www.bacinopescabvicenza.it Open in urlscan Pro
185.2.4.48 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bacinopescabvicenza.it/wp-user/
Submission: On January 02 via api (January 2nd 2023, 8:28:47 am UTC) from CH — Scanned from IT

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 16 HTTP transactions. The main IP is 185.2.4.48, located in Italy and belongs to REGISTER_UK-AS, IT. The main domain is www.bacinopescabvicenza.it.
TLS certificate: Issued by R3 on December 8th 2022. Valid for: 3 months.

This is the only time www.bacinopescabvicenza.it was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Emirates Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
9	185.2.4.48 185.2.4.48	203461 (REGISTER_...) (REGISTER_UK-AS)
1	2606:4700::68... 2606:4700::6810:5814	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
16	5

9 185.2.4.48 (Italy)

ASN203461 (REGISTER_UK-AS, IT)
PTR: lhcp1048.webapps.net

www.bacinopescabvicenza.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5814 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	bacinopescabvicenza.it www.bacinopescabvicenza.it	177 KB
3	gstatic.com fonts.gstatic.com	36 KB
2	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3022	83 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 127	1 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 488	9 KB
16	5

	Domain	Requested by
9	www.bacinopescabvicenza.it	www.bacinopescabvicenza.it
3	fonts.gstatic.com	fonts.googleapis.com
2	stackpath.bootstrapcdn.com	www.bacinopescabvicenza.it stackpath.bootstrapcdn.com
1	fonts.googleapis.com	www.bacinopescabvicenza.it
1	cdn.jsdelivr.net	www.bacinopescabvicenza.it
16	5

This site contains no links.

Subject Issuer	Validity	Valid
bacinopescabvicenza.it R3	`2022-12-08` - `2023-03-08`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.bacinopescabvicenza.it/wp-user/
Frame ID: 0B4FB9DC83E6E0D046202330872FAE35
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Emirates Post

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

16
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

307 kB
Transfer

644 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.bacinopescabvicenza.it/wp-user/ 11 KB
2 KB 278ms
194ms Document
text/html 185.2.4.48
REGISTER_UK-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bacinopescabvicenza.it/wp-user/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.2.4.48 , Italy, ASN203461 (REGISTER_UK-AS, IT),
Reverse DNS: lhcp1048.webapps.net
Software: Apache / PHP/7.2.34
Resource Hash: 902932ce2ba59a825b03b4a9c47bf6ed6c44313be018260740e3fb495c64ebc1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1861
Content-Type: text/html; charset=UTF-8
Date: Mon, 02 Jan 2023 08:28:43 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=150
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Powered-By: PHP/7.2.34

GET
H2 200 bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ 64 KB
9 KB 58ms
24ms Stylesheet
text/css 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css

Requested by

Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 02 Jan 2023 08:28:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 24793605
x-jsd-version: 1.5.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19164-FRA, cache-mxp6960-MXP
x-jsd-version-type: version
server: cloudflare
etag: W/"100a0-GGXd3Lt7Z9zvQlDlkMyalXSrpnM"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F9TqY1dV4VOfBw53LlHeirdCU5f8y8Wjtl2NBFZtNTMtxGhtm5w6wwfj8LD2omCOC2HokC8BVBP2%2Bg6etvvG2Yj20AVWPcJASsc50Q6lY35GDUUGXwNQPmhXmaeaZP6fB3aRDvs%2FY4fokwmQBz4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 78321f7359585a0d-MXP

GET
H2 200 font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 66ms
23ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 02 Jan 2023 08:28:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 617
age: 16680538
cdn-cachedat: 10/15/2021 13:58:25
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.0
cdn-requestpullcode: 200
server: cloudflare
etag: W/"269550530cc127b6aa5a35925a7de6ce"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cdn-cache: HIT
access-control-allow-origin: *
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: c3d9a235cd11da664c3f825570e85cf0
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 78321f736881baa0-MXP
cdn-requestpullsuccess: True

GET
H/1.1 200
OK bootstrap.css
www.bacinopescabvicenza.it/wp-user/css/ 188 KB
25 KB 47ms
47ms Stylesheet
text/css 185.2.4.48
REGISTER_UK-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bacinopescabvicenza.it/wp-user/css/bootstrap.css
Requested by: Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.2.4.48 , Italy, ASN203461 (REGISTER_UK-AS, IT),
Reverse DNS: lhcp1048.webapps.net
Software: Apache /
Resource Hash: 0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/wp-user/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 02 Jan 2023 08:28:43 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Nov 2022 22:47:36 GMT
Server: Apache
ETag: "1e402df-2f1f7-5ecfd538a3200-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 24828

GET
H/1.1 200
OK boom.css
www.bacinopescabvicenza.it/wp-user/css/ 10 KB
2 KB 120ms
41ms Stylesheet
text/css 185.2.4.48
REGISTER_UK-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bacinopescabvicenza.it/wp-user/css/boom.css
Requested by: Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.2.4.48 , Italy, ASN203461 (REGISTER_UK-AS, IT),
Reverse DNS: lhcp1048.webapps.net
Software: Apache /
Resource Hash: 8cc26f4531eebbed3ee9f5f62b49005abf0993c1fb7af68fc4b948dee73eb7da

