fiedelity.fidekhity.com Open in urlscan Pro
2606:4700:3031::6815:c26 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://fiedelity.fidekhity.com/
Submission: On April 05 via api (April 5th 2024, 3:40:10 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3031::6815:c26, located in United States and belongs to CLOUDFLARENET, US. The main domain is fiedelity.fidekhity.com.
TLS certificate: Issued by GTS CA 1P5 on February 29th 2024. Valid for: 3 months.

This is the only time fiedelity.fidekhity.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fidelity (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700:303... 2606:4700:3031::6815:c26	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
4	2606:4700:20:... 2606:4700:20::681a:11e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
12	6

3 2606:4700:3031::6815:c26 (United States)

ASN13335 (CLOUDFLARENET, US)

fiedelity.fidekhity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:20::681a:11e (United States)

ASN13335 (CLOUDFLARENET, US)

app.ardalio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	ardalio.com app.ardalio.com — Cisco Umbrella Rank: 80583	7 KB
3	fidekhity.com fiedelity.fidekhity.com	6 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 372 fonts.googleapis.com — Cisco Umbrella Rank: 38	32 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1126	32 KB
1	gstatic.com fonts.gstatic.com	16 KB
12	5

	Domain	Requested by
4	app.ardalio.com	fiedelity.fidekhity.com app.ardalio.com
3	fiedelity.fidekhity.com	fiedelity.fidekhity.com
2	maxcdn.bootstrapcdn.com	fiedelity.fidekhity.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	fiedelity.fidekhity.com
1	ajax.googleapis.com	fiedelity.fidekhity.com
12	6

This site contains no links.

Subject Issuer	Validity	Valid
fidekhity.com GTS CA 1P5	`2024-02-29` - `2024-05-29`	3 months	crt.sh
bootstrapcdn.com GTS CA 1P5	`2024-03-27` - `2024-06-25`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
ardalio.com GTS CA 1P5	`2024-03-24` - `2024-06-22`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://fiedelity.fidekhity.com/
Frame ID: 4BD3773FB793AA1EF64BCF6C1A171E8B
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

fidelity Login

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

93 kB
Transfer

294 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
fiedelity.fidekhity.com/ 10 KB
4 KB 194ms
139ms Document
text/html 2606:4700:3031::6815:c26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fiedelity.fidekhity.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:c26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d95503d2b7cbf17410269bf374ced040cc0283e3b4efe2979c6378bd406e255

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86faa278a85d1e3e-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 05 Apr 2024 15:40:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RCT6W69cFK2PaDfde52sPwp7Ycot0fzJpjBQCjltlApiz58lyjxZoziJ%2FaSE8uV1r1v6RTX42aVA5TF3ew7yxJYwsEEtJDx5hbmMmuMfQ9TRAjjTOJ4gbG%2FqHK%2FvQ7R5CcK8GnSulM6H0xe8GQ4FBk4PPku%2FUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/ 119 KB
20 KB 44ms
17ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css

Requested by

Host: fiedelity.fidekhity.com
URL: https://fiedelity.fidekhity.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 15:40:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 1077
age: 1987631
cdn-cachedat: 01/04/2023 09:19:49
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
cdn-proxyver: 1.03
cdn-requestpullcode: 200
server: cloudflare
etag: W/"7f89537eaf606bff49f5cc1a7c24dbca"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 7a8d1f92759b360c967b5fb361e39826
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 86faa279b88c924d-FRA
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.3/ 88 KB
31 KB 36ms
7ms Script
text/javascript 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.3/jquery.min.js

Requested by

Host: fiedelity.fidekhity.com
URL: https://fiedelity.fidekhity.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 02:54:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 391550
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31191
x-xss-protection: 0
last-modified: Wed, 11 Jan 2023 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 01 Apr 2025 02:54:16 GMT

GET
H3 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/ 39 KB
12 KB 51ms
25ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js

Requested by

Host: fiedelity.fidekhity.com
URL: https://fiedelity.fidekhity.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 15:40:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 722
age: 1983443
cdn-cachedat: 08/07/2023 07:43:09
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"2f34b630ffe30ba2ff2b91e3f3c322a1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 4ee37cfb4e854232a98222bcb496cfa9
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 86faa279b88d924d-FRA
cdn-requestpullsuccess: True

