cpaofredmond.com Open in urlscan Pro
2606:4700:3033::6815:5334 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://link.gy/2429c
Effective URL:
https://cpaofredmond.com/
Submission Tags: 7855344
Submission: On October 18 via api (October 18th 2022, 9:11:12 am UTC) from GB — Scanned from IT

Summary HTTP 17 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3033::6815:5334, located in United States and belongs to CLOUDFLARENET, US. The main domain is cpaofredmond.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 9th 2022. Valid for: a year.

This is the only time cpaofredmond.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BPER Banca (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	2606:4700:303... 2606:4700:3033::6815:5334	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	2

2 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

link.gy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:4700:3033::6815:5334 (United States)

ASN13335 (CLOUDFLARENET, US)

cpaofredmond.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	cpaofredmond.com cpaofredmond.com	273 KB
2	link.gy link.gy	8 KB
17	2

	Domain	Requested by
15	cpaofredmond.com	link.gy cpaofredmond.com
2	link.gy	link.gy
17	2

This site contains links to these domains. Also see Links.

Domain
homebanking.bpergroup.net
www.bper.it

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-12-02` - `2022-12-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://cpaofredmond.com/
Frame ID: 2BD6E80526141514989CA772078C44E9
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Gruppo BPER - SMART MOBILE - Login

Page URL History Show full URLs

https://link.gy/2429c Page URL
https://cpaofredmond.com/ Page URL

Page Statistics

17
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

280 kB
Transfer

312 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://homebanking.bpergroup.net/wps/portal/hb/home/ibpr/sec/login/login?bank=05387&channel=IBPR
Title: clicca qui

Search URL Search Domain Scan URL

URL: http://www.bper.it/wps/bper/banca/bper_istzbper_content/sitoit/homepage/footer/antiriciclaggio/
Title: Antiriciclaggio

Search URL Search Domain Scan URL

URL: http://www.bper.it/wps/bper/banca/bper_istzbper_content/sitoit/homepage/footer/note-legali/
Title: Note Legali

Search URL Search Domain Scan URL

URL: http://www.bper.it/wps/bper/banca/bper_istzbper_content/sitoit/homepage/footer/privacy/
Title: Privacy

Search URL Search Domain Scan URL

URL: http://www.bper.it/wps/bper/banca/bper_istzbper_content/sitoit/homepage/footer/trasparenza/
Title: Trasparenza

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://link.gy/2429c Page URL
https://cpaofredmond.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 301 2429c Show response
link.gy/ 3 KB
3 KB 1743ms
1687ms Document
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://link.gy/2429c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / LINK.GY URL Shortener

Resource Hash

c626ce4c08412468d5db7bd1203eb6c7535670da7dd0fc3ddc3dd6e7abfc2137

Security Headers

Name	Value
Content-Security-Policy	referrer always;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, max-age=90
cf-cache-status: DYNAMIC
cf-ray: 75c025038fc083b4-MXP
content-security-policy: referrer always;
content-type: text/html; charset=utf-8
date: Tue, 18 Oct 2022 09:11:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
referrer-policy: unsafe-url
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3WfvUaLaviSzA%2Buvi2YIdDNzFD1ae0%2Bx2UOfSt%2BfmVxzimEmxbmrVLLYUSXfxmF%2FWmFNyl56n6n2oBFWaULOt4EddUfY%2FkZOnnRJZNzJWfz7fY2jStVESoPiq74YedjKdAh8MRsP"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: LINK.GY URL Shortener

GET
H2 200 rocket-loader.min.js Show response
link.gy/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 21ms
19ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://link.gy/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: link.gy
URL: https://link.gy/2429c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://link.gy/2429c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 11 Oct 2022 13:38:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"634571bd-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gM4dfWs36BXgXtyVAPPvi1XlaxsaSlBKxavfYarUUBmDYPAfoZNhJ9405sQKKp8PRogQa8CTHyvHN88AkNf1xhw6BSh8d2Lv0PkXWIy6iq6taTt6SGoX9k6WhvdEWG3mu0heYBs2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 75c0250e2cc583b4-MXP
expires: Thu, 20 Oct 2022 09:11:07 GMT

GET
H2 200 Primary Request / Show response
cpaofredmond.com/ 15 KB
3 KB 308ms
251ms Document
text/html 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpaofredmond.com/
Requested by: Host: link.gy
URL: https://link.gy/2429c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.0.33
Resource Hash: ef119420eb5ff0592630a8ecc74342f503addaeaf2dd47af871a77e9ecc74faf

