200
OK theme.css
bpweb.bancapassadore.it/bpc/javax.faces.resource/ 28 KB
29 KB 449ms
80ms Stylesheet
text/css 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/theme.css?ln=primefaces-aristo
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: eb999f390240b931e4a2ca0da8406915fbf9d81de90007e9b7a273b363409dbe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 22 Oct 2021 01:19:20 GMT
X-Powered-By: Servlet/3.0
Transfer-Encoding: chunked
Content-Language: en-US
X-UA-Compatible: IE=Edge
Connection: Keep-Alive
Content-Type: text/css
Keep-Alive: timeout=10, max=100
Expires: Fri, 29 Oct 2021 10:08:11 GMT

GET
H/1.1 200
OK primefaces.css
bpweb.bancapassadore.it/bpc/javax.faces.resource/ 62 KB
62 KB 419ms
49ms Stylesheet
text/css 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/primefaces.css?ln=primefaces&v=5.2
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: 294201823c79d0e7e4e1678340a321e4a36586bbd6076ee0eb564ceedb7253de

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 22 Oct 2021 01:19:20 GMT
X-Powered-By: Servlet/3.0
Transfer-Encoding: chunked
Content-Language: en-US
X-UA-Compatible: IE=Edge
Connection: Keep-Alive
Content-Type: text/css
Keep-Alive: timeout=10, max=100
Expires: Fri, 29 Oct 2021 10:08:11 GMT

GET
H/1.1 200
OK PassadoreIB_print.css
bpweb.bancapassadore.it/bpc/javax.faces.resource/css/ 902 B
1 KB 394ms
23ms Stylesheet
text/css 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/css/PassadoreIB_print.css?ln=default&rv=5.5.0
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: 399e35bfec680d779d25e8b4f4816656668073c7506ba3be20d4e5cf3b16c12d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 22 Oct 2021 01:19:20 GMT
X-Powered-By: Servlet/3.0
Content-Language: en-US
X-UA-Compatible: IE=Edge
Connection: Keep-Alive
Content-Type: text/css
Keep-Alive: timeout=10, max=100
Content-Length: 902
Expires: Fri, 29 Oct 2021 10:08:11 GMT

GET
H/1.1 200
OK primefaces-extensions.css
bpweb.bancapassadore.it/bpc/javax.faces.resource/ 2 KB
2 KB 401ms
28ms Stylesheet
text/css 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/primefaces-extensions.css?ln=primefaces-extensions&v=3.1.0
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: b7ffeb1def9df747c517509cfe18ca15b3bb7191bfca627beb6072846bff537a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 22 Oct 2021 01:19:20 GMT
X-Powered-By: Servlet/3.0
Content-Language: en-US
X-UA-Compatible: IE=Edge
Connection: Keep-Alive
Content-Type: text/css
Keep-Alive: timeout=10, max=100
Content-Length: 1995
Expires: Fri, 29 Oct 2021 10:08:11 GMT

GET
H/1.1 200
OK PassadoreIB.css
bpweb.bancapassadore.it/bpc/javax.faces.resource/css/ 120 KB
120 KB 403ms
29ms Stylesheet
text/css 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/css/PassadoreIB.css?ln=default&rv=5.5.0
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: 38ae39ce5adac0510ec77a45579d46c9838dc779753330a3d8bae5f6c096587e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 22 Oct 2021 01:19:20 GMT
X-Powered-By: Servlet/3.0
Transfer-Encoding: chunked
Content-Language: en-US
X-UA-Compatible: IE=Edge
Connection: Keep-Alive
Content-Type: text/css
Keep-Alive: timeout=10, max=100
Expires: Fri, 29 Oct 2021 10:08:11 GMT

GET
H2 200 css
fonts.googleapis.com/ 10 KB
820 B 39ms
17ms Stylesheet
text/css 142.250.184.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,700,300,600

Requested by

Host: bancapassadore.info
URL: http://bancapassadore.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f10.1e100.net

