URL: http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da8931...
Submission: On October 27 via automatic, source openphish

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 4 HTTP transactions. The main IP is 193.204.39.14, located in Pavia, Italy and belongs to ASGARR Consortium GARR, IT. The main domain is biblioenrico.imati.cnr.it.
This is the only time biblioenrico.imati.cnr.it was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 193.204.39.14 137 (ASGARR Co...)
1 46.105.76.250 16276 (OVH)
1 52.209.165.110 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
4 4
Domain Requested by
1 www.youtube.com biblioenrico.imati.cnr.it
1 www.stickpng.com biblioenrico.imati.cnr.it
1 fotokiklosi.gr biblioenrico.imati.cnr.it
1 biblioenrico.imati.cnr.it
4 4

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
Subject Issuer Validity Valid
*.google.com
Google Internet Authority G3
2018-10-09 -
2019-01-01
3 months crt.sh

This page contains 2 frames:

Primary Page: http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da893165b97cf0afd973818a78e&dispatch=2743d0ec4a8c1ef62455d198f83e7dc83d3d8a13
Frame ID: C93995B2C8E3F35139BF7533C01EF114
Requests: 3 HTTP requests in this frame

Frame: https://www.youtube.com/v/YIpNFB2rFEY&autoplay=1
Frame ID: 8428F3218FA7E07AB232F0A1CCC0E1BC
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /CentOS/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

4
Requests

25 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

24 kB
Transfer

23 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request car.php
biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/
4 KB
5 KB
Document
General
Full URL
http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da893165b97cf0afd973818a78e&dispatch=2743d0ec4a8c1ef62455d198f83e7dc83d3d8a13
Protocol
HTTP/1.1
Server
193.204.39.14 Pavia, Italy, ASN137 (ASGARR Consortium GARR, IT),
Reverse DNS
ntadriana.imati.cnr.it
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
5df7af105064ee4c9b22f89d3703f107dc00da95ac15e661e6549a098ae8abdf

Request headers

Host
biblioenrico.imati.cnr.it
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 27 Oct 2018 01:07:45 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Content-Length
4498
Connection
close
Content-Type
text/html; charset=UTF-8
custom_iconfacebook_skin.png
fotokiklosi.gr/wp-content/uploads/2018/01//
7 KB
8 KB
Image
General
Full URL
http://fotokiklosi.gr/wp-content/uploads/2018/01//custom_iconfacebook_skin.png
Requested by
Host: biblioenrico.imati.cnr.it
URL: http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da893165b97cf0afd973818a78e&dispatch=2743d0ec4a8c1ef62455d198f83e7dc83d3d8a13
Protocol
HTTP/1.1
Server
46.105.76.250 , France, ASN16276 (OVH, FR),
Reverse DNS
ns450.easy.gr
Software
Apache / PleskLin
Resource Hash
098230a3aaaed035fd352c52cae4eb40f9cccd227a34879759ecdcfe37ff69cb

Request headers

Referer
http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da893165b97cf0afd973818a78e&dispatch=2743d0ec4a8c1ef62455d198f83e7dc83d3d8a13
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 27 Oct 2018 01:45:22 GMT
Last-Modified
Wed, 17 Jan 2018 08:07:28 GMT
Server
Apache
X-Powered-By
PleskLin
ETag
"218a5-1d1c-562f456a86795"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=40
Content-Length
7452
580b57fcd9996e24bc43c53e.png
www.stickpng.com/assets/images/
11 KB
11 KB
Image
General
Full URL
http://www.stickpng.com/assets/images/580b57fcd9996e24bc43c53e.png
Requested by
Host: biblioenrico.imati.cnr.it
URL: http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da893165b97cf0afd973818a78e&dispatch=2743d0ec4a8c1ef62455d198f83e7dc83d3d8a13
Protocol
HTTP/1.1
Server
52.209.165.110 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-209-165-110.eu-west-1.compute.amazonaws.com
Software
Cowboy /
Resource Hash
7036f3620117ad19c36881ef7322af77dec111cc717e1d9c1dcee23c45313125
Security Headers
Name Value
X-Frame-Options DENY

Request headers

Referer
http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da893165b97cf0afd973818a78e&dispatch=2743d0ec4a8c1ef62455d198f83e7dc83d3d8a13
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 27 Oct 2018 01:45:23 GMT
Via
1.1 vegur
Last-Modified
Sat, 22 Oct 2016 12:38:26 GMT
Server
Cowboy
Etag
"3d74e8bfd4ef7985f7529bb9f7650eca"
X-Frame-Options
DENY
Content-Type
image/png
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
11381
YIpNFB2rFEY&autoplay=1
www.youtube.com/v/ Frame 8428
0
0
Document
General
Full URL
https://www.youtube.com/v/YIpNFB2rFEY&autoplay=1
Requested by
Host: biblioenrico.imati.cnr.it
URL: http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da893165b97cf0afd973818a78e&dispatch=2743d0ec4a8c1ef62455d198f83e7dc83d3d8a13
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
YouTube Frontend Proxy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://www.google.com/appserve/security-bugs/log/youtube

Request headers

:method
GET
:authority
www.youtube.com
:scheme
https
:path
/v/YIpNFB2rFEY&autoplay=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da893165b97cf0afd973818a78e&dispatch=2743d0ec4a8c1ef62455d198f83e7dc83d3d8a13
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://biblioenrico.imati.cnr.it/sites/default/files/private/hola/supp/1cf46/dir/car.php?cmd=_account-details&session=f8f84da893165b97cf0afd973818a78e&dispatch=2743d0ec4a8c1ef62455d198f83e7dc83d3d8a13

Response headers

status
404
strict-transport-security
max-age=31536000
content-type
text/html; charset=utf-8
cache-control
no-cache
expires
Tue, 27 Apr 1971 19:44:06 EST
content-length
0
x-xss-protection
1; mode=block; report=https://www.google.com/appserve/security-bugs/log/youtube
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
x-content-type-options
nosniff
date
Sat, 27 Oct 2018 01:45:22 GMT
server
YouTube Frontend Proxy
set-cookie
VISITOR_INFO1_LIVE=eu-y2AInEOI; path=/; domain=.youtube.com; expires=Thu, 25-Apr-2019 01:45:22 GMT; httponly YSC=gKknnrcEqOo; path=/; domain=.youtube.com; httponly VISITOR_INFO1_LIVE=eu-y2AInEOI; path=/; domain=.youtube.com; expires=Thu, 25-Apr-2019 01:45:22 GMT; httponly PREF=f1=50000000; path=/; domain=.youtube.com; expires=Thu, 27-Jun-2019 13:38:22 GMT GPS=1; path=/; domain=.youtube.com; expires=Sat, 27-Oct-2018 02:15:22 GMT
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| snowmax object| snowcolor object| snowtype string| snowletter number| sinkspeed number| snowmaxsize number| snowminsize number| snowingzone object| snow number| marginbottom number| marginright undefined| timer number| i_snow object| x_mv object| crds object| lftrght string| browserinfos undefined| ie5 boolean| ns6 object| opera boolean| browserok function| randommaker function| initsnow function| movesnow number| rand

4 Cookies

Domain/Path Name / Value
.youtube.com/ Name: PREF
Value: f1=50000000
.youtube.com/ Name: GPS
Value: 1
.youtube.com/ Name: YSC
Value: gKknnrcEqOo
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: eu-y2AInEOI