ex-e-co.be
Open in
urlscan Pro
2001:41d0:301::26
Malicious Activity!
Public Scan
URL:
https://ex-e-co.be/it/persone-e-famiglie/login1.php
Submission: On January 21 via api from IE — Scanned from FR
Submission: On January 21 via api from IE — Scanned from FR
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 2001:41d0:301::26, located in
France and
belongs to OVH, FR.
The main domain is ex-e-co.be.
TLS certificate: Issued by R3 on November 10th 2021. Valid for: 3 months.
This is the only time ex-e-co.be was scanned on urlscan.io!
TLS certificate: Issued by R3 on November 10th 2021. Valid for: 3 months.
This is the only time ex-e-co.be was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banca Intesa Sanpaolo (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 2001:41d0:301... 2001:41d0:301::26 | 16276 (OVH) (OVH) | |
| 7 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
ex-e-co.be
ex-e-co.be |
762 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | ex-e-co.be |
ex-e-co.be
|
| 7 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| ex-e-co.be R3 |
2021-11-10 - 2022-02-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ex-e-co.be/it/persone-e-famiglie/login1.php
Frame ID: 474ADCA372AEEDB64E8DB7A425552A83
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
LoginDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
login1.php
ex-e-co.be/it/persone-e-famiglie/ |
12 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
freccia_dx.png
ex-e-co.be/it/persone-e-famiglie/img/ |
579 B 758 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css.css
ex-e-co.be/it/persone-e-famiglie/css/ |
1 MB 472 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.4.1.min.js
ex-e-co.be/it/persone-e-famiglie/js/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
OpenSans-Regular.woff
ex-e-co.be/it/persone-e-famiglie/fonts/ |
18 KB 18 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
OpenSans-Semibold.woff2
ex-e-co.be/it/persone-e-famiglie/fonts/ |
18 KB 18 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ispfont.woff
ex-e-co.be/it/persone-e-famiglie/fonts/ |
219 KB 220 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banca Intesa Sanpaolo (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| limit3 function| limit5 function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ex-e-co.be
2001:41d0:301::26
0130c3c398e9a41a9f5ce8566ef6d7e769128c4c87258fd6f9faa0035cd4cae0
0a763a7e062e07ecff7353150309fe9f272f111778232f4158f0a0525fc3d930
1b1e8c3f482e627078ec3c96a6e96b4d9b7544731e00d443813cf69b26d65aa8
412b8ff9c5ab32b9019fcd84bcd4a54c0e265a14528474f4ee45b27a20abeaeb
57c79375b1419ee1d984f443cda77c04b9b38c0be5330b2d41d65103115ffd72
81f0ec27796225ea29f9f1c7b74f083edcd7bc97a09d5fc4e8d03c0134e62445
dd55b96ea748437e949ebfff8b5b0432ac8f59139aac25b8bed4d9a393b7a1dd