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/wp-user/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 02 Jan 2023 08:28:43 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Nov 2022 22:47:36 GMT
Server: Apache
ETag: "1e402dc-29a8-5ecfd538a3200-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 2041

GET
H/1.1 200
OK Emarats.png
www.bacinopescabvicenza.it/wp-user/image/ 17 KB
17 KB 124ms
41ms Image
image/png 185.2.4.48
REGISTER_UK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bacinopescabvicenza.it/wp-user/image/Emarats.png
Requested by: Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.2.4.48 , Italy, ASN203461 (REGISTER_UK-AS, IT),
Reverse DNS: lhcp1048.webapps.net
Software: Apache /
Resource Hash: 2e6c37dce49aa29359da9f8213274dd675646341fb974561dcd467ad50d65beb

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/wp-user/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 02 Jan 2023 08:28:43 GMT
Last-Modified: Tue, 08 Nov 2022 22:47:36 GMT
Server: Apache
ETag: "1e402ec-42c0-5ecfd538a3200"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 17088

GET
H/1.1 200
OK one_fot.png
www.bacinopescabvicenza.it/wp-user/image/ 4 KB
5 KB 124ms
42ms Image
image/png 185.2.4.48
REGISTER_UK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bacinopescabvicenza.it/wp-user/image/one_fot.png
Requested by: Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.2.4.48 , Italy, ASN203461 (REGISTER_UK-AS, IT),
Reverse DNS: lhcp1048.webapps.net
Software: Apache /
Resource Hash: 17387bd69df120b4c3308535376487c20ddd06201c5556a3a9c73995791e0451

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/wp-user/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 02 Jan 2023 08:28:43 GMT
Last-Modified: Tue, 08 Nov 2022 22:47:36 GMT
Server: Apache
ETag: "1e402ee-11f8-5ecfd538a3200"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 4600

GET
H/1.1 200
OK two_fot.png
www.bacinopescabvicenza.it/wp-user/image/ 3 KB
3 KB 55ms
41ms Image
image/png 185.2.4.48
REGISTER_UK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bacinopescabvicenza.it/wp-user/image/two_fot.png
Requested by: Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.2.4.48 , Italy, ASN203461 (REGISTER_UK-AS, IT),
Reverse DNS: lhcp1048.webapps.net
Software: Apache /
Resource Hash: acc0310e90ebd8e08982a24361bd64e1794780909b4494f592bd1c0cc8523a75

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/wp-user/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 02 Jan 2023 08:28:43 GMT
Last-Modified: Tue, 08 Nov 2022 22:47:36 GMT
Server: Apache
ETag: "1e40832-a5e-5ecfd538a3200"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 2654

GET
H/1.1 200
OK jquery-3.5.1.min.js Show response
www.bacinopescabvicenza.it/wp-user/js/ 87 KB
31 KB 116ms
45ms Script
application/javascript 185.2.4.48
REGISTER_UK-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bacinopescabvicenza.it/wp-user/js/jquery-3.5.1.min.js
Requested by: Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.2.4.48 , Italy, ASN203461 (REGISTER_UK-AS, IT),
Reverse DNS: lhcp1048.webapps.net
Software: Apache /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/wp-user/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 02 Jan 2023 08:28:43 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Nov 2022 22:47:36 GMT
Server: Apache
ETag: "1e4103b-15d84-5ecfd538a3200-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=148
Content-Length: 30910

GET
H/1.1 200
OK jquery.mask.js Show response
www.bacinopescabvicenza.it/wp-user/js/ 23 KB
6 KB 121ms
41ms Script
application/javascript 185.2.4.48
REGISTER_UK-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bacinopescabvicenza.it/wp-user/js/jquery.mask.js
Requested by: Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.2.4.48 , Italy, ASN203461 (REGISTER_UK-AS, IT),
Reverse DNS: lhcp1048.webapps.net
Software: Apache /
Resource Hash: a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/wp-user/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 02 Jan 2023 08:28:43 GMT
Content-Encoding: gzip
Last-Modified: Tue, 08 Nov 2022 22:47:36 GMT
Server: Apache
ETag: "1e4103a-5a88-5ecfd538a3200-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 5877

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
1 KB 116ms
35ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Titillium+Web:ital,wght@0,200;0,300;0,400;0,600;0,700;0,900;1,200;1,300;1,400;1,600;1,700&display=swap

Requested by

Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/css/boom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8fadd588b390d9dd77751078dcd6233bcb6bbe81e06851c329cb717c7c7f9d42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 02 Jan 2023 08:28:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 02 Jan 2023 08:00:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 02 Jan 2023 08:28:43 GMT

