verify-twint.click - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is verify-twint.click.
TLS certificate: Issued by WE1 on December 16th 2024. Valid for: 3 months.

This is the only time verify-twint.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	2001:4b78:100... 2001:4b78:1001::1101	12637 (SEEWEB SE...) (SEEWEB SEEWEB s.r.l.)
4	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	3

2 2001:4b78:1001::1101 (Italy) 1 redirects

ASN12637 (SEEWEB SEEWEB s.r.l., IT)

langoloquadrato.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.langoloquadrato.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

verify-twint.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	verify-twint.click verify-twint.click	19 KB
2	langoloquadrato.it 1 redirects langoloquadrato.it www.langoloquadrato.it	823 B
6	2

	Domain	Requested by
4	verify-twint.click	www.langoloquadrato.it verify-twint.click
1	www.langoloquadrato.it
1	langoloquadrato.it	1 redirects
6	3

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com

Subject Issuer	Validity	Valid
www.langoloquadrato.it R11	`2024-10-28` - `2025-01-26`	3 months	crt.sh
verify-twint.click WE1	`2024-12-16` - `2025-03-17`	3 months	crt.sh

This page contains 1 frames:

Frame: https://verify-twint.click/twint/language.php
Frame ID: 647AF9B5E707F5657DBEB499AADC54E4
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Suspected phishing site | Cloudflare

Page URL History Show full URLs

https://langoloquadrato.it/ HTTP 301
https://www.langoloquadrato.it/ Page URL
https://verify-twint.click/twint/language.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

6
Requests

83 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

20 kB
Transfer

59 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cloudflare.com/learning/access-management/phishing-attack/
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.cloudflare.com/5xx-error-landing
Title: Cloudflare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://langoloquadrato.it/ HTTP 301
https://www.langoloquadrato.it/ Page URL
https://verify-twint.click/twint/language.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://langoloquadrato.it/ HTTP 301
https://www.langoloquadrato.it/

Request Chain 4

https://verify-twint.click/cdn-cgi/phish-bypass?atok=XA8r5gv7TgsgCjyfpXAROyoM1tpMw.42P8MYsLLUREQ-1734513580-0.0.1.1-%2Ftwint%2Flanguage.php HTTP 301
https://verify-twint.click/twint/language.php

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
www.langoloquadrato.it/
Redirect Chain

https://langoloquadrato.it/
https://www.langoloquadrato.it/

300 B
388 B

84ms
39ms

Document
text/html

2001:4b78:1001::1101
SEEWEB SEEWEB s.r.l.

General

Check archive.org

Show headers Download Go to

Full URL: https://www.langoloquadrato.it/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4b78:1001::1101 , Italy, ASN12637 (SEEWEB SEEWEB s.r.l., IT),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: eeb355db55e53f63c86020726305f0b20868751ace95742b38417a06aa6158a2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 201
content-type: text/html
date: Wed, 18 Dec 2024 09:19:40 GMT
etag: "12c-62977bef41bfb-gzip"
last-modified: Tue, 17 Dec 2024 14:02:21 GMT
server: nginx/1.22.1
vary: Accept-Encoding

Redirect headers

content-length: 307
content-type: text/html; charset=iso-8859-1
date: Wed, 18 Dec 2024 09:19:40 GMT
location: https://www.langoloquadrato.it/
server: nginx/1.22.1

GET
H3 403 Primary Request language.php Show response
verify-twint.click/twint/ 4 KB
2 KB 118ms
37ms Document
text/html 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://verify-twint.click/twint/language.php

Requested by

Host: www.langoloquadrato.it
URL: https://www.langoloquadrato.it/

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be1f497fbd2b1f35a32f98874483de55f15319ce0921af3ba65707c8a228afa5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.langoloquadrato.it/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cf-ray: 8f3e129679aedcbe-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 18 Dec 2024 09:19:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F%2FwkG4aiX%2FS7gto7aO%2Fer0G%2BEkFoc6RtWdd7qfqL4T9klF4zJcXERZNZCXt5kwt5QLdGc2%2FLgNWW2VPRar%2BNl8zyuRDMERMDX1VYPCUZ76Kw0CgH33ll5F3B0gKRj07RBZFKzvk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H3 200 cf.errors.css
verify-twint.click/cdn-cgi/styles/ 23 KB
5 KB 36ms
36ms Stylesheet
text/css 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://verify-twint.click/cdn-cgi/styles/cf.errors.css

