abandonismod.tk
Open in
urlscan Pro
45.58.52.112
Malicious Activity!
Public Scan
Submitted URL: https://abandonismod.tk/mediolanum
Effective URL: https://abandonismod.tk/mediolanum/h/log.php?MTY2OTM4MzAxN2RlMzY5YWY4MWI0MGNkMTNmYjgzMjQxOTQ5MzhiMGZhNmJkOGUzYzFkYWZjMjU...
Submission: On November 25 via manual from IT — Scanned from IT
Effective URL: https://abandonismod.tk/mediolanum/h/log.php?MTY2OTM4MzAxN2RlMzY5YWY4MWI0MGNkMTNmYjgzMjQxOTQ5MzhiMGZhNmJkOGUzYzFkYWZjMjU...
Submission: On November 25 via manual from IT — Scanned from IT
Summary
This website contacted 5 IPs
in 2 countries
across 4 domains to perform 44 HTTP transactions.
The main IP is 45.58.52.112, located in
Dallas, United States and
belongs to HOSTUS-GLOBAL-AS HostUS, HK.
The main domain is abandonismod.tk.
TLS certificate: Issued by R3 on October 23rd 2022. Valid for: 3 months.
This is the only time abandonismod.tk was scanned on urlscan.io!
TLS certificate: Issued by R3 on October 23rd 2022. Valid for: 3 months.
This is the only time abandonismod.tk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banca Mediolanum (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 37 | 45.58.52.112 45.58.52.112 | 7489 (HOSTUS-GL...) (HOSTUS-GLOBAL-AS HostUS) | |
| 4 | 13.224.189.117 13.224.189.117 | 16509 (AMAZON-02) (AMAZON-02) | |
| 3 | 2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
| 1 2 | 52.6.90.138 52.6.90.138 | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 1 | 2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK) | |
| 44 | 5 |
4
13.224.189.117
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-117.fra2.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-117.fra2.r.cloudfront.net
| cdn.fanplayr.com |
3
2a03:2880:f01c:8012:face:b00c:0:3
(Frankfurt am Main, Germany)
ASN32934 (FACEBOOK, US)
ASN32934 (FACEBOOK, US)
| connect.facebook.net |
2
52.6.90.138
(Ashburn, United States)
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-90-138.compute-1.amazonaws.com
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-90-138.compute-1.amazonaws.com
| my.fanplayr.com | |
| e1.fanplayr.com |
1
2a03:2880:f11c:8183:face:b00c:0:25de
(Frankfurt am Main, Germany)
ASN32934 (FACEBOOK, US)
ASN32934 (FACEBOOK, US)
| www.facebook.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 37 |
abandonismod.tk
2 redirects
abandonismod.tk |
3 MB |
| 6 |
fanplayr.com
1 redirects
cdn.fanplayr.com — Cisco Umbrella Rank: 65054 my.fanplayr.com — Cisco Umbrella Rank: 104550 e1.fanplayr.com — Cisco Umbrella Rank: 76576 |
136 KB |
| 3 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 144 |
39 KB |
| 1 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 110 |
185 B |
| 44 | 4 |
| Domain | Requested by | |
|---|---|---|
| 37 | abandonismod.tk |
2 redirects
abandonismod.tk
|
| 4 | cdn.fanplayr.com |
abandonismod.tk
cdn.fanplayr.com |
| 3 | connect.facebook.net |
abandonismod.tk
connect.facebook.net |
| 1 | www.facebook.com |
abandonismod.tk
|
| 1 | e1.fanplayr.com |
abandonismod.tk
|
| 1 | my.fanplayr.com | 1 redirects |
| 44 | 6 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.abandonismod.tk R3 |
2022-10-23 - 2023-01-21 |
3 months | crt.sh |
| *.fanplayr.com Amazon |
2022-01-07 - 2023-02-04 |
a year | crt.sh |
| *.facebook.com DigiCert SHA2 High Assurance Server CA |
2022-09-03 - 2022-12-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://abandonismod.tk/mediolanum/h/log.php?MTY2OTM4MzAxN2RlMzY5YWY4MWI0MGNkMTNmYjgzMjQxOTQ5MzhiMGZhNmJkOGUzYzFkYWZjMjU4NDMxOGZhYjdjYWI4M2NhMDBiOGJkOTE3MA==
Frame ID: CC8BEFC6FAB171D5682D3C43E2F0718D
Requests: 44 HTTP requests in this frame
Screenshot
Page Title
Banca Mediolanum S.p.A. | Accesso clientiPage URL History Show full URLs
-
https://abandonismod.tk/mediolanum
HTTP 301
https://abandonismod.tk/mediolanum/ HTTP 302
https://abandonismod.tk/mediolanum/h/log.php?MTY2OTM4MzAxN2RlMzY5YWY4MWI0MGNkMTNmYjgzMjQxOTQ5MzhiMGZ... Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Facebook
(Widgets)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Google Tag Manager
(Tag Managers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- googletagmanager\.com/ns\.html[^>]+></iframe>
- <!-- (?:End )?Google Tag Manager -->
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
36 Outgoing links
These are links going to different origins than the main page.
