www.edatabook.com Open in urlscan Pro
103.145.50.153 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.edatabook.com/bper/
Effective URL:
https://www.edatabook.com/bper/auth/clients/login.php?verification
Submission: On August 02 via automatic, source phishtank (August 2nd 2023, 1:44:06 am UTC) — Scanned from DE

Summary HTTP 2 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 103.145.50.153, located in India and belongs to QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN. The main domain is www.edatabook.com.
TLS certificate: Issued by R3 on June 13th 2023. Valid for: 3 months.

This is the only time www.edatabook.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BPER Banca (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 3	103.145.50.153 103.145.50.153		141004 (QTIME-AS-...) (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED)
2	2

3 103.145.50.153 (India) 1 redirects

ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN)
PTR: vps.banksloan.com

www.edatabook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	edatabook.com 1 redirects www.edatabook.com	2 MB
2	1

	Domain	Requested by
3	www.edatabook.com	1 redirects www.edatabook.com
2	1

This site contains links to these domains. Also see Links.

Domain
homebanking.bpergroup.net
www.bper.it

Subject Issuer	Validity	Valid
edatabook.com R3	`2023-06-13` - `2023-09-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.edatabook.com/bper/auth/clients/login.php?verification
Frame ID: 634649F44B73765C0D15F01237F521D9
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Page URL History Show full URLs

https://www.edatabook.com/bper/ Page URL
https://www.edatabook.com/bper/auth/index.php?pwd=UEh0cFFyRkA HTTP 302
https://www.edatabook.com/bper/auth/clients/login.php?verification Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

2947 kB
Transfer

5863 kB
Size

1
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://homebanking.bpergroup.net/auth/#/auth/primo-accesso?bank=05387
Title: È il tuo primo accesso?

Search URL Search Domain Scan URL

URL: https://www.bper.it/privati/prestiti/prestiti-online
Title: Scopri di più

Search URL Search Domain Scan URL

URL: https://www.bper.it/documents/2084926082/2094568827/BPER++Banca+-+Guida+Primi+Passi+IB.pdf/9af37eb4-e9bf-a081-2c6d-a3e62001f52f?t=1668170555300

Search URL Search Domain Scan URL

URL: https://www.bper.it/benvenuti-bper-banca/domande-risposte-utili-carige-bml

Search URL Search Domain Scan URL

URL: https://www.bper.it/benvenuti-bper-banca/domande-e-risposte-utili-cesare-ponti

Search URL Search Domain Scan URL

URL: https://www.bper.it/footer/privacy-policy/internet-banking
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.bper.it/footer/informative-normative/dleg-231-01?_ga=2.240983747.177688189.1647968555-1305436462.1632925734
Title: D.Lgs. 231/01

Search URL Search Domain Scan URL

URL: https://www.bper.it/footer/trasparenza?_ga=2.198529775.177688189.1647968555-1305436462.1632925734
Title: Trasparenza

Search URL Search Domain Scan URL

URL: https://www.bper.it/footer/informative-normative/note-legali?_ga=2.198529775.177688189.1647968555-1305436462.1632925734
Title: Note legali

Search URL Search Domain Scan URL

URL: https://www.bper.it/footer/informative-normative/aml?_ga=2.198529775.177688189.1647968555-1305436462.1632925734
Title: AML

