inps.monster Open in urlscan Pro
2606:4700:3035::ac43:ab2a  Malicious Activity! Public Scan

Submitted URL: http://inps.monster/savaiaufamilia
Effective URL: https://inps.monster/savaiaufamilia/
Submission: On November 02 via manual from RO — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3035::ac43:ab2a, located in United States and belongs to CLOUDFLARENET, US. The main domain is inps.monster.
TLS certificate: Issued by E1 on October 24th 2022. Valid for: 3 months.
This is the only time inps.monster was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Intesa Sanpaolo (Banking)

Domain & IP information

IP Address AS Autonomous System
2 2 2606:4700:303... 13335 (CLOUDFLAR...)
1 10 2606:4700:303... 13335 (CLOUDFLAR...)
9 1
Apex Domain
Subdomains
Transfer
12 inps.monster
inps.monster
71 KB
9 1
Domain Requested by
12 inps.monster 3 redirects inps.monster
9 1

This site contains no links.

Subject Issuer Validity Valid
*.inps.monster
E1
2022-10-24 -
2023-01-22
3 months crt.sh

This page contains 3 frames:

Primary Page: https://inps.monster/savaiaufamilia/
Frame ID: 4D2A6C7CCA412B8F8E3DCB8FBC1952D9
Requests: 7 HTTP requests in this frame

Frame: https://inps.monster/savaiaufamilia/iframe.php?theme=dark
Frame ID: F9F91D271189EACB0E5BF7D7F9F0DCB9
Requests: 1 HTTP requests in this frame

Frame: https://inps.monster/savaiaufamilia/iframe.php?theme=dark
Frame ID: 746C17DA5E97CAD6FF5B75D954B396BF
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://inps.monster/savaiaufamilia HTTP 301
    https://inps.monster/savaiaufamilia HTTP 301
    http://inps.monster/savaiaufamilia/ HTTP 301
    https://inps.monster/savaiaufamilia/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc/designs/

Overall confidence: 100%
Detected patterns
  • <[^>]+data-controller

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

69 kB
Transfer

251 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://inps.monster/savaiaufamilia HTTP 301
    https://inps.monster/savaiaufamilia HTTP 301
    http://inps.monster/savaiaufamilia/ HTTP 301
    https://inps.monster/savaiaufamilia/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
inps.monster/savaiaufamilia/
Redirect Chain
  • http://inps.monster/savaiaufamilia
  • https://inps.monster/savaiaufamilia
  • http://inps.monster/savaiaufamilia/
  • https://inps.monster/savaiaufamilia/
23 KB
5 KB
Document
General
Full URL
https://inps.monster/savaiaufamilia/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:ab2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
17015d7b72e92c62528d38904152604397ada185a21fa08a434077115faaf043

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
763f78986a629b40-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 02 Nov 2022 20:03:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hulUVFpW6i9c6Lbj%2FoC9dGJr7u4Druf4iqzNqYmnO4VtoXZkN2HW8A5IAw4yr1MVutlLgzFTYKXmKR3GeyWmkinrbc7%2FYiLNRlaX6nOEQ%2F6HloEyvK3fgXKaEpuThF5Tq5NYLyp120eg4%2FQ%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

CF-RAY
763f78984e029bbe-FRA
Cache-Control
max-age=3600
Connection
keep-alive
Date
Wed, 02 Nov 2022 20:03:00 GMT
Expires
Wed, 02 Nov 2022 21:03:00 GMT
Location
https://inps.monster/savaiaufamilia/
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GD%2BZQjMY7qz9aK0UvxVSBDNf%2Bg8PHQgAft%2FNxeAebs2%2FskWWZveIDHFD5jPGUigFT9lcKug2cTo%2BYbxzqU%2BGFMB0mZvWWVDjSZT7baPOsx8ZkPO7G8vAzPKatc8x8Ro2gqa%2Bdziih%2F9N1I0%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
s.css
inps.monster/savaiaufamilia/
160 KB
23 KB
Stylesheet
General
Full URL
https://inps.monster/savaiaufamilia/s.css
Requested by
Host: inps.monster
URL: https://inps.monster/savaiaufamilia/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:ab2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
003a057f71c19eb3fa65cd4913d6a56ee8c1393ae63549c01f9606cb7ae23597