GET
H2 200 css2
fonts.googleapis.com/ 1 KB
893 B 39ms
16ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Quicksand&display=swap

Requested by

Host: fiedelity.fidekhity.com
URL: https://fiedelity.fidekhity.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1e8aa706d96df48dad9bcfdfdd590efb2d53a8650e85396f95ad3e3daff3db77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 05 Apr 2024 15:40:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 05 Apr 2024 14:44:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 05 Apr 2024 15:40:06 GMT

GET
H3 200 logo.svg
fiedelity.fidekhity.com/img/ 3 KB
2 KB 122ms
122ms Image
image/svg+xml 2606:4700:3031::6815:c26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fiedelity.fidekhity.com/img/logo.svg
Requested by: Host: fiedelity.fidekhity.com
URL: https://fiedelity.fidekhity.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:c26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a1410b4f4c92b57d938e22d6418dc173b4661805a231fdc567d357790ccebf8

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 15:40:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 Apr 2024 14:38:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"c55-6155a671001b1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ENUb7%2FcGcNAseIOxCPIFVr%2FCxIgIZl%2FScQ90gZz1o9HLaZluqAmJkpbXM0ImitUwGD9ir8r4kAfKUKuTScrE%2FSFn6jh0MUqW7Sai8DkGu89ggV%2FToVQx4LyEjdp5nWGSlVYDLekP1Y30O7odLdSZaswhirlM7A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 86faa27999631e3e-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 log7.js Show response
app.ardalio.com/ 17 KB
5 KB 59ms
21ms Script
text/javascript 2606:4700:20::681a:11e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.ardalio.com/log7.js

Requested by

Host: fiedelity.fidekhity.com
URL: https://fiedelity.fidekhity.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:11e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5063a12c8c604c33f111c30651cfb98b60219a22a7c1958883e57829b3706fc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 15:40:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 139
cf-polished: origSize=17842
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer-when-downgrade
cf-bgj: minify
last-modified: Thu, 21 Mar 2024 16:56:49 GMT
server: cloudflare
etag: W/"45b2-6142e97e1f1f8-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8GMlgj6J6sWggsGte72ivYinmlrttdfwRueEzRF9Qa0w6jxuv8%2FQ18tdC1pdCDbYiBp2rocy%2F7KsUUJjPwB9Y9De5ugQMSGQTL3i4sP%2FGf%2B1uM0NcM%2F01%2BAAYNEh1KnFtQoiqv%2FGTtQmV93wEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: public, max-age=691200, must-revalidate
cf-ray: 86faa27a3da4bbf5-FRA

GET
H2 200 6xK-dSZaM9iE8KbpRA_LJ3z8mH9BOJvgkP8o58a-wg.woff2
fonts.gstatic.com/s/quicksand/v31/ 15 KB
16 KB 35ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/quicksand/v31/6xK-dSZaM9iE8KbpRA_LJ3z8mH9BOJvgkP8o58a-wg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Quicksand&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73b8057c918765ed1a41c6ca23e2c0530b51d396e12ce63071297c5a04178504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://fiedelity.fidekhity.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 14:28:40 GMT
x-content-type-options: nosniff
age: 90686
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15788
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 23:17:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Apr 2025 14:28:40 GMT

POST
H3 200 LogServer Show response
app.ardalio.com/ 1 KB
1 KB 152ms
132ms Fetch
application/json 2606:4700:20::681a:11e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.ardalio.com/LogServer

Requested by

Host: app.ardalio.com
URL: https://app.ardalio.com/log7.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:11e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c835a96a51277c017aa448333e0c73b112af8aa50aab4c8f2c0c29ed899182ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 05 Apr 2024 15:40:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains
referrer-policy: no-referrer-when-downgrade
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
vary: Accept-Encoding
access-control-allow-methods: POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vQy1TGPSU9%2FGe7WWyY%2FkHPa8czO7YIIgvVxJOmI%2B9E%2B4rCzUy43%2BQSrSJwsG2%2F0TEyz8DoY8jJljnizjHatxk68eeAlin9m%2Bpj5d1ix93Bw3vgyxjTDt0ZimWRmcfgtaaSSZ4xUf0Fgk2HtDiw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 86faa27a8b9671a9-FRA
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400