URL: https://www.bancamediolanum.it/
Title: BANCA MEDIOLANUM
Title: BANCA MEDIOLANUM
Search URL Search Domain Scan URL
URL: http://www.familybanker.it/
Title: FAMILY BANKER
Title: FAMILY BANKER
Search URL Search Domain Scan URL
URL: http://www.fondazionemediolanum.it/
Title: FONDAZIONE MEDIOLANUM ONLUS
Title: FONDAZIONE MEDIOLANUM ONLUS
Search URL Search Domain Scan URL
URL: http://www.mediolanumcorporateuniversity.it/
Title: Mediolanum Corporate University
Title: Mediolanum Corporate University
Search URL Search Domain Scan URL
URL: http://www.mediolanumfiduciaria.it/
Title: Mediolanum Fiduciaria
Title: Mediolanum Fiduciaria
Search URL Search Domain Scan URL
URL: https://www.mediolanuminvestmentbanking.it/
Title: Mediolanum Investment Banking
Title: Mediolanum Investment Banking
Search URL Search Domain Scan URL
URL: https://www.bancomediolanum.es/
Title: Banco Mediolanum
Title: Banco Mediolanum
Search URL Search Domain Scan URL
URL: https://www.banklenz.de/
Title: Bankhaus August Lenz
Title: Bankhaus August Lenz
Search URL Search Domain Scan URL
URL: http://www.gamaxfunds.com/
Title: Gamax Management AG
Title: Gamax Management AG
Search URL Search Domain Scan URL
URL: http://www.eurocqs.it/
Title: EuroCQS S.p.A.
Title: EuroCQS S.p.A.
Search URL Search Domain Scan URL
URL: https://www.flowe.com/
Title: Flowe S.p.A. Società Benefit
Title: Flowe S.p.A. Società Benefit
Search URL Search Domain Scan URL
URL: http://www.mediolanumprivatebanker.it/
Title: Private Banking
Title: Private Banking
Search URL Search Domain Scan URL
URL: http://www.centodieci.it/
Title: Centodieci
Title: Centodieci
Search URL Search Domain Scan URL
URL: https://www.mediolanumassicurazioni.it/
Title: Mediolanum Assicurazioni
Title: Mediolanum Assicurazioni
Search URL Search Domain Scan URL
URL: http://www.mediolanumgestionefondi.it/
Title: Mediolanum Gestione Fondi
Title: Mediolanum Gestione Fondi
Search URL Search Domain Scan URL
URL: http://www.mediolanuminternationalfunds.it/
Title: Mediolanum International Funds
Title: Mediolanum International Funds
Search URL Search Domain Scan URL
URL: https://www.mediolanuminternationallife.it/
Title: Mediolanum International Life
Title: Mediolanum International Life
Search URL Search Domain Scan URL
URL: https://www.mediolanumvita.it/
Title: Mediolanum Vita
Title: Mediolanum Vita
Search URL Search Domain Scan URL
URL: https://www.bmedonline.it/
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/mutui-prestiti-online/selfy-shop/
Search URL Search Domain Scan URL
URL: https://comunicazioni.bancamediolanum.it/ricorda-codice-cliente
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/assicurazioni-on-line/selfycare/selfycare-pet
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/il-nostro-modello/multicanalita-app-mobile/il-mio-bilancio
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/assicurazioni-on-line/selfycare/selfycare-travel
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/sicurezza
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/corporate/commitments/emergenza-covid-19
Title: Scopri di più
Title: Scopri di più
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/corporate-governance/dati-societari
Title: Dati societari
Title: Dati societari
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/trasparenza
Title: Trasparenza
Title: Trasparenza
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/reclami-ricorsi-conciliazione
Title: Reclami, ricorsi e conciliazioni
Title: Reclami, ricorsi e conciliazioni
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/promozioni-manifestazioni-a-premio
Title: Promozioni e manifestazioni a premio
Title: Promozioni e manifestazioni a premio
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/corporate-governance/governance
Title: Governance
