pdf-pagamento-della-fattura.web.app
Open in
urlscan Pro
2620:0:890::100
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On October 20 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1D4 on October 19th 2022. Valid for: 3 months.
This is the only time pdf-pagamento-della-fattura.web.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Adobe (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2620:0:890::100 2620:0:890::100 | 54113 (FASTLY) (FASTLY) | |
2 | 2606:4700::68... 2606:4700::6810:5614 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 143.204.203.34 143.204.203.34 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:214... 2600:9000:214f:9c00:6:4afb:9140:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
8 | 5 |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-203-34.fra53.r.cloudfront.net
static.adobelogin.com |
ASN16509 (AMAZON-02, US)
cdn.mcauto-images-production.sendgrid.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 216 |
36 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 394 |
53 KB |
2 |
web.app
pdf-pagamento-della-fattura.web.app |
3 KB |
1 |
sendgrid.net
cdn.mcauto-images-production.sendgrid.net — Cisco Umbrella Rank: 21272 |
42 KB |
1 |
adobelogin.com
static.adobelogin.com — Cisco Umbrella Rank: 32547 |
4 KB |
8 | 5 |
Domain | Requested by | |
---|---|---|
2 | cdnjs.cloudflare.com |
pdf-pagamento-della-fattura.web.app
|
2 | cdn.jsdelivr.net |
pdf-pagamento-della-fattura.web.app
|
2 | pdf-pagamento-della-fattura.web.app |
pdf-pagamento-della-fattura.web.app
|
1 | cdn.mcauto-images-production.sendgrid.net |
pdf-pagamento-della-fattura.web.app
|
1 | static.adobelogin.com |
pdf-pagamento-della-fattura.web.app
|
8 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
web.app GTS CA 1D4 |
2022-10-19 - 2023-01-17 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
static.adobelogin.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-06 - 2023-07-07 |
a year | crt.sh |
cdn.mcauto-images-production.sendgrid.net Amazon |
2022-05-19 - 2023-06-17 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pdf-pagamento-della-fattura.web.app/?w=p.gelato%40inail.it&data=05%7C01%7Cioc%40inail.it%7C85a0bb7e560e460f000508dab1f9cb1b%7C418322d35401446f99969e2e03ee3a5e%7C0%7C0%7C638017984952741686%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXV
Frame ID: 41E6E3520F135FC81F4F77558A079BA9
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
PDF ONLINEDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
pdf-pagamento-della-fattura.web.app/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/css/ |
190 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4x_817cf14a2f3fcff4ee6d4e35c5026779.png
static.adobelogin.com/clients/virgoweb-2020/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/ |
88 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/js/ |
78 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.5/ |
24 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
pdf-pagamento-della-fattura.web.app/ |
4 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1366x768.jpg
cdn.mcauto-images-production.sendgrid.net/32724a092ad701f7/c6e2282d-8a53-44c8-9b7c-262b2479f731/ |
41 KB 42 KB |
Image
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Adobe (Consumer)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation number| uidEvent object| bootstrap function| setAddressField function| isEmail function| startTimer0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdn.mcauto-images-production.sendgrid.net
cdnjs.cloudflare.com
pdf-pagamento-della-fattura.web.app
static.adobelogin.com
143.204.203.34
2600:9000:214f:9c00:6:4afb:9140:93a1
2606:4700::6810:5614
2606:4700::6811:190e
2620:0:890::100
270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820
6ec0a7c90cd3c73fc4f7b4c5d098a3cd6546e13c0f9101ccdf7ef255d7dc7c08
8d1f9d1b356371a86587ce39318b55eef4ee5dceb0e13e61b5ce7f8c147e3dc3
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
bf2c42990195a30809f22c5097c932f55e458d68220a542d1260a62e07fd23c5
c0c09020adb6f602b16d48374166b9e38ca92383a81650b6a9097c43cc43f31f
e61d76a5ce6532cc01241cdb4028157ed3c5f3a3d45cb0f0e01f3a961d3a7c01
ed959b654022f7bae48ab9380dc129e065833e45a944c70d684c971ac3578cb8