Software

ESF /

Resource Hash

8c0e5c2f898c9c6ae0c1aff2eca3068d28c9545f8b8c4458d912b27f93d7280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 22 Oct 2021 10:08:10 GMT
server: ESF
date: Fri, 22 Oct 2021 10:08:10 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Fri, 22 Oct 2021 10:08:10 GMT

GET
H2 200 css
fonts.googleapis.com/ 8 KB
1 KB 38ms
16ms Stylesheet
text/css 142.250.184.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Mono:300,400,500,700&display=swap

Requested by

Host: bancapassadore.info
URL: http://bancapassadore.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f10.1e100.net

Software

ESF /

Resource Hash

294d7c44de6670f2f63a477acf6ed371dd15c3a113f86b8859f6e615710656be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 22 Oct 2021 09:57:55 GMT
server: ESF
date: Fri, 22 Oct 2021 10:08:10 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Fri, 22 Oct 2021 10:08:10 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 28ms
7ms Script
text/javascript 142.250.185.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: bancapassadore.info
URL: http://bancapassadore.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f10.1e100.net

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 14:16:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71497
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Fri, 21 Oct 2022 14:16:33 GMT

GET
H/1.1 200
OK M4.png
bpweb.bancapassadore.it/bpc/resources/img/common/logo/ 36 KB
37 KB 30ms
30ms Image
image/png 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpweb.bancapassadore.it/bpc/resources/img/common/logo/M4.png?pfdrid_c=true
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: 2bb172c04d50beceb48647b4c93853575d1d3215db9f8aefe295715cd4828fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 09 Oct 2020 14:15:02 GMT
X-Powered-By: Servlet/3.0
Content-Language: en-US
Connection: Keep-Alive
Content-Type: image/png
Keep-Alive: timeout=10, max=99
Content-Length: 37058
X-UA-Compatible: IE=Edge

GET
H/1.1 200
OK M3.png
bpweb.bancapassadore.it/bpc/resources/img/common/logo/ 11 KB
12 KB 28ms
27ms Image
image/png 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpweb.bancapassadore.it/bpc/resources/img/common/logo/M3.png?pfdrid_c=true
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: 80d5628a97287da6a50c1ebba5ea15e2b01ad2261c7352ea1d8837ebd7217745

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 09 Oct 2020 14:15:02 GMT
X-Powered-By: Servlet/3.0
Content-Language: en-US
Connection: Keep-Alive
Content-Type: image/png
Keep-Alive: timeout=10, max=98
Content-Length: 11528
X-UA-Compatible: IE=Edge

GET
H/1.1 200
OK autenticazione.png
bpweb.bancapassadore.it/bpc/resources/img/common/ 4 KB
5 KB 30ms
29ms Image
image/png 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpweb.bancapassadore.it/bpc/resources/img/common/autenticazione.png?pfdrid_c=true
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: c0c420100286731deb43551fb8f3d04c776d1bd0364a91bed8b9917ec86f1ece

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 09 Oct 2020 14:15:02 GMT
X-Powered-By: Servlet/3.0
Content-Language: en-US
Connection: Keep-Alive
Content-Type: image/png
Keep-Alive: timeout=10, max=97
Content-Length: 4568
X-UA-Compatible: IE=Edge

GET
H/1.1 200
OK M1.gif
bpweb.bancapassadore.it/bpc/resources/img/common/ 7 KB
7 KB 35ms
35ms Image
image/gif 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpweb.bancapassadore.it/bpc/resources/img/common/M1.gif
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: 0879ad9ad4563502560305a600be70d3f6643c87b660aeca6446b0c091fe2634

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 09 Oct 2020 14:15:02 GMT
X-Powered-By: Servlet/3.0
Content-Language: en-US
Connection: Keep-Alive
Content-Type: image/gif
Keep-Alive: timeout=10, max=96
Content-Length: 7061
X-UA-Compatible: IE=Edge

