lob.ilbattelloavapore.net Open in urlscan Pro
34.65.241.81 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://lob.ilbattelloavapore.net/azerty/web/login.php
Submission: On February 03 via api (February 3rd 2023, 1:07:09 pm UTC) from FR — Scanned from IT

Summary HTTP 16 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 34.65.241.81, located in Zurich, Switzerland and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is lob.ilbattelloavapore.net.

This is the only time lob.ilbattelloavapore.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aruba (Online)

Domain & IP information

	IP Address	AS Autonomous System
13	34.65.241.81 34.65.241.81	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a00:1450:400... 2a00:1450:4001:801::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
16	3

13 34.65.241.81 (Zurich, Switzerland)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.241.65.34.bc.googleusercontent.com

lob.ilbattelloavapore.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	ilbattelloavapore.net lob.ilbattelloavapore.net	213 KB
2	gstatic.com fonts.gstatic.com	46 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	840 B
16	3

	Domain	Requested by
13	lob.ilbattelloavapore.net	lob.ilbattelloavapore.net
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	lob.ilbattelloavapore.net
16	3

This site contains links to these domains. Also see Links.

Domain
managehosting.aruba.it

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://lob.ilbattelloavapore.net/azerty/web/login.php
Frame ID: 9FB5BB13EF0F7CCBFBBFD6C919F66CED
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Servizio Hosting - Aruba.it

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

16
Requests

19 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

260 kB
Transfer

595 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://managehosting.aruba.it/AreaUtenti.asp?Lang=IT

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request login.php Show response
lob.ilbattelloavapore.net/azerty/web/ 21 KB
8 KB 113ms
68ms Document
text/html 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://lob.ilbattelloavapore.net/azerty/web/login.php
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: 527572de8a1897f9e0eaca14a9e29fe27820e649b2a499e68ac5753a6f841194

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: close
Content-Encoding: gzip
Content-Length: 7923
Content-Type: text/html; charset=UTF-8
Date: Fri, 03 Feb 2023 13:07:04 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
Vary: Accept-Encoding

GET
H/1.1 200
OK source.css
lob.ilbattelloavapore.net/azerty/web/res/ 148 KB
26 KB 46ms
26ms Stylesheet
text/css 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://lob.ilbattelloavapore.net/azerty/web/res/source.css?v=55
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/login.php
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: 2fa289bf10d54698c82688afb8590b3a223f074cb381a64f4806a8c5ced577f5

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Feb 2023 02:56:28 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "24eea-5f3c2d3ee3dc6-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 26589

GET
H/1.1 404
Not Found PasswordScaduta_Include.css
lob.ilbattelloavapore.net/ 0
0 40ms
20ms Stylesheet
text/html 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://lob.ilbattelloavapore.net/PasswordScaduta_Include.css
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/login.php
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Last-Modified: Sun, 22 Jan 2023 19:14:12 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "5ad-5f2df1677887e"
Content-Type: text/html
Connection: close
Accept-Ranges: bytes
Content-Length: 1453

GET
H/1.1 200
OK back.jpg
lob.ilbattelloavapore.net/azerty/web/res/ 53 KB
53 KB 41ms
20ms Image
image/jpeg 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://lob.ilbattelloavapore.net/azerty/web/res/back.jpg
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/login.php
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: bcedd8f5b1acb515cecfe911027e6a0dfeb447b4e9c8613f5e4fab67930b7d54

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Last-Modified: Fri, 03 Feb 2023 02:56:26 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "d32a-5f3c2d3d0d1fd"
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 54058

GET
H/1.1 200
OK info-information-circle.svg
lob.ilbattelloavapore.net/azerty/web/res/ 822 B
1 KB 40ms
19ms Image
image/svg+xml 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://lob.ilbattelloavapore.net/azerty/web/res/info-information-circle.svg
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/login.php
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: 27a9a24907f8907c98afcf081684fe8fe95f3381ef49ff0d56c9e8e1eb525b6f

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Last-Modified: Fri, 03 Feb 2023 02:56:27 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "336-5f3c2d3debcbe"
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 822

GET
H/1.1 200
OK eye-show.svg
lob.ilbattelloavapore.net/azerty/web/res/ 2 KB
2 KB 42ms
20ms Image
image/svg+xml 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://lob.ilbattelloavapore.net/azerty/web/res/eye-show.svg
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/login.php
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: 6676b05ef9626756989d9dbc09608830af666a330ad1bfa12438b9775330c474

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Last-Modified: Fri, 03 Feb 2023 02:56:26 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "7a6-5f3c2d3d43d0d"
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 1958

GET
H/1.1 200
OK eye-hide.svg
lob.ilbattelloavapore.net/azerty/web/res/ 2 KB
3 KB 39ms
20ms Image
image/svg+xml 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://lob.ilbattelloavapore.net/azerty/web/res/eye-hide.svg
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/login.php
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: 6c46bf722fb11c3066171661ece073b58b6ea6c16b00a9d3cc162a6f215b57f1

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Last-Modified: Fri, 03 Feb 2023 02:56:26 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "92a-5f3c2d3d43d0d"
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 2346

GET
H/1.1 404
Not Found main_separatore_5_5.gif
lob.ilbattelloavapore.net/azerty/web/res/ 1 KB
1 KB 40ms
20ms Image
text/html 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://lob.ilbattelloavapore.net/azerty/web/res/main_separatore_5_5.gif
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/login.php
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: e87dced30fd630db2040a7ef1db70cff4336afb895f79587aca111b7132632ed