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://inps.monster/savaiaufamilia/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Wed, 02 Nov 2022 20:03:00 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 02 Nov 2022 19:32:57 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"28049-5ec81e868b4dc-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KgWcG4wN%2B6OY9rZCsjoP0Oogc2Nnw4z6B1WB6xDQT4PsJL639fx6tQU8aJ9X5KqtTVrKVGCmBmdzCYUgYKGoPurRAEfmTYvxIabFFbGGtbfwFwYE7WTgD85n%2F7FxnvOn5HUPWulc8N700LY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
763f7898edfb6964-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
logo.png
inps.monster/savaiaufamilia/etc/designs/vetrina/images/
5 KB
6 KB
Image
General
Full URL
https://inps.monster/savaiaufamilia/etc/designs/vetrina/images/logo.png
Requested by
Host: inps.monster
URL: https://inps.monster/savaiaufamilia/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:ab2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
559bde803d8dedb905509859f3c1d14c9837788f2d5cf6ee26f1518f528d0cf8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://inps.monster/savaiaufamilia/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Wed, 02 Nov 2022 20:03:00 GMT
cf-cache-status
MISS
last-modified
Wed, 02 Nov 2022 18:15:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"146d-5ec80d3076700"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gkHzj0SwM7YGZmogDAiKnJrEFf1kT%2FvY24SsQxpkrCGXytCJf4kYIDtt89eEVDOqUm1b0fvQtbeAq98eh2dbkTuXbs7MeW8XMABN2dw3BBUUhVvvwFeRPVekjWgvdiNi5eup2S%2FkSheb%2BD0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
763f7898edfd6964-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5229
iframe.php
inps.monster/savaiaufamilia/ Frame F9F9
19 KB
5 KB
Document
General
Full URL
https://inps.monster/savaiaufamilia/iframe.php?theme=dark
Requested by
Host: inps.monster
URL: https://inps.monster/savaiaufamilia/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:ab2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9d137aa2ebee16dee724a3971abcd6e200e7cce2b079626bee5538f42de2a76

Request headers

Referer
https://inps.monster/savaiaufamilia/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
763f78990e426964-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 02 Nov 2022 20:03:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zt8cVarkaqdDuJ3Vb2pTxsyloCDFlTB%2B7jlQYDIqE3xZ3I15gz2tZftkdF5Wnyr6dNd5GIzDGzvcOn37nAXQSVdUpv8VHWNiDgD6TicY1QgwfWUZ9kaoTUMOZrkGfrwYYxI8ZcM5iqJAYvc%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
iframe.php
inps.monster/savaiaufamilia/ Frame 746C
19 KB
5 KB
Document
General
Full URL
https://inps.monster/savaiaufamilia/iframe.php?theme=dark
Requested by
Host: inps.monster
URL: https://inps.monster/savaiaufamilia/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:ab2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9d137aa2ebee16dee724a3971abcd6e200e7cce2b079626bee5538f42de2a76