Request headers

Referer: https://link.gy/2429c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 75c0250ec8debb06-MXP
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 18 Oct 2022 09:11:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5wJ2co4sSm9BU3b1Q7EmxIuVdf9oKiX%2FBSQ%2F7GVqL7E6OrGMMPJtIZSy3k7XLXFW8eIcMONU2DAh1DT7dPMsf3fjOcdgtdgnvVBH0IBhExyu6ExgZIu%2B17Q8Y0rP9A2FngERPz%2Fd9pEoZRAAqwEc"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.0.33

GET
H3 200 adapter1.css
cpaofredmond.com/asset/ 0
520 B 46ms
23ms Stylesheet
text/css 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpaofredmond.com/asset/adapter1.css
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:07:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 312
etag: "25c1d64-0-5ba8ef723e380"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2KVl%2FXs8aVjLLp1MOhilc1%2FgJvbyxuecLLFg0ar2m6gXL3DrDXvm%2Bup7PdBBEFzgMkiFqVgvNhUoLXhFo6OuecyVwd15o1XUbjOQoGjJ5aNjjGDrNFc8s%2B6%2BwTzMy8dThI3CabMA8wO8X%2BVv%2F85L"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c025109c4b83b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H3 200 adapter2.css
cpaofredmond.com/asset/ 0
477 B 46ms
24ms Stylesheet
text/css 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpaofredmond.com/asset/adapter2.css
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:08:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 312
etag: "25c1d65-0-5ba8ef760ec80"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=11JQvYTqnqW7yTQKpqh14yu7d4lMG3Sx7U1dI1F9d8D00tPwXoLBdZn3WFY5rITB8JxhtFN18yw528W%2Fc52aHeCDVGw6Knd3qIjzLuV0ginNLe2SONQId5dkHoPu%2FzgFes0nuuX3FD%2FiweT04eAw"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c025109c4d83b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H3 200 adapter3.css
cpaofredmond.com/asset/ 0
479 B 52ms
30ms Stylesheet
text/css 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpaofredmond.com/asset/adapter3.css
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:08:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 312
etag: "25c1d5a-0-5ba8ef79df580"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ee541NMSKPwZhf05eqfzwHjLxWE1fnduhLc%2BtBsuMD2uQTjo5kwUoSDkwyYeAAIBMx8Cp1XsAgHuYvx4FK4%2FxOY69CS55zx829D7dCfGD5UT3EkXkSSppzzoy5fbQlB5eKReBB7AmxYv%2FVqMmtml"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c025109c4f83b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H3 200 adapter4.css
cpaofredmond.com/asset/ 0
483 B 51ms
29ms Stylesheet
text/css 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpaofredmond.com/asset/adapter4.css
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:08:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 312
etag: "25c1d66-0-5ba8ef7f98300"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oRU5ZtQaJlSg4eFvC9arfMc5QfUFz2%2Ft%2BhInbE5CKOzAU0TYA9rheClLRR%2BJ5%2BOQFIDFreiE6m0GqHcXr3eFOqhpFQao7fNJAv%2BuimuwfiRRw%2BUDE3vbohjEuFXmFy7jTmj1JnEI2DEkUPr8TXey"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c025109c5183b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H3 200 adapter5.css
cpaofredmond.com/asset/ 745 B
631 B 49ms
28ms Stylesheet
text/css 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpaofredmond.com/asset/adapter5.css
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 97f0a5cf106173089ffb157a2369a5a494831f17cf1b143e080aaf85aabb28a6

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:08:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 312
etag: W/"25c1d62-2e9-5ba8ef8739500-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JWzx443Pw1gBVTzMZ0etSv20xNgx%2FQvbj0lIE3xd5Q3Cod7y%2BsQPENBQu8iVIaMd0yjcXIDSqJtYcRvUNCOOk6jDQGbKa6lEgkFvDYnWR%2BRNveNZYPr1eNqiwyc%2FEgz6OKpyiVEA8WGJwlsjvDAz"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 75c025109c5583b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 adapter6.css
cpaofredmond.com/asset/ 23 KB
4 KB 67ms
46ms Stylesheet
text/css 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpaofredmond.com/asset/adapter6.css
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 810052a83ef5c1a9badb171984b05be6d92742b6e39a99b16ad2f906ef1b51eb

