urlscan.io logo urlscan.io
SecurityTrails logo

touchfoundation.info Open in urlscan Pro
206.221.182.74  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://touchfoundation.info/attendi2.php
Submission Tags: 7513481
Submission: On May 11 via api from US — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 206.221.182.74, located in United States and belongs to RELIABLESITE, US. The main domain is touchfoundation.info.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 15th 2022. Valid for: 3 months.
This is the only time touchfoundation.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Credit Agricole (Banking)

Domain & IP information

IP Address AS Autonomous System
5 206.221.182.74 23470 (RELIABLESITE)
5 1
Apex Domain
Subdomains		 Transfer
5 touchfoundation.info
touchfoundation.info
147 KB
5 1
Domain Requested by
5 touchfoundation.info touchfoundation.info
5 1

This site contains no links.

Subject Issuer Validity Valid
touchfoundation.info
cPanel, Inc. Certification Authority		 2022-04-15 -
2022-07-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://touchfoundation.info/attendi2.php
Frame ID: 68B60C20A12A80D62F4AC11A7320C6F9
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Crédit Agricole - Accesso Home Banking

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • moment(?:\.min)?\.js

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

147 kB
Transfer

573 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request attendi2.php
touchfoundation.info/ 		339 KB
54 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://touchfoundation.info/attendi2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed / PHP/7.4.12
Resource Hash
1f2afc37c05769cb8036e4831864dd2c9e4c763929ffa0a53162ad0cb062f1ed

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 11 May 2022 15:57:39 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.12
moment.js
touchfoundation.info/ 		170 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://touchfoundation.info/moment.js
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/attendi2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
f0075677245792b113c801a56bd36682461596ac3830e1d1eac2499ad1460184

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://touchfoundation.info/attendi2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 15:57:39 GMT
content-encoding
br
last-modified
Mon, 19 Jul 2021 07:16:06 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
35415
expires
Wed, 18 May 2022 15:57:39 GMT
ca_logo.svg
touchfoundation.info/cartella/ 		8 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://touchfoundation.info/cartella/ca_logo.svg
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/attendi2.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
906593415d0df2881d81176b9be0ae598ee9cf6b08cc1ce72df7b62e12baa85d

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://touchfoundation.info/attendi2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 15:57:39 GMT
content-encoding
br
last-modified
Thu, 04 Mar 2021 16:21:14 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
2687
expires
Wed, 18 May 2022 15:57:39 GMT
loading-buffering.gif
touchfoundation.info/ 		40 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://touchfoundation.info/loading-buffering.gif
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/attendi2.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
2eff2ae61047456178738bb7f10017cd66509ef3a547d5e3666267c7f4943b66

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://touchfoundation.info/attendi2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 15:57:39 GMT
last-modified
Mon, 19 Jul 2021 07:16:38 GMT
server
LiteSpeed
content-type
image/gif
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
40957
expires
Wed, 18 May 2022 15:57:39 GMT
Montserrat-Regular.woff2
touchfoundation.info/assets/fonts/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://touchfoundation.info/assets/fonts/Montserrat-Regular.woff2
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/attendi2.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
3db499acd608730bb66d02f0ba81182b48f69477ffe98a21b7ae0d5467a7f52d

Request headers

Referer
https://touchfoundation.info/attendi2.php
Origin
https://touchfoundation.info
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 15:57:39 GMT
last-modified
Thu, 04 Mar 2021 17:18:28 GMT
server
LiteSpeed
accept-ranges
bytes
content-length
16512
content-type
font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Credit Agricole (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| moment number| x object| countDownDate number| distance

0 Cookies