Title: Governance
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/rapporti-dormienti
Title: Rapporti dormienti
Title: Rapporti dormienti
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/aml-ctf
Title: AML & CTF
Title: AML & CTF
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/privacy
Title: Privacy
Title: Privacy
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/corporate/investors/informative
Title: Bilanci
Title: Bilanci
Search URL Search Domain Scan URL
URL: https://www.bancamediolanum.it/contatti-sede-mediolanum
Title: Contattaci
Title: Contattaci
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://abandonismod.tk/mediolanum
HTTP 301
https://abandonismod.tk/mediolanum/ HTTP 302
https://abandonismod.tk/mediolanum/h/log.php?MTY2OTM4MzAxN2RlMzY5YWY4MWI0MGNkMTNmYjgzMjQxOTQ5MzhiMGZhNmJkOGUzYzFkYWZjMjU4NDMxOGZhYjdjYWI4M2NhMDBiOGJkOTE3MA== Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 34- https://my.fanplayr.com/external.Genius/?callback=jQuery111106942580288859066_1669383019563&a=init&uuid=1669383019570-f2db35f351c9eb5626e9703b&user=0&session=0&url=https%3A%2F%2Fabandonismod.tk%2Fmediolanum%2Fh%2Flog.php%3FMTY2OTM4MzAxN2RlMzY5YWY4MWI0MGNkMTNmYjgzMjQxOTQ5MzhiMGZhNmJkOGUzYzFkYWZjMjU4NDMxOGZhYjdjYWI4M2NhMDBiOGJkOTE3MA%3D%3D&store_domain=abandonismod.tk&tz=0&account=94ff8bc29f9e0580bebcb39c20971e8b&store_data=shopType%3Dcustom%26pageType%3Dpage%26productPrice%3D0%26lineItemCount%3D0%26numItems%3D0%26discount%3D0%26total%3D0%26repeatCart%3Dfalse%26repeatCustomData%3D0%26custom%3D1%26version%3D3&custom_data=&invocation=0&ref=&log_only=0&browser_language=en-US&widget_language=&push=&swv=u&gacid=&idmap=%7B%7D&adaptor=1.0.11&_=1669383019564 HTTP 302
- https://e1.fanplayr.com/external.Genius/?callback=jQuery111106942580288859066_1669383019563&a=init&uuid=1669383019570-f2db35f351c9eb5626e9703b&user=0&session=0&url=https%3A%2F%2Fabandonismod.tk%2Fmediolanum%2Fh%2Flog.php%3FMTY2OTM4MzAxN2RlMzY5YWY4MWI0MGNkMTNmYjgzMjQxOTQ5MzhiMGZhNmJkOGUzYzFkYWZjMjU4NDMxOGZhYjdjYWI4M2NhMDBiOGJkOTE3MA%3D%3D&store_domain=abandonismod.tk&tz=0&account=94ff8bc29f9e0580bebcb39c20971e8b&store_data=shopType%3Dcustom%26pageType%3Dpage%26productPrice%3D0%26lineItemCount%3D0%26numItems%3D0%26discount%3D0%26total%3D0%26repeatCart%3Dfalse%26repeatCustomData%3D0%26custom%3D1%26version%3D3&custom_data=&invocation=0&ref=&log_only=0&browser_language=en-US&widget_language=&push=&swv=u&gacid=&idmap=%7B%7D&adaptor=1.0.11&_=1669383019564
44 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
log.php
abandonismod.tk/mediolanum/h/ Redirect Chain
|
53 KB 53 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
140 KB 140 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-psd2.css
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
405 B 646 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fonts.css
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
all.min.css
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
57 KB 57 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
abandonismod.tk/mediolanum/h/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
platform.min.js
cdn.fanplayr.com/client/production/platform/releases/1.108.0/ |
182 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loader.js
cdn.fanplayr.com/client/production/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
adaptor.js
cdn.fanplayr.com/customers/banca-mediolanum/adaptor/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
103 KB 28 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.3.1.js.t%C3%A9l%C3%A9chargement
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
137 KB 137 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
app.js
abandonismod.tk/mediolanum/h/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