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Last-Modified: Sun, 22 Jan 2023 19:14:12 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "5ad-5f2df1677887e"
Content-Type: text/html
Connection: close
Accept-Ranges: bytes
Content-Length: 1453

GET
H/1.1 200
OK jq.js Show response
lob.ilbattelloavapore.net/azerty/web/res/cdns/ 287 KB
85 KB 54ms
33ms Script
application/javascript 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://lob.ilbattelloavapore.net/azerty/web/res/cdns/jq.js
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/login.php
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: 9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Feb 2023 02:56:30 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "47b27-5f3c2d408dac2-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes

GET
H2 200 css
fonts.googleapis.com/ 3 KB
840 B 96ms
36ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700,900

Requested by

Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/res/source.css?v=55

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5ef043454b128260dda530a42312fbb985505034036cd3f3ea23cfe324a7905b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 03 Feb 2023 13:07:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 12:09:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 03 Feb 2023 13:07:05 GMT

GET
H/1.1 200
OK icon-user.png
lob.ilbattelloavapore.net/azerty/web/res/ 17 KB
17 KB 48ms
20ms Image
image/png 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://lob.ilbattelloavapore.net/azerty/web/res/icon-user.png
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/res/source.css?v=55
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/res/source.css?v=55
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Last-Modified: Fri, 03 Feb 2023 02:56:27 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "43f1-5f3c2d3dbbf10"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 17393

GET
H/1.1 200
OK icon-headset.png
lob.ilbattelloavapore.net/azerty/web/res/ 15 KB
15 KB 49ms
20ms Image
image/png 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://lob.ilbattelloavapore.net/azerty/web/res/icon-headset.png
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/res/source.css?v=55
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792

Request headers

accept-language: it-IT,it;q=0.9
Referer: http://lob.ilbattelloavapore.net/azerty/web/res/source.css?v=55
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 13:07:05 GMT
Last-Modified: Fri, 03 Feb 2023 02:56:27 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
ETag: "3c35-5f3c2d3db70ef"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 15413

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v23/ 23 KB
23 KB 115ms
54ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://lob.ilbattelloavapore.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Sun, 29 Jan 2023 11:05:12 GMT
x-content-type-options: nosniff
age: 439313
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 29 Jan 2024 11:05:12 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v23/ 23 KB
23 KB 85ms
25ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://lob.ilbattelloavapore.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 07:53:51 GMT
x-content-type-options: nosniff
age: 18794
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:56:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Feb 2024 07:53:51 GMT

POST
H/1.1 200
OK fetch.php Show response
lob.ilbattelloavapore.net/azerty/panel/ 1 B
197 B 42ms
21ms XHR
text/html 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://lob.ilbattelloavapore.net/azerty/panel/fetch.php
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/res/cdns/jq.js
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Accept: */*
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
X-Requested-With: XMLHttpRequest
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Fri, 03 Feb 2023 13:07:07 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
Connection: close
Content-Length: 1
Content-Type: text/html; charset=UTF-8

POST
H/1.1 200
OK fetch.php Show response
lob.ilbattelloavapore.net/azerty/panel/ 1 B
197 B 42ms
21ms XHR
text/html 34.65.241.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://lob.ilbattelloavapore.net/azerty/panel/fetch.php
Requested by: Host: lob.ilbattelloavapore.net
URL: http://lob.ilbattelloavapore.net/azerty/web/res/cdns/jq.js
Protocol: HTTP/1.1
Server: 34.65.241.81 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 81.241.65.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Accept: */*
Referer: http://lob.ilbattelloavapore.net/azerty/web/login.php
X-Requested-With: XMLHttpRequest
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Fri, 03 Feb 2023 13:07:09 GMT
Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1
Connection: close
Content-Length: 1
Content-Type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lob.ilbattelloavapore.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: muvf58thjo0e8lt11n6s557j50

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://lob.ilbattelloavapore.net/PasswordScaduta_Include.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://lob.ilbattelloavapore.net/azerty/web/res/main_separatore_5_5.gif Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
lob.ilbattelloavapore.net
2a00:1450:4001:801::200a
2a00:1450:4001:830::2003
34.65.241.81
27a9a24907f8907c98afcf081684fe8fe95f3381ef49ff0d56c9e8e1eb525b6f
2fa289bf10d54698c82688afb8590b3a223f074cb381a64f4806a8c5ced577f5
527572de8a1897f9e0eaca14a9e29fe27820e649b2a499e68ac5753a6f841194
5ef043454b128260dda530a42312fbb985505034036cd3f3ea23cfe324a7905b
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
6676b05ef9626756989d9dbc09608830af666a330ad1bfa12438b9775330c474
6c46bf722fb11c3066171661ece073b58b6ea6c16b00a9d3cc162a6f215b57f1
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61
bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792
bcedd8f5b1acb515cecfe911027e6a0dfeb447b4e9c8613f5e4fab67930b7d54
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
e87dced30fd630db2040a7ef1db70cff4336afb895f79587aca111b7132632ed

lob.ilbattelloavapore.net Open in urlscan Pro 34.65.241.81 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

19 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

260 kBTransfer

595 kBSize

1 Cookies

1 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

lob.ilbattelloavapore.net Open in urlscan Pro
34.65.241.81 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

19 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

260 kB
Transfer

595 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!