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:09:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 312
etag: W/"25c1d67-5af8-5ba8efc25a080-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SBbGCZX86p0ehClBVrvJKSJhkGzePJa68qalSHV7EtTyzHJ4gVkc1m1dWNbfu6zd4ZyC2hNJGAtLpT2tB80WuYWzdu7sxFGdEEnh9sJdgVxXo4heOEvlyotBLQW7KgX6q8SU8s9Xa17s0tY3AtCF"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 75c025109c5683b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 icona_chiusura.png
cpaofredmond.com/asset/ 383 B
880 B 48ms
47ms Image
image/png 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cpaofredmond.com/asset/icona_chiusura.png
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c20a8e8d6a48dd69db89620ffa6a06c166939f652ffb632d01660d80986fd67

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:03:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2930
etag: "25c1d63-17f-5ba8ee57f4980"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q5XR6hGjnzYLT03u5h3UtPFkErouCPUXV2DSGf48uB6%2B8no4R3ylEHCtBX4Z%2Bsr0kC9dS%2FkagnSwhZKfXG8PbzNmKDKWVnrMySWXF1Z2nQTbJonwXKb3rX8arbRZ%2B%2BrPR9m4m%2B7OjVzi7gqit8Wv"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c02510ac6683b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 383

GET
H3 200 icona_app.png
cpaofredmond.com/asset/ 19 KB
19 KB 29ms
29ms Image
image/png 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cpaofredmond.com/asset/icona_app.png
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35d6e04a6b2d292981e945e91b1b556feed1c0525bcac9016b370a1ce3955cc5

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:03:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2930
etag: "25c1d5c-4abc-5ba8ee57f4980"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5LpCRZIxVxs0yIidM5IrtjX4TyixPeeywpGpZ9bbYsRgsNvqDo3GFSStD%2Fy29PIdBZ80vHzFWbx4UcCbWCEPYaOApZsN3aLUNpX4IBHjSVNgLSqiGl%2BebCBb%2FBlP6dhezD%2FydK5pRea9VhqYlMx3"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c02510ac6783b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19132

GET
H3 200 adv_1.png
cpaofredmond.com/asset/ 9 KB
10 KB 37ms
36ms Image
image/png 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cpaofredmond.com/asset/adv_1.png
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a5057b7f48ff1e0c8341dbf776b51f0e4c9e7b03e8e685621877adb49576e200

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:03:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2930
etag: "25c1d60-24f0-5ba8ee57f4980"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oSJU9cFkbA080Bbuv42KJbBAeM2nA0J2FbAH9%2F3MX0RTHqqI5nrfbGCLd%2FusWwaZ7JXaLhTa4oLZzqsFzCNmDfub02ir4PK23SdNFxtfy2sMPMt62E2gB4Zs2n4iCvbTiVmQLYNDyroQvZOZdvkj"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c02510ac6c83b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9456

GET
H3 200 topBar_100_800.png
cpaofredmond.com/asset/ 43 KB
44 KB 46ms
45ms Image
image/png 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cpaofredmond.com/asset/topBar_100_800.png
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0c4516d42e83a48b994fdc1a1b5b8740a2933258ef1ff378e1c8b98d7a7f0ec

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:10:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 311
etag: "25c1d5f-ac05-5ba8f00333980"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BSkYP3u4NoafVIrS%2B2vCHh%2BIcBOSv1USrk4%2BUtrnx%2F2rH2HqWO23ItHb1l9ZVB20Sgn%2Fvihl6%2FqevwLWnyKdn0b6eu0K4Mk6IusKSZ9rvCshHniyKrrBXLsATyh8b862SHTyVINPOANDDT2eW03B"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c02510ed0283b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44037

GET
H3 200 inputTXT_left_100_800.png
cpaofredmond.com/asset/ 62 KB
63 KB 62ms
61ms Image
image/png 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cpaofredmond.com/asset/inputTXT_left_100_800.png
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 330e464d63e022f4e38f1d1cb1d4f218ae74ed2fdc5635d46efea9da22356104

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:10:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2930
etag: "25c1d5d-f9cc-5ba8f0014b500"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bu%2FcyAcVeoPTRXxIJ7CDCYU7K%2FRrppCDUHdDW%2FO3R5ffznfD1yjKqBN3nMWyiQuSZUhltNRNWnDR1OzjG3pCMsErzqSG4cRalY6RNPr5y6SJ39IDqeehZGEgWAkR%2F1nAyNL6AT6deIrS4v16RFG%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c02510ed0b83b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 63948

GET
H3 200 inputTXT_center_100_800.png
cpaofredmond.com/asset/ 62 KB
62 KB 24ms
23ms Image
image/png 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cpaofredmond.com/asset/inputTXT_center_100_800.png
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9cc4bf0720c976723ec69e4b228e3a87023366fa7dfe0f8472a62b3985281a89