abandonismod.tk/mediolanum/h/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dPg.js.t%C3%A9l%C3%A9chargement
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
215 B 469 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
home_check_err.js.t%C3%A9l%C3%A9chargement
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
840 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARCBM_HomePage.js.t%C3%A9l%C3%A9chargement
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sha1.js.t%C3%A9l%C3%A9chargement
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lightstreamer.js.t%C3%A9l%C3%A9chargement
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
165 KB 165 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tastierino.js.t%C3%A9l%C3%A9chargement
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
homebm_oam1_psd2.js.t%C3%A9l%C3%A9chargement
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
146 KB 146 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
707357396031534
connect.facebook.net/signals/config/ |
20 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
HB-bmed-logo.jpg
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
33 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
user.png
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
788 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ico-alert.png
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bmedonline-desk-selfyshop-tagliarata.png
abandonismod.tk/mediolanum/h/ecm/static-assets/images/upload/ |
461 KB 461 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bmedonline-desk-ricordacodice.png
abandonismod.tk/mediolanum/h/ecm/static-assets/images/upload/ |
156 KB 156 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bmedonline-desk-selfycare-petpng.png
abandonismod.tk/mediolanum/h/ecm/static-assets/images/upload/ |
710 KB 710 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bmedonline-desk-ilmiobilancio.png
abandonismod.tk/mediolanum/h/ecm/static-assets/images/upload/ |
418 KB 419 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bmedonline-selfycare-travel-desk.png
abandonismod.tk/mediolanum/h/ecm/static-assets/images/upload/ |
794 KB 794 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bmedonline-desk-sicurezza-062021.png
abandonismod.tk/mediolanum/h/ecm/static-assets/images/upload/ |
48 KB 48 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-mediolanum.png
abandonismod.tk/mediolanum/h/Banca%20Mediolanum%20S.p.A.%20_%20Accesso%20clienti_files/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arrow-down-nav-gruppo-off.png
abandonismod.tk/mediolanum/h/ecm/static-assets/images/menu/ |
155 B 396 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediolanumsans-regular.otf
abandonismod.tk/mediolanum/h/fonts/webfontkit-20150730-065551/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediolanumsans-bold.otf
abandonismod.tk/mediolanum/h/fonts/webfontkit-20150730-065025/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
platform.min.js
cdn.fanplayr.com/client/production/platform/releases/1.138.0/ |
193 KB 66 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
e1.fanplayr.com/external.Genius/ Redirect Chain
|
84 B 225 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
707357396031534
connect.facebook.net/signals/config/ |
21 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
www.facebook.com/tr/ |
0 185 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediolanumsans-regular.woff2
abandonismod.tk/mediolanum/h/fonts/webfontkit-20150730-065551/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediolanumsans-bold.woff2
abandonismod.tk/mediolanum/h/fonts/webfontkit-20150730-065025/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediolanumsans-regular.woff
abandonismod.tk/mediolanum/h/fonts/webfontkit-20150730-065551/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediolanumsans-bold.woff
