Submitted URL: https://ksof.westsidereal.com/kontol/nntesa.php
Effective URL: https://intesasanpaolocarte.redirectme.net/primo-accessodati/c499162e95e0fbf569b3f17fa0bc/
Submission: On August 29 via api from JP — Scanned from JP

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 105.134.83.88, located in Morocco and belongs to IAM-AS, MA. The main domain is intesasanpaolocarte.redirectme.net.
TLS certificate: Issued by R3 on August 25th 2022. Valid for: 3 months.
This is the only time intesasanpaolocarte.redirectme.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

MIME: empty
Downloaded from: https://intesasanpaolocarte.redirectme.net/primo-accessodati/c499162e95e0fbf569b3f17fa0bc/

Domain & IP information

IP Address AS Autonomous System
1 192.185.193.214 46606 (UNIFIEDLA...)
4 105.134.83.88 6713 (IAM-AS)
5 2
Domain Requested by
4 intesasanpaolocarte.redirectme.net intesasanpaolocarte.redirectme.net
ksof.westsidereal.com
1 ksof.westsidereal.com
5 2

This site contains no links.

Subject Issuer Validity Valid
www.ksof.westsidereal.com
R3
2022-07-31 -
2022-10-29
3 months crt.sh
intesasanpaolocarte.redirectme.net
R3
2022-08-25 -
2022-11-23
3 months crt.sh

This page contains 1 frames:

Frame: https://intesasanpaolocarte.redirectme.net/primo-accessodati/c499162e95e0fbf569b3f17fa0bc/
Frame ID: 8DB0B044481215A1ABDEC1CB4DD8717C
Requests: 5 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://ksof.westsidereal.com/kontol/nntesa.php Page URL
  2. https://intesasanpaolocarte.redirectme.net/primo-accessodati/ Page URL
  3. https://intesasanpaolocarte.redirectme.net/primo-accessodati/c499162e95e0fbf569b3f17fa0bc/ Page URL

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

3 kB
Transfer

10 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ksof.westsidereal.com/kontol/nntesa.php Page URL
  2. https://intesasanpaolocarte.redirectme.net/primo-accessodati/ Page URL
  3. https://intesasanpaolocarte.redirectme.net/primo-accessodati/c499162e95e0fbf569b3f17fa0bc/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
nntesa.php
ksof.westsidereal.com/kontol/
135 B
245 B
Document
General
Full URL
https://ksof.westsidereal.com/kontol/nntesa.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.193.214 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-193-214.unifiedlayer.com
Software
Apache /
Resource Hash
8a4f588f2e2e62b221cd5a92307e0bded004d8940d6cc32c3e3a396db4d7b724

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

content-encoding
gzip
content-length
132
content-type
text/html; charset=UTF-8
date
Mon, 29 Aug 2022 16:02:46 GMT
server
Apache
vary
Accept-Encoding
x-server-cache
false
/
intesasanpaolocarte.redirectme.net/primo-accessodati/
135 B
267 B
Document
General
Full URL
https://intesasanpaolocarte.redirectme.net/primo-accessodati/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
105.134.83.88 , Morocco, ASN6713 (IAM-AS, MA),
Reverse DNS
Software
nginx/1.20.2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://ksof.westsidereal.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

content-length
135
content-type
text/html; charset=UTF-8
date
Mon, 29 Aug 2022 16:02:48 GMT
referrer-policy
no-referrer
server
nginx/1.20.2
strict-transport-security
max-age=604800
Primary Request /
intesasanpaolocarte.redirectme.net/primo-accessodati/c499162e95e0fbf569b3f17fa0bc/
10 KB
2 KB
Document
General
Full URL
https://intesasanpaolocarte.redirectme.net/primo-accessodati/c499162e95e0fbf569b3f17fa0bc/
Requested by
Host: intesasanpaolocarte.redirectme.net
URL: https://intesasanpaolocarte.redirectme.net/primo-accessodati/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
105.134.83.88 , Morocco, ASN6713 (IAM-AS, MA),
Reverse DNS
Software
nginx/1.20.2 /
Resource Hash
b0a5b5e8d4d23fbf67a378e381f2a276aad8d46704a04bd8b78c403d723bdf05
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
1919
content-type
text/html; charset=UTF-8
date
Mon, 29 Aug 2022 16:02:48 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
referrer-policy
no-referrer
server
nginx/1.20.2
strict-transport-security
max-age=604800
vary
Accept-Encoding
/
intesasanpaolocarte.redirectme.net/
4 B
214 B
XHR
General
Full URL
https://intesasanpaolocarte.redirectme.net/?authentification
Requested by
Host: ksof.westsidereal.com
URL: https://ksof.westsidereal.com/kontol/nntesa.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
105.134.83.88 , Morocco, ASN6713 (IAM-AS, MA),
Reverse DNS
Software
nginx/1.20.2 /
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryv2SpITxAVA8ZExF8

Response headers

pragma
no-cache
date
Mon, 29 Aug 2022 16:02:49 GMT
referrer-policy
no-referrer
server
nginx/1.20.2
strict-transport-security
max-age=604800
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
content-length
4
expires
Thu, 19 Nov 1981 08:52:00 GMT
/
intesasanpaolocarte.redirectme.net/primo-accessodati/c499162e95e0fbf569b3f17fa0bc/
0
0
Document
General
Full URL
https://intesasanpaolocarte.redirectme.net/primo-accessodati/c499162e95e0fbf569b3f17fa0bc/
Requested by
Host: ksof.westsidereal.com
URL: https://ksof.westsidereal.com/kontol/nntesa.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
105.134.83.88 , Morocco, ASN6713 (IAM-AS, MA),
Reverse DNS
Software
nginx/1.20.2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-length
0
content-type
application/pdf
date
Mon, 29 Aug 2022 16:02:49 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
referrer-policy
no-referrer
refresh
0;
server
nginx/1.20.2
strict-transport-security
max-age=604800

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| _0xc81e function| _0xe33c string| rand number| startTime boolean| cookieEnabled function| render number| xd number| strObjC number| foundPDF string| plug object| result string| nv object| data object| xhr string| fpbys

1 Cookies

Domain/Path Name / Value
intesasanpaolocarte.redirectme.net/ Name: PHPSESSID
Value: nltuaa5c637oqtf8sfjm833aja

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

intesasanpaolocarte.redirectme.net
ksof.westsidereal.com
105.134.83.88
192.185.193.214
8a4f588f2e2e62b221cd5a92307e0bded004d8940d6cc32c3e3a396db4d7b724
b0a5b5e8d4d23fbf67a378e381f2a276aad8d46704a04bd8b78c403d723bdf05
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b