GET
H/1.1 200
OK background.jpg
www.bacinopescabvicenza.it/wp-user/image/ 87 KB
87 KB 41ms
41ms Image
image/jpeg 185.2.4.48
REGISTER_UK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bacinopescabvicenza.it/wp-user/image/background.jpg
Requested by: Host: www.bacinopescabvicenza.it
URL: https://www.bacinopescabvicenza.it/wp-user/css/boom.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.2.4.48 , Italy, ASN203461 (REGISTER_UK-AS, IT),
Reverse DNS: lhcp1048.webapps.net
Software: Apache /
Resource Hash: 54ebe1cfd007f0f18e87c8b4ade278766ec32c5e2240463a32a5c9228d17a786

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.bacinopescabvicenza.it/wp-user/css/boom.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 02 Jan 2023 08:28:43 GMT
Last-Modified: Tue, 08 Nov 2022 22:47:36 GMT
Server: Apache
ETag: "1e402e5-15a76-5ecfd538a3200"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 88694

GET
H3 200 fontawesome-webfont.woff2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 75 KB
76 KB 41ms
23ms Font
font/woff2 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: stackpath.bootstrapcdn.com
URL: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin: https://www.bacinopescabvicenza.it
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 02 Jan 2023 08:28:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 752
age: 11852
cdn-cachedat: 08/17/2022 18:20:14
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77160
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
server: cloudflare
etag: "af7ae505a9eed503f8b8e6982036873e"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: d6212dd977a91edca936f499684f7c2b
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 78321f74dd3783a0-MXP
cdn-requestpullsuccess: True

GET
H2 200 NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzYw.woff2
fonts.gstatic.com/s/titilliumweb/v15/ 12 KB
12 KB 85ms
26ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v15/NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzYw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Titillium+Web:ital,wght@0,200;0,300;0,400;0,600;0,700;0,900;1,200;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd870101ad4e95d687a2eb734707b0dd7c20808f76d7be77a71a5d13cf99401c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bacinopescabvicenza.it
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 17:13:59 GMT
x-content-type-options: nosniff
age: 227684
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12136
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:39:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Dec 2023 17:13:59 GMT

GET
H2 200 NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2
fonts.gstatic.com/s/titilliumweb/v15/ 12 KB
12 KB 108ms
49ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v15/NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Titillium+Web:ital,wght@0,200;0,300;0,400;0,600;0,700;0,900;1,200;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5c1172f24f4f49f780c65cf5be897527fd08f3662a2ba8db0cfe0057d92e367

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bacinopescabvicenza.it
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 21:37:39 GMT
x-content-type-options: nosniff
age: 298264
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11796
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:47:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 21:37:39 GMT

GET
H2 200 NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2
fonts.gstatic.com/s/titilliumweb/v15/ 12 KB
12 KB 89ms
30ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v15/NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Titillium+Web:ital,wght@0,200;0,300;0,400;0,600;0,700;0,900;1,200;1,300;1,400;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

557f6d0883db85be712c3a77baa38875ddf99ecbdfd6fec98e5c0b1f7a0e1532

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bacinopescabvicenza.it
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 28 Dec 2022 19:24:57 GMT
x-content-type-options: nosniff
age: 392626
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12372
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:19:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 Dec 2023 19:24:57 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Emirates Post (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.bacinopescabvicenza.it/	1969-12-31 23:59:59	Name: PHPSESSID Value: 09b7e203916ab630aeed922d8fa925cb

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
stackpath.bootstrapcdn.com
www.bacinopescabvicenza.it
185.2.4.48
2606:4700::6810:5814
2606:4700::6812:acf
2a00:1450:4001:811::200a
2a00:1450:4001:82b::2003
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334
17387bd69df120b4c3308535376487c20ddd06201c5556a3a9c73995791e0451
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2e6c37dce49aa29359da9f8213274dd675646341fb974561dcd467ad50d65beb
3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef
54ebe1cfd007f0f18e87c8b4ade278766ec32c5e2240463a32a5c9228d17a786
557f6d0883db85be712c3a77baa38875ddf99ecbdfd6fec98e5c0b1f7a0e1532
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8cc26f4531eebbed3ee9f5f62b49005abf0993c1fb7af68fc4b948dee73eb7da
8fadd588b390d9dd77751078dcd6233bcb6bbe81e06851c329cb717c7c7f9d42
902932ce2ba59a825b03b4a9c47bf6ed6c44313be018260740e3fb495c64ebc1
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
acc0310e90ebd8e08982a24361bd64e1794780909b4494f592bd1c0cc8523a75
d5c1172f24f4f49f780c65cf5be897527fd08f3662a2ba8db0cfe0057d92e367
dd870101ad4e95d687a2eb734707b0dd7c20808f76d7be77a71a5d13cf99401c
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

www.bacinopescabvicenza.it Open in urlscan Pro 185.2.4.48 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

307 kBTransfer

644 kBSize

1 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

www.bacinopescabvicenza.it Open in urlscan Pro
185.2.4.48 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

307 kB
Transfer

644 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!