abandonismod.tk/mediolanum/h/fonts/webfontkit-20150730-065025/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediolanumsans-regular.ttf
abandonismod.tk/mediolanum/h/fonts/webfontkit-20150730-065551/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mediolanumsans-bold.ttf
abandonismod.tk/mediolanum/h/fonts/webfontkit-20150730-065025/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banca Mediolanum (Financial)188 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Run function| ClearTheLast string| OAM_CODICE_CLIENTE string| OAM_NICKNAME string| SA number| bmed_cr string| crFrom string| crCanale undefined| path number| dPg_loaded undefined| io undefined| test number| home_check_err_loaded function| CLValidateForm function| CLFormatString function| addHighlight function| CLGeneratePosition function| CLRandom function| CLReturnPosition function| whenOnKeyPress function| setCookie function| getCookieData number| ARCBM_HomePage_loaded object| CryptoJS number| sha1_loaded object| fanplayr object| Lightstreamer function| LightstreamerClient function| Subscription object| exp string| dove string| gStrong string| gVsess string| gIdTopic string| gPrefissoCellulare string| gNumeroCellulare string| gSkipCertificazione string| gSkipStrong string| gSkipMaxCert string| gSkipMaxSA string| gStatoCert string| gStatoStrong string| gStatoStrongBannerPsd2 string| gCellunivoco string| gCliC string| pwdCli string| gStrongPin string| gIdPrelogin string| gclientlight string| gCodiceCliente string| gSecurityToken string| gSecLev string| gTipologiaRinvio string| gTipoLayer string| gCodDispoPSD2 boolean| gLastStepPin1 undefined| gTastierino boolean| callLoginStrong string| linkRecCodici string| linkSbloccaBMed string| cClienteVerificato object| fraud string| NUMEROTEL string| NOMECLI string| COGNOMECLI string| CONTI string| PRESSO string| INDIRIZZO string| LOCALITA string| CAP string| COMUNE string| PROVINCIA string| CANONE_DATA_ADD string| CANONE_ERR_NUM string| CANONE_ESENTE string| CANONE_CONTO_ADD string| CANONE_IBAN_CC string| CANONE_PROX_ADD string| IDPRENOTAZIONE string| FIRSTSTEP_ACT string| FIRSTSTEP_ACT_COD string| STATOCEL_CODE string| STATUSSYS_CODE string| STATUSSYS_SYS_STAT string| STATUSSYS_FLG_FAX string| STATUSSYS_ERR_CODE string| INFOCRUSC_LIV_SIC string| GETDAY_DATA_WORK string| ESTRADATA_TODAY string| PREFISSO string| TELEFONO number| IMPORTO string| APPLICA_PRICING string| TIPODISPOSITIVA string| ACTION_CODE string| IN_TIPO_DISP string| IN_ACTION_CODE string| IN_DISPSTATUS string| IN_STATO string| TESTO20SEC string| TESTO_INFO number| gContErrVerificaCod string| oamHost number| stopCert string| request_id boolean| sendSmsAble string| TESTO30SEC string| nmolLogin string| gIDPRELO string| hostToUseLS number| otpError string| sitoAss string| idPRELO string| ipAddress string| testCookie string| cOAMAuthnCookie string| dominioAction function| goRigenearaPin function| prova function| Get_Cookie function| Delete_Cookie function| logInfoAgg function| getQSParam function| tracciaStepGiornale function| funcPost function| lpad function| autenticazione function| controllaPin function| sendSms function| disegnaTemplateSMS function| disegnaTemplateNPU function| disegnaTemplateSMSfake function| loginStrong function| login function| decodeErrorOAM function| accessoLogin function| decodeError function| preLogin function| openPopNmolCertMass function| continuaCertificazioneMass function| openPopNmolCert function| confermaCodiceCert function| sendCodCert function| sendCodSmsCert function| write2Pin function| getMotore function| getInfoDispositiva function| eseguiDispositiva function| setFocus function| onlyNumbers function| chiudiPopup function| skipLastStep