URL: http://monitoring.mawie.it/
Submission Tags: phishingrod
Submission: On July 16 via api from DE — Scanned from IT

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 5.10.161.27, located in Düsseldorf, Germany and belongs to VODANET International IP-Backbone of Vodafone, DE. The main domain is monitoring.mawie.it.
This is the only time monitoring.mawie.it was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 5.10.161.27 3209 (VODANET I...)
5 2
Apex Domain
Subdomains
Transfer
3 mawie.it
monitoring.mawie.it
11 KB
0 teamviewer.com Failed
www.teamviewer.com — Cisco Umbrella Rank: 94521 Failed
5 2
Domain Requested by
3 monitoring.mawie.it monitoring.mawie.it
0 www.teamviewer.com Failed monitoring.mawie.it
5 2

This site contains links to these domains. Also see Links.

Domain
www.mawie.it
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://monitoring.mawie.it/
Frame ID: CEB3CFCCB1EAC4DB2F667E18027A4DF9
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

MaWie.IT - get IT done

Page URL History Show full URLs

  1. http://monitoring.mawie.it/ HTTP 307
    https://monitoring.mawie.it/ HTTP 307
    http://monitoring.mawie.it/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:<html [^>]*xmlns:w="urn:schemas-microsoft-com:office:word"|<w:WordDocument>|<div [^>]*class="?WordSection1[" >]|<style[^>]*>[^>]*@page WordSection1)

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

11 kB
Transfer

31 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://monitoring.mawie.it/ HTTP 307
    https://monitoring.mawie.it/ HTTP 307
    http://monitoring.mawie.it/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://www.teamviewer.com/link/?url=232691&id=1871028592 HTTP 301
  • https://www.teamviewer.com/link/ HTTP 302
  • https://www.teamviewer.com/ HTTP 302
  • https://www.teamviewer.com/it/
Request Chain 2
  • http://www.teamviewer.com/link/?url=985962&id=1871028592 HTTP 301
  • https://www.teamviewer.com/link/ HTTP 302
  • https://www.teamviewer.com/ HTTP 302
  • https://www.teamviewer.com/it/

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
monitoring.mawie.it/
Redirect Chain
  • http://monitoring.mawie.it/
  • https://monitoring.mawie.it/
  • http://monitoring.mawie.it/
25 KB
4 KB
Document
General
Full URL
http://monitoring.mawie.it/
Protocol
HTTP/1.1
Server
5.10.161.27 Düsseldorf, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE),
Reverse DNS
ip-005-010-161-027.um02.pools.vodafone-ip.de
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
66600cc1622f18c486da56bcdaf230971e7a710b4d6c06e6f5b4d3c54c5cd1d1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
4191
Content-Type
text/html
Date
Tue, 16 Jul 2024 10:20:31 GMT
ETag
"80aa998cfef3d31:0"
Last-Modified
Fri, 25 May 2018 08:01:13 GMT
Server
Microsoft-IIS/7.5
Vary
Accept-Encoding
X-Powered-By
ASP.NET

Redirect headers

Location
http://monitoring.mawie.it/
Non-Authoritative-Reason
HttpsUpgrades
image002.jpg
monitoring.mawie.it/image/
5 KB
6 KB
Image
General
Full URL
http://monitoring.mawie.it/image/image002.jpg
Requested by
Host: monitoring.mawie.it
URL: http://monitoring.mawie.it/
Protocol
HTTP/1.1
Server
5.10.161.27 Düsseldorf, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE),
Reverse DNS
ip-005-010-161-027.um02.pools.vodafone-ip.de
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
647fa637c354933584953009428860f611917de1d14daf26c5df6266556ddfaf

Request headers

Referer
http://monitoring.mawie.it/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Tue, 16 Jul 2024 10:20:31 GMT
Last-Modified
Sun, 03 Apr 2011 15:04:30 GMT
Server
Microsoft-IIS/7.5
ETag
"aa2da76e10f2cb1:0"
X-Powered-By
ASP.NET
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
5615
/
www.teamviewer.com/it/
Redirect Chain
  • http://www.teamviewer.com/link/?url=232691&id=1871028592
  • https://www.teamviewer.com/link/
  • https://www.teamviewer.com/
  • https://www.teamviewer.com/it/
0
0

/
www.teamviewer.com/it/
Redirect Chain
  • http://www.teamviewer.com/link/?url=985962&id=1871028592
  • https://www.teamviewer.com/link/
  • https://www.teamviewer.com/
  • https://www.teamviewer.com/it/
0
0

favicon.ico
monitoring.mawie.it/
318 B
567 B
Other
General
Full URL
http://monitoring.mawie.it/favicon.ico
Protocol
HTTP/1.1
Server
5.10.161.27 Düsseldorf, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE),
Reverse DNS
ip-005-010-161-027.um02.pools.vodafone-ip.de
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
cd120711b981074a4ccc591ad10a2b9942b943778e214796c1f085d9693a2ca3

Request headers

Referer
http://monitoring.mawie.it/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Tue, 16 Jul 2024 10:20:34 GMT
Last-Modified
Tue, 19 Feb 2008 15:00:04 GMT
Server
Microsoft-IIS/7.5
ETag
"2a85a91b873c81:0"
X-Powered-By
ASP.NET
Content-Type
image/x-icon
Accept-Ranges
bytes
Content-Length
318

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.teamviewer.com
URL
https://www.teamviewer.com/it/
Domain
www.teamviewer.com
URL
https://www.teamviewer.com/it/

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
.teamviewer.com/ Name: __cf_bm
Value: 0ruWu_fwmphaIA4tmfP3dfl1PAZr3V_l9LtGDCZDiS4-1721125235-1.0.1.1-pi2rmacUEgd_rLmZuSWAbC04K1o23.u1p97gyIJxLGEGa3sQD_t5z9w6.K7apuwWXj_g3JqVKaRB7wiCdxh1TQ
.teamviewer.com/ Name: _cfuvid
Value: wHCVfnSDPEp7X41Vfx13nYba1pRu7ihJVgdAhW9yqss-1721125235641-0.0.1.1-604800000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

monitoring.mawie.it
www.teamviewer.com
www.teamviewer.com
5.10.161.27
647fa637c354933584953009428860f611917de1d14daf26c5df6266556ddfaf
66600cc1622f18c486da56bcdaf230971e7a710b4d6c06e6f5b4d3c54c5cd1d1
cd120711b981074a4ccc591ad10a2b9942b943778e214796c1f085d9693a2ca3