GET
H3 404 favicon.ico
fiedelity.fidekhity.com/ 371 B
711 B 385ms
385ms Other
text/html 2606:4700:3031::6815:c26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fiedelity.fidekhity.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:c26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35c07c7ddde722dc024a6ee7775398f42f509d00aeda26feedca69b9a77f80c0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Apr 2024 15:40:06 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cb7wL5f8l6UZ1TkmDSX99g%2F%2B0ZFV7sLeUMQz2M2fC9ZaYpcH3w5ZHxoUjKwp759uBmJbYmldFUpdH304NgOZkL81V7G3GiSDRAUIDZro7HLRRak7CO%2BKLTV2RX0vDnzendDZ5xB%2FyoRbGO7WNEFOdgFvYQ1HpQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-ray: 86faa27a7a651e3e-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 PingServer Show response
app.ardalio.com/ 13 B
512 B 123ms
122ms Fetch
application/json 2606:4700:20::681a:11e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.ardalio.com/PingServer

Requested by

Host: app.ardalio.com
URL: https://app.ardalio.com/log7.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:11e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae95d608ee76e064ca676f3114fc5f48b0d5adac9ea3c9dbd137112f53c9b055

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 05 Apr 2024 15:40:06 GMT
strict-transport-security: max-age=63072000; includeSubDomains
referrer-policy: no-referrer-when-downgrade
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
vary: Accept-Encoding
access-control-allow-methods: POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y7wdckSb3baQG%2B17At7YHM9IuGjp1jIlevt2mtBSalfGa8OkfcxOIGnyuTAjYgGLsRgv0o38Ldd65hbgSWYUXu%2FYlcqgyL5dvfh4zGxghiEmmE1bIyVLscGJugrrA5VEtbk6vUitm6ELStxGLw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 86faa27b6d0771a9-FRA
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400

POST
H3 200 PingServer Show response
app.ardalio.com/ 13 B
519 B 130ms
129ms Fetch
application/json 2606:4700:20::681a:11e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.ardalio.com/PingServer

Requested by

Host: app.ardalio.com
URL: https://app.ardalio.com/log7.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:11e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae95d608ee76e064ca676f3114fc5f48b0d5adac9ea3c9dbd137112f53c9b055

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://fiedelity.fidekhity.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 05 Apr 2024 15:40:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains
referrer-policy: no-referrer-when-downgrade
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
vary: Accept-Encoding
access-control-allow-methods: POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vwUdOSXo5fXcw0CpFXUiJzFVcDNACPclbVX%2Fgxrf%2FtD7uJOZRr7SATIcs7XXzu3HFH1fmbX5WGFO5wn9bpl9K5ywdw0HAaIXXWZBIKKLZ%2F%2Fv4m9bJ2su%2Bb4VktxXO7hjWaVdKBfslerAiBAPhA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 86faa287eb3471a9-FRA
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fidelity (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://fiedelity.fidekhity.com/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://fiedelity.fidekhity.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
app.ardalio.com
fiedelity.fidekhity.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
2606:4700:20::681a:11e
2606:4700:3031::6815:c26
2606:4700::6812:acf
2a00:1450:4001:803::200a
2a00:1450:4001:80b::200a
2a00:1450:4001:80f::2003
1e8aa706d96df48dad9bcfdfdd590efb2d53a8650e85396f95ad3e3daff3db77
35c07c7ddde722dc024a6ee7775398f42f509d00aeda26feedca69b9a77f80c0
4a1410b4f4c92b57d938e22d6418dc173b4661805a231fdc567d357790ccebf8
4d95503d2b7cbf17410269bf374ced040cc0283e3b4efe2979c6378bd406e255
5063a12c8c604c33f111c30651cfb98b60219a22a7c1958883e57829b3706fc0
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
73b8057c918765ed1a41c6ca23e2c0530b51d396e12ce63071297c5a04178504
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
ae95d608ee76e064ca676f3114fc5f48b0d5adac9ea3c9dbd137112f53c9b055
c835a96a51277c017aa448333e0c73b112af8aa50aab4c8f2c0c29ed899182ba

fiedelity.fidekhity.com Open in urlscan Pro 2606:4700:3031::6815:c26 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

100 %IPv6

5 Domains

6 Subdomains

6 IPs

2 Countries

93 kBTransfer

294 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

fiedelity.fidekhity.com Open in urlscan Pro
2606:4700:3031::6815:c26 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

93 kB
Transfer

294 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!