function| disabilitaBtnSkip function| skip function| goStep1 function| goStep2 function| goStep3 function| callInfoStrong function| gestisciMsgErrore function| goTokenAppComplete function| goEsitoOK function| openLayerPSD2 function| loginApi function| logoutApi function| loginApi_mia function| openPopNoNomber function| openPopCertDup function| openPopCertDupMass function| openLayerPolizze function| richiediSmsPinDigit function| showToolTip function| hideToolTip function| getPopupSkip string| QS boolean| flgLogin string| re function| createCookie object| dataLayer function| fbq function| _fbq object| fanplayr_api function| fanplayr_ready function| dataLayerTracking function| fpRiprendiPratica function| fpOpenChat undefined| jQuery111106942580288859066_16693830195634 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| abandonismod.tk/mediolanum/h | Name: dPg Value: |
|
| abandonismod.tk/ | Name: PHPSESSID Value: f3e9d7004211b3cf93c7cad061955221 |
|
| abandonismod.tk/ | Name: height Value: 1453 |
|
| .abandonismod.tk/ | Name: fanplayr Value: %7B%22uuid%22%3A%221669383019570-f2db35f351c9eb5626e9703b%22%2C%22uk%22%3A%22%22%2C%22sk%22%3A%22%22%2C%22se%22%3A%22my.fanplayr.com%22%2C%22tm%22%3A1%2C%22t%22%3A1669383019570%7D |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
abandonismod.tk
cdn.fanplayr.com
connect.facebook.net
e1.fanplayr.com
my.fanplayr.com
www.facebook.com
13.224.189.117
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
45.58.52.112
52.6.90.138
171ac238374d53520ded08e6f040948a28f13c83cf1799aef882270358e5c3f1
196f8f13038e05f017d74d86d8f97d5017035f3731e5612273d95ab6a0a87362
204c99aecc46dad620cd024e829a5f26b92817f4b4e32cc7dc336f040c9559ac
21978f9951f5ab48d8b56461dc6100dcb9d345c710e64c661e62a646d29ed822
3190e12e9f0bd2be03ba24763fd5a79aea4ea11a0943acf1b02968c794b1f44c
34d632f00678757d4f0faa4c9da36b0561f05f6cb787180bbd06a75c487c37a4
354fe9332fae4defa00200731e6477c93bc0b0a0a6f9b8fb57b0d59294e4c6d1
3a3cebc4d7a4938330f7ae34c9ddb7318805a2c1f275bd460c6377be4b4efc2e
42660412d013b3f04994265b6e1bc793ee425f1f8bd0fceee866257c1774351e
4521d2660af14ced6628837ff5ec772f2f7bc4467acfaee5d45529065bc322d4
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
6695cb193061215c3db613d4cf150e4ef265bc659e34e1703e2dd87e600b051f
6c2f6c6fcb8dbec4d5376f1273e589e0c5a600e634730c538871d74b4d268720
70a6e755e5b41e829f361709448acb9884b0167341f13388cd9f3fec186d74a4
83105545baa0ba2c920ae5dc59ae5007f5670f354145605046f7ffefeef612fd
8887872dfa818a2c63ba2a496f811cbcbef2e6444c0d343e295e832cece0f510
8b0acc349bbc43762ca2cad5c848da0d23423329efbb4d816cb950498c932167
8bcceb9103e84aff43517180d98a1aef204980aeb41d53e6fbf6da7d767ee316
8c814712ccaf55e4f93469daf010ba277e8569d60781237c3a2ac6eaf81359e1
8d9aab5e84dc6e2446b86ef2b4e65cd50382627f0849b9fb4b64d143669b467c
9958346b69f9d58c4ab135b4595b4504ba7e22b153d3914ccee6ad000d18bad2
a07170bd0e630e10157796e6ef39ade02e9e571fcd1dfa91ec6b81a255fb764f
a9f044e31521b7535854d4892563329dd1672d2d450841ea4702a026186400f8
bc6d5e733245a97d54ea68d8b54c9640a52aa621b2f803bbbf169e0f8c400ee1
c093294bb42d7f10d4788894b8454e450f4a62a15c49875cf223233c0816db3c
c46e9e353091303dc3955f737c3dd0548bd9cc839052bf34b242e107dbfa4260
c5f55211021f7d8a65b7dc50c4bd5f655a94ccfaf6300a9455b92ad44b7d880e
c634fd909e84cad3d846edae0860aaf3930bda62acb1bf3c1dc45548d501662b
d114b1bf43a4891fc61a44116dad3f7f3826a2b4ce2de17431111611fed59902
d11e55e608c2a9bc505f455e31cc4713d5fc952b6aec6f0d405d59f780e6fffa
d5c905d7ce4679b183eb11f7c6811682ddffbf0f037590360ae2b1a84a51ef1b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edc59a3d87e825d0c1b25a810792f9827bc8ac2edb7b77664ef3411511019e40
eef9aac95d6b9483bdef06aecf307043dd6058441012fcb85fc2b7b61a596913
f706d3ab65bc881e780aa6662ef31ab5e900c5ee0eec60971775bab33b102d90
feaaf4e9e2f8cd65ece2416845dbd7513d07029557275eb440497f17a6edd520