Requested by

Host: verify-twint.click
URL: https://verify-twint.click/twint/language.php

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://verify-twint.click/twint/language.php

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"675fc4ac-5df3"
x-content-type-options: nosniff
cf-ray: 8f3e1296ba4adcbe-FRA
expires: Wed, 18 Dec 2024 11:19:40 GMT
date: Wed, 18 Dec 2024 09:19:40 GMT
content-type: text/css
last-modified: Mon, 16 Dec 2024 06:11:56 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
verify-twint.click/cdn-cgi/images/ 452 B
634 B 36ms
36ms Image
image/png 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://verify-twint.click/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: verify-twint.click
URL: https://verify-twint.click/cdn-cgi/styles/cf.errors.css

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://verify-twint.click/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "675fc4ac-1c4"
x-content-type-options: nosniff
cf-ray: 8f3e1296fab6dcbe-FRA
expires: Wed, 18 Dec 2024 11:19:40 GMT
accept-ranges: bytes
content-length: 452
date: Wed, 18 Dec 2024 09:19:40 GMT
content-type: image/png
last-modified: Mon, 16 Dec 2024 06:11:56 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 favicon.ico
verify-twint.click/ 30 KB
12 KB 19473ms
19473ms Other
image/x-icon 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://verify-twint.click/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://verify-twint.click/twint/language.php

Response headers

content-encoding: zstd
cf-cache-status: STALE
etag: W/"78ae-51affc7a4c400"
age: 39305
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z3SUu9f2A7NCPOmQpaJeuGXuR%2B%2FW7SJUTAdfMvsgCxyPNdvIG9n%2BJmvths7oCItSLXi07S6UFGz43QmjTiJjWSbQDi319CP%2Bw4kmbgZgzpWuqKmfxIREUF%2FZwHeVI8ISKxd7TtY%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=35949&min_rtt=32966&rtt_var=4219&sent=26&recv=19&lost=0&retrans=0&sent_bytes=12505&recv_bytes=6785&delivery_rate=492&cwnd=12000&unsent_bytes=0&cid=eb0e9fb114423e0f&ts=19597&x=1", cfExtPri, cfHdrFlush;dur=0
date: Wed, 18 Dec 2024 09:20:00 GMT
content-type: image/x-icon
last-modified: Thu, 16 Jul 2015 15:32:32 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f3e12973b5bdcbe-FRA
server: cloudflare

GET

language.php
verify-twint.click/twint/
Redirect Chain

https://verify-twint.click/cdn-cgi/phish-bypass?atok=XA8r5gv7TgsgCjyfpXAROyoM1tpMw.42P8MYsLLUREQ-1734513580-0.0.1.1-%2Ftwint%2Flanguage.php
https://verify-twint.click/twint/language.php

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: verify-twint.click
URL: https://verify-twint.click/twint/language.php

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _cf_translation

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.verify-twint.click/	1970-01-21 01:49:59	Name: __cf_mw_byp Value: XA8r5gv7TgsgCjyfpXAROyoM1tpMw.42P8MYsLLUREQ-1734513580-0.0.1.1-/twint/language.php

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://verify-twint.click/twint/language.php Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

langoloquadrato.it
verify-twint.click
www.langoloquadrato.it
verify-twint.click
188.114.97.3
2001:4b78:1001::1101
1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
be1f497fbd2b1f35a32f98874483de55f15319ce0921af3ba65707c8a228afa5
eeb355db55e53f63c86020726305f0b20868751ace95742b38417a06aa6158a2
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

verify-twint.click Open in urlscan Pro 188.114.97.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

50 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

20 kBTransfer

59 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

verify-twint.click Open in urlscan Pro
188.114.97.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

20 kB
Transfer

59 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!