Search URL Search Domain Scan URL

URL: https://www.bper.it/footer/privacy-policy/gestione-cookies/internet-banking
Title: Cookie policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.edatabook.com/bper/ Page URL
https://www.edatabook.com/bper/auth/index.php?pwd=UEh0cFFyRkA HTTP 302
https://www.edatabook.com/bper/auth/clients/login.php?verification Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
18 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ www.edatabook.com/bper/	74 B 323 B	1922ms 342ms	Document text/html	103.145.50.153 QTIME-AS-AP QTIME...
General Check archive.org Show headers Download Go to Full URL https://www.edatabook.com/bper/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 103.145.50.153 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN), Reverse DNS vps.banksloan.com Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Length 88 Content-Type text/html; charset=UTF-8 Date Wed, 02 Aug 2023 01:43:54 GMT Keep-Alive timeout=5, max=100 Server Apache Vary Accept-Encoding
GET H/1.1	200 OK	Primary Request login.php Show response www.edatabook.com/bper/auth/clients/ Redirect Chain https://www.edatabook.com/bper/auth/index.php?pwd=UEh0cFFyRkA https://www.edatabook.com/bper/auth/clients/login.php?verification	4 MB 2 MB	1836ms 1835ms	Document text/html	103.145.50.153 QTIME-AS-AP QTIME...
General Check archive.org Show headers Download Go to Full URL https://www.edatabook.com/bper/auth/clients/login.php?verification Requested by Host: www.edatabook.com URL: https://www.edatabook.com/bper/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 103.145.50.153 , India, ASN141004 (QTIME-AS-AP QTIME BUSINESSES PRIVATE LIMITED, IN), Reverse DNS vps.banksloan.com Software Apache / Resource Hash `5cf0b493d5ec70c7eb8b5c8458e95f34ee79697dcde1320810f197a59841f38d` Request headers Referer https://www.edatabook.com/bper/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 02 Aug 2023 01:43:55 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=98 Pragma no-cache Server Apache Transfer-Encoding chunked Vary Accept-Encoding Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Wed, 02 Aug 2023 01:43:54 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Location clients/login.php?verification#_ Pragma no-cache Server Apache
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0f64c1547d33c0d5a6ec2bea1296da06f8d1b876ff4b3bdc6e5151a1ca0c702c` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	14 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `03b99f1b7c7d616204ee60056eee3d6b2d4153365131d606978ccbfc30404082` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	684 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f2e5d114edc565e7c290a9941bf9989c6113936537c397137400314e4098c745` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	885 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c8a05f8286d745f6c593a532f7df92bb742c778b30083f1233e17df9478c9170` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	693 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c145e601056fb95cf4535f1c2d063aa04d0b85270aedc33de3c5c0cb87fc0caa` Request headers Referer Origin https://www.edatabook.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	140 KB 140 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `65c5f92b8c9b015ff9f30794e92f74863b2230a489f99d5f2eee31cc3caacc35` Request headers Referer Origin https://www.edatabook.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	81 KB 81 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `bf996a693d8c7b587ecb289bea2789e2141ab78c1ac33e5d1dbb7a7e2d83c69f` Request headers Referer Origin https://www.edatabook.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	143 KB 143 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `76e69830b8d2953df45a0acfd2b6290a5f817145f048fce5620d15fc93ef7bb0` Request headers Referer Origin https://www.edatabook.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	91 KB 91 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `cff4895f0f3bb9572b58947952cc8ea899933769b4cefe951caf630315ab39bd` Request headers Referer Origin https://www.edatabook.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	142 KB 142 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `02c4d3b380dbd48f28aa31ae66172cdfbaac8ff940e3ebc9cfef7d853b73ea61` Request headers Referer Origin https://www.edatabook.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	140 KB 140 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `92fa835eeba17c1cecced2b77b8442e56c64b849b38c9c45198abcc6f92da365` Request headers Referer Origin https://www.edatabook.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	12 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `60db760f7d5fd9c6b680ac00f719128ebd9fa9a30168e0d98f92ae7a66e4a5a5` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6d7257d5d026cee2c8d3a673ed80ba236122bed9bf8504ca5cb846985e99c81a` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	13 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5a81fd5d88908220d70c5c8af65732d0f63d1de0b5e413f658392b245c6402e7` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	118 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9d8d90b0d6790c92d58efb1cdb5074ab053686472b2c72bbf6c0b904330dd370` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	88 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `311167b08911270f63af4fc478295e4da13b546eba9d38a8146a23bd2bcdb313` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a779ad318a4da0e360b8540a7db4a9353398d5eb877b6b86bd0e5e831ff855b9` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 3 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `10a396cf83a1f0fa5ae02c199215e1b8e32fdb313f3d5e24c3e61a56f01e3eb5` Request headers Referer Origin https://www.edatabook.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Response headers Content-Type application/octet-stream

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BPER Banca (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| savepage_ShadowLoader

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.edatabook.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: d54332d034f3a8197f8d2fda5a23c37e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.edatabook.com
103.145.50.153
02c4d3b380dbd48f28aa31ae66172cdfbaac8ff940e3ebc9cfef7d853b73ea61
03b99f1b7c7d616204ee60056eee3d6b2d4153365131d606978ccbfc30404082
0f64c1547d33c0d5a6ec2bea1296da06f8d1b876ff4b3bdc6e5151a1ca0c702c
10a396cf83a1f0fa5ae02c199215e1b8e32fdb313f3d5e24c3e61a56f01e3eb5
311167b08911270f63af4fc478295e4da13b546eba9d38a8146a23bd2bcdb313
5a81fd5d88908220d70c5c8af65732d0f63d1de0b5e413f658392b245c6402e7
5cf0b493d5ec70c7eb8b5c8458e95f34ee79697dcde1320810f197a59841f38d
60db760f7d5fd9c6b680ac00f719128ebd9fa9a30168e0d98f92ae7a66e4a5a5
65c5f92b8c9b015ff9f30794e92f74863b2230a489f99d5f2eee31cc3caacc35
6d7257d5d026cee2c8d3a673ed80ba236122bed9bf8504ca5cb846985e99c81a
76e69830b8d2953df45a0acfd2b6290a5f817145f048fce5620d15fc93ef7bb0
92fa835eeba17c1cecced2b77b8442e56c64b849b38c9c45198abcc6f92da365
9d8d90b0d6790c92d58efb1cdb5074ab053686472b2c72bbf6c0b904330dd370
a779ad318a4da0e360b8540a7db4a9353398d5eb877b6b86bd0e5e831ff855b9
bf996a693d8c7b587ecb289bea2789e2141ab78c1ac33e5d1dbb7a7e2d83c69f
c145e601056fb95cf4535f1c2d063aa04d0b85270aedc33de3c5c0cb87fc0caa
c8a05f8286d745f6c593a532f7df92bb742c778b30083f1233e17df9478c9170
cff4895f0f3bb9572b58947952cc8ea899933769b4cefe951caf630315ab39bd
f2e5d114edc565e7c290a9941bf9989c6113936537c397137400314e4098c745

www.edatabook.com Open in urlscan Pro 103.145.50.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

2947 kBTransfer

5863 kBSize

1 Cookies

11 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 18 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

www.edatabook.com Open in urlscan Pro
103.145.50.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

2947 kB
Transfer

5863 kB
Size

1
Cookies

2 HTTP transactions
18 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!