GET
H/1.1 200
OK securitySeal_prod.htm Show response
bpweb.bancapassadore.it/NortonSecuritySeal/ Frame A472 1 KB
2 KB 26ms
25ms Document
text/html 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://bpweb.bancapassadore.it/NortonSecuritySeal/securitySeal_prod.htm
Requested by: Host: bancapassadore.info
URL: http://bancapassadore.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: 2f0f1f352f97d16718abc02aafa88ab2a9f4ffa17e02191a0049964dc78cd2d8

Request headers

Host: bpweb.bancapassadore.it
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://bancapassadore.info/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://bancapassadore.info/

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
X-Powered-By: Servlet/3.0
Last-Modified: Tue, 10 Oct 2017 18:58:18 GMT
Content-Length: 1255
Keep-Alive: timeout=10, max=99
Connection: Keep-Alive
Content-Type: text/html
Content-Language: en-US
X-Pad: avoid browser bug

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ 44 KB
44 KB 51ms
14ms Font
font/woff2 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700,300,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://bancapassadore.info
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 17:04:31 GMT
x-content-type-options: nosniff
age: 61420
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 44760
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 16:50:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 21 Oct 2022 17:04:31 GMT

GET
H/1.1 200
OK octagon_corner_up.png
bpweb.bancapassadore.it/bpc/javax.faces.resource/img/common/ 1 KB
2 KB 29ms
29ms Image
image/png 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/img/common/octagon_corner_up.png
Requested by: Host: bpweb.bancapassadore.it
URL: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/css/PassadoreIB.css?ln=default&rv=5.5.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: 643e03d27d2052549696f808cd22cd1797325bc97d86d304efaf250bfad8ee19

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/css/PassadoreIB.css?ln=default&rv=5.5.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 09 Oct 2020 14:15:02 GMT
X-Powered-By: Servlet/3.0
Content-Language: en-US
X-UA-Compatible: IE=Edge
Connection: Keep-Alive
Content-Type: image/png
Keep-Alive: timeout=10, max=95
Content-Length: 1265
Expires: Fri, 29 Oct 2021 10:08:11 GMT

GET
H/1.1 200
OK octagon_corner_down.png
bpweb.bancapassadore.it/bpc/javax.faces.resource/img/common/ 1 KB
2 KB 27ms
26ms Image
image/png 91.216.127.98
PASSADORE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/img/common/octagon_corner_down.png
Requested by: Host: bpweb.bancapassadore.it
URL: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/css/PassadoreIB.css?ln=default&rv=5.5.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 91.216.127.98 , Italy, ASN51065 (PASSADORE-AS, IT),
Reverse DNS: bpweb.bancapassadore.it
Software: / Servlet/3.0
Resource Hash: e6476d7fb056263478569866831f3772e03192359c4c08d92c68683266b0af93

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://bpweb.bancapassadore.it/bpc/javax.faces.resource/css/PassadoreIB.css?ln=default&rv=5.5.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:11 GMT
Last-Modified: Fri, 09 Oct 2020 14:15:02 GMT
X-Powered-By: Servlet/3.0
Content-Language: en-US
X-UA-Compatible: IE=Edge
Connection: Keep-Alive
Content-Type: image/png
Keep-Alive: timeout=10, max=99
Content-Length: 1265
Expires: Fri, 29 Oct 2021 10:08:11 GMT

GET
H/1.1 200
OK sealv2.js Show response
seal.entrust.net/ Frame A472 9 KB
9 KB 621ms
120ms Script
application/javascript 72.140.233.34
RCC-GRANITE-1

General

Check archive.org

Show headers Download Go to

Full URL

https://seal.entrust.net/sealv2.js

Requested by

Host: bpweb.bancapassadore.it
URL: https://bpweb.bancapassadore.it/NortonSecuritySeal/securitySeal_prod.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