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:10:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2930
etag: "25c1d5e-f780-5ba8efff63080"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ox7Z89wdPLpKvav7RU8xkzUKsf%2BZGEGtYBz224NgHDY%2F4DqeZmwzpnD%2B8EpMQMD4%2BiyPi7hMFYixGD%2BRAaaC5rWpaffdGirs8RLlDVFbhczuP%2FwsuFn3%2B1tybjT7ygzaYoVKPX5IjV82MlYPbbVI"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c02510ed0e83b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 63360

GET
H3 200 inputTXT_right_100_800.png
cpaofredmond.com/asset/ 63 KB
63 KB 44ms
44ms Image
image/png 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cpaofredmond.com/asset/inputTXT_right_100_800.png
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d16db51f5734f4e596320552c7f45d32894cb8b0317c1ca4cde503fd5f1e4256

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:10:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2930
etag: "25c1d5b-fba5-5ba8effd7ac00"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mWBAraoFgqdQyyvdqP6dq%2FL%2FeOPZ03uoOU9uwGIcrUt1J5Q%2FVmQ%2Bq5u5By7yxYnYn8cDf7IhbPaK0FZZ8KKMaT6Ha8%2FBwldmbm5MlYmxx1aq4q%2Fe%2FHm%2BeVAhSRR4kBRFB%2BYdyzlff%2BErXZhm3Rgc"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c02510ed1183b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 64421

GET
H3 200 bottom_bar_100_800.png
cpaofredmond.com/asset/ 362 B
855 B 80ms
80ms Image
image/png 2606:4700:3033::6815:5334
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cpaofredmond.com/asset/bottom_bar_100_800.png
Requested by: Host: cpaofredmond.com
URL: https://cpaofredmond.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:5334 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7310092fbdec879dbac38536057bbebbe01f0a4bda9f5256ad329087c4e873fe

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cpaofredmond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 09:11:07 GMT
cf-cache-status: HIT
last-modified: Fri, 05 Feb 2021 04:10:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2930
etag: "25c1d61-16a-5ba8f0051be00"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cYSDcFlEfGMdOilmy3QKdEhj7Xo6OPnXWra7OCqUaJbNgS9aqi9m%2FX9lTYKEBnDbKr%2BWCKZ95yY%2BRoYj3Q0An%2FriVxDj8JlXxLPY4t5NhSP1WXjlLxhj1ogpzNii7uOTlAUF%2FFgaSdKlJnT6rp2l"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 75c02510ed1383b2-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 362

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BPER Banca (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.link.gy/	1969-12-31 23:59:59	Name: LINKGY Value: f4cgct0u3r6m3qjmcila9ok028

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://link.gy/2429c Message: Unrecognized Content-Security-Policy directive 'referrer'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	referrer always;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cpaofredmond.com
link.gy
2606:4700:3033::6815:5334
2a06:98c1:3121::3
2c20a8e8d6a48dd69db89620ffa6a06c166939f652ffb632d01660d80986fd67
330e464d63e022f4e38f1d1cb1d4f218ae74ed2fdc5635d46efea9da22356104
35d6e04a6b2d292981e945e91b1b556feed1c0525bcac9016b370a1ce3955cc5
7310092fbdec879dbac38536057bbebbe01f0a4bda9f5256ad329087c4e873fe
810052a83ef5c1a9badb171984b05be6d92742b6e39a99b16ad2f906ef1b51eb
97f0a5cf106173089ffb157a2369a5a494831f17cf1b143e080aaf85aabb28a6
9cc4bf0720c976723ec69e4b228e3a87023366fa7dfe0f8472a62b3985281a89
a5057b7f48ff1e0c8341dbf776b51f0e4c9e7b03e8e685621877adb49576e200
c626ce4c08412468d5db7bd1203eb6c7535670da7dd0fc3ddc3dd6e7abfc2137
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d16db51f5734f4e596320552c7f45d32894cb8b0317c1ca4cde503fd5f1e4256
e0c4516d42e83a48b994fdc1a1b5b8740a2933258ef1ff378e1c8b98d7a7f0ec
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef119420eb5ff0592630a8ecc74342f503addaeaf2dd47af871a77e9ecc74faf

cpaofredmond.com Open in urlscan Pro 2606:4700:3033::6815:5334 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

17 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

280 kBTransfer

312 kBSize

1 Cookies

5 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

cpaofredmond.com Open in urlscan Pro
2606:4700:3033::6815:5334 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

280 kB
Transfer

312 kB
Size

1
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!