Request headers

Referer
https://inps.monster/savaiaufamilia/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
763f78990e4c6964-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 02 Nov 2022 20:03:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kQvwjgrRsnO%2FJE4qMhh4VHEhNPGr08NaVR4TUxBijtpNonwHlnLk7dxdEQoIGhXyntZIImUa7nN5DBb8ahZOQJAMwBG9c%2F1q94TePgA0DcWJwF%2BQSE4y%2FmygJbwGEbFbwPNGxPJ7HPDI0Es%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
sprites.png
inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/images/
10 KB
10 KB
Image
General
Full URL
https://inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/images/sprites.png
Requested by
Host: inps.monster
URL: https://inps.monster/savaiaufamilia/s.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:ab2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a9148f6e2717336ff367ab00ec1d5eaa172a0a6be1404dd324c28d77804c8cf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://inps.monster/savaiaufamilia/s.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Wed, 02 Nov 2022 20:03:00 GMT
cf-cache-status
MISS
last-modified
Wed, 02 Nov 2022 18:16:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"2605-5ec80d5884580"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hUeRqXK0f3l24AgwX8zARattUNZaKyBXcc2ooplu3jD%2FBv4d%2FrxZka1WifBoPEZnrff5z6%2By8Fju%2Bq2S3JgP5DgyyE3F5%2FuQoEu9jMHAQ5FhvQK%2B8VFh0RU5QFVVEuQ9cN0zjLXkrUMMeq8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
763f7899cfe66964-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
9733
OpenSans-Regular.ttf
inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/fonts/
0
0
Font
General
Full URL
https://inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/fonts/OpenSans-Regular.ttf?2r5i7k
Requested by
Host: inps.monster
URL: https://inps.monster/savaiaufamilia/s.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:ab2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://inps.monster/savaiaufamilia/s.css
Origin
https://inps.monster
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Wed, 02 Nov 2022 20:03:00 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MmpoIEW9ZiOZKb%2BvN52Cb2jcHnc6kRNEVxs0hBHZGC214cjp0ifYohHaO%2BTfY4YTFDf3n1%2B8M%2BJ5b8SnPlzc0po5%2Bpa%2BwMq8ION5rPAGYIp3zgWGOscUCUOW0dCPClOnQo0NiIwvgAonp9A%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
763f7899cfef6964-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
OpenSans-Light.woff2
inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/fonts/
15 KB
15 KB
Font
General
Full URL
https://inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/fonts/OpenSans-Light.woff2
Requested by
Host: inps.monster
URL: https://inps.monster/savaiaufamilia/s.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:ab2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f677ee2d82dfb11f08175f673cf3f065b0d5e491b4485e01259a492715c746e2

Request headers

Referer
https://inps.monster/savaiaufamilia/s.css
Origin
https://inps.monster
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Wed, 02 Nov 2022 20:03:00 GMT
cf-cache-status
MISS
last-modified
Wed, 02 Nov 2022 18:16:04 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"3a54-5ec80d569c100"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YQUDONlM3VLB0ThQC12Bifas2PGkKfIXrnRwhmDZka8IYREDI99D6dPf9yAfn9cL%2BBHa2ugVCMxnT8Oi9jCFQej3StNL3Ma%2Bi7CQvT94BL562BpLyiKEMxXspk399beSUmiiS9siNSvWHRQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
763f7899dff36964-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
14932
OpenSans-Regular.woff
inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/fonts/
0
0
Font
General
Full URL
https://inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/fonts/OpenSans-Regular.woff?2r5i7k
Requested by
Host: inps.monster
URL: https://inps.monster/savaiaufamilia/s.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:ab2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://inps.monster/savaiaufamilia/s.css
Origin
https://inps.monster
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Wed, 02 Nov 2022 20:03:00 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9yyyuiHVnJncdJiWdhmDdoDfkZYD32e27uxt6FKdXeepshWPC0eR4ABNVZMRrpPKRyb%2FaFICG5EyGtDx2zyALFJnFab6%2Bi4hQDgGlKyvtjS19YJpqbAE65NODWpVxlFNf%2FI92ICcEmj%2BFZY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
cache-control
max-age=14400
cf-ray
763f789a38ba6964-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Intesa Sanpaolo (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies

3 Console Messages

Source Level URL
Text
rendering warning URL: https://inps.monster/savaiaufamilia/(Line 4)
Message:
The key "samasugeti" is not recognized and ignored.
network error URL: https://inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/fonts/OpenSans-Regular.ttf?2r5i7k
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://inps.monster/savaiaufamilia/etc/designs/vetrina/clientlib-site/css/fonts/OpenSans-Regular.woff?2r5i7k
Message:
Failed to load resource: the server responded with a status of 404 ()