72.140.233.34 , Canada, ASN54412 (RCC-GRANITE-1, CA),

Reverse DNS

unallocated-static.datacentres.rogers.com

Software

Resource Hash

0bff94fea36ce236559135513c9709147d8ecc7de40c09929a8061d5626f10fc

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://bpweb.bancapassadore.it/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:12 GMT
Last-Modified: Wed, 15 Sep 2021 22:15:23 GMT
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: private
Connection: close
Accept-Ranges: bytes
Content-Length: 8945

GET
H/1.1 200
OK entrust_site_seal_small.png
seal.entrust.net/en/current/ Frame A472 3 KB
3 KB 358ms
122ms Image
image/png 72.140.233.34
RCC-GRANITE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://seal.entrust.net/en/current/entrust_site_seal_small.png

Requested by

Host: bpweb.bancapassadore.it
URL: https://bpweb.bancapassadore.it/NortonSecuritySeal/securitySeal_prod.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

72.140.233.34 , Canada, ASN54412 (RCC-GRANITE-1, CA),

Reverse DNS

unallocated-static.datacentres.rogers.com

Software

Resource Hash

0f76a7da8a5cc69305a4056beb623ec8f8cb2f7e12eedb791111fce744f0787c

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://bpweb.bancapassadore.it/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 22 Oct 2021 10:08:12 GMT
Last-Modified: Wed, 15 Sep 2021 22:15:23 GMT
X-Frame-Options: DENY
Content-Type: image/png
Cache-Control: private
Connection: close
Accept-Ranges: bytes
Content-Length: 2889

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Passadore (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bancapassadore.info
bpweb.bancapassadore.it
fonts.googleapis.com
fonts.gstatic.com
seal.entrust.net
142.250.184.234
142.250.185.106
142.250.185.99
68.65.123.36
72.140.233.34
91.216.127.98
0879ad9ad4563502560305a600be70d3f6643c87b660aeca6446b0c091fe2634
0bff94fea36ce236559135513c9709147d8ecc7de40c09929a8061d5626f10fc
0f76a7da8a5cc69305a4056beb623ec8f8cb2f7e12eedb791111fce744f0787c
294201823c79d0e7e4e1678340a321e4a36586bbd6076ee0eb564ceedb7253de
294d7c44de6670f2f63a477acf6ed371dd15c3a113f86b8859f6e615710656be
2bb172c04d50beceb48647b4c93853575d1d3215db9f8aefe295715cd4828fb7
2f0f1f352f97d16718abc02aafa88ab2a9f4ffa17e02191a0049964dc78cd2d8
38ae39ce5adac0510ec77a45579d46c9838dc779753330a3d8bae5f6c096587e
399e35bfec680d779d25e8b4f4816656668073c7506ba3be20d4e5cf3b16c12d
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
643e03d27d2052549696f808cd22cd1797325bc97d86d304efaf250bfad8ee19
80d5628a97287da6a50c1ebba5ea15e2b01ad2261c7352ea1d8837ebd7217745
8c0e5c2f898c9c6ae0c1aff2eca3068d28c9545f8b8c4458d912b27f93d7280a
9642af1a1336ba645839dcda4e582c8d1f20698271801023bfffbfb3da7ad9a4
b7ffeb1def9df747c517509cfe18ca15b3bb7191bfca627beb6072846bff537a
c0c420100286731deb43551fb8f3d04c776d1bd0364a91bed8b9917ec86f1ece
e6476d7fb056263478569866831f3772e03192359c4c08d92c68683266b0af93
eb999f390240b931e4a2ca0da8406915fbf9d81de90007e9b7a273b363409dbe
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

bancapassadore.info Open in urlscan Pro 68.65.123.36 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

19 Requests

95 %HTTPS

0 %IPv6

5 Domains

6 Subdomains

6 IPs

3 Countries

374 kBTransfer

460 kBSize

0 Cookies

2 Outgoing links

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

bancapassadore.info Open in urlscan Pro
68.65.123.36 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

95 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

374 kB
Transfer

460 kB
Size

0
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!