lob.ilbattelloavapore.net
Open in
urlscan Pro
34.65.241.81
Malicious Activity!
Public Scan
URL:
http://lob.ilbattelloavapore.net/azerty/web/login.php
Submission Tags: tweet @atomspam #phishing #aruba #infosec #cybersecurity #atomspam Search All
Submission: On February 03 via api from FI — Scanned from FI
Submission Tags: tweet @atomspam #phishing #aruba #infosec #cybersecurity #atomspam Search All
Submission: On February 03 via api from FI — Scanned from FI
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 16 HTTP transactions.
The main IP is 34.65.241.81, located in
Zurich, Switzerland and
belongs to GOOGLE-CLOUD-PLATFORM, US.
The main domain is lob.ilbattelloavapore.net.
This is the only time lob.ilbattelloavapore.net was scanned on urlscan.io!
This is the only time lob.ilbattelloavapore.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aruba (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 34.65.241.81 34.65.241.81 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
| 2 | 2a00:1450:400... 2a00:1450:400d:808::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 16 | 3 |
13
34.65.241.81
(Zurich, Switzerland)
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.241.65.34.bc.googleusercontent.com
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.241.65.34.bc.googleusercontent.com
| lob.ilbattelloavapore.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
ilbattelloavapore.net
lob.ilbattelloavapore.net |
213 KB |
| 2 |
gstatic.com
fonts.gstatic.com |
46 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34 |
840 B |
| 16 | 3 |
| Domain | Requested by | |
|---|---|---|
| 13 | lob.ilbattelloavapore.net |
lob.ilbattelloavapore.net
|
| 2 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | fonts.googleapis.com |
lob.ilbattelloavapore.net
|
| 16 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| managehosting.aruba.it |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| upload.video.google.com GTS CA 1C3 |
2023-01-09 - 2023-04-03 |
3 months | crt.sh |
| *.gstatic.com GTS CA 1C3 |
2023-01-09 - 2023-04-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://lob.ilbattelloavapore.net/azerty/web/login.php
Frame ID: 368BBFB61D1EB4ABF7A0FFAEA99D7481
Requests: 16 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
URL: https://managehosting.aruba.it/AreaUtenti.asp?Lang=IT
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
login.php
lob.ilbattelloavapore.net/azerty/web/ |
21 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
source.css
lob.ilbattelloavapore.net/azerty/web/res/ |
148 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PasswordScaduta_Include.css
lob.ilbattelloavapore.net/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
back.jpg
lob.ilbattelloavapore.net/azerty/web/res/ |
53 KB 53 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
info-information-circle.svg
lob.ilbattelloavapore.net/azerty/web/res/ |
822 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
eye-show.svg
lob.ilbattelloavapore.net/azerty/web/res/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
eye-hide.svg
lob.ilbattelloavapore.net/azerty/web/res/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main_separatore_5_5.gif
lob.ilbattelloavapore.net/azerty/web/res/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jq.js
lob.ilbattelloavapore.net/azerty/web/res/cdns/ |
287 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
3 KB 840 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-user.png
lob.ilbattelloavapore.net/azerty/web/res/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-headset.png
lob.ilbattelloavapore.net/azerty/web/res/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v23/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v23/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
fetch.php
lob.ilbattelloavapore.net/azerty/panel/ |
1 B 197 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
fetch.php
lob.ilbattelloavapore.net/azerty/panel/ |
1 B 197 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aruba (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange undefined| showPasswordWeb undefined| closeAlertMsg function| $ function| jQuery string| cd1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| lob.ilbattelloavapore.net/ | Name: PHPSESSID Value: ebhgjnk7p7gjn3g3iqrotfh085 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
lob.ilbattelloavapore.net
2a00:1450:4001:82a::200a
2a00:1450:400d:808::2003
34.65.241.81
27a9a24907f8907c98afcf081684fe8fe95f3381ef49ff0d56c9e8e1eb525b6f
2fa289bf10d54698c82688afb8590b3a223f074cb381a64f4806a8c5ced577f5
527572de8a1897f9e0eaca14a9e29fe27820e649b2a499e68ac5753a6f841194
5ef043454b128260dda530a42312fbb985505034036cd3f3ea23cfe324a7905b
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
6676b05ef9626756989d9dbc09608830af666a330ad1bfa12438b9775330c474
6c46bf722fb11c3066171661ece073b58b6ea6c16b00a9d3cc162a6f215b57f1
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61
bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792
bcedd8f5b1acb515cecfe911027e6a0dfeb447b4e9c8613f5e4fab67930b7d54
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
e87dced30fd630db2040a7ef1db70cff4336afb895f79587aca111b7132632ed