supporto-bper-login-sicuro-website-webclient.cfolks.pl Open in urlscan Pro
195.78.66.225 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://cfg.me/webBPER
Effective URL:
https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php
Submission: On January 31 via api (January 31st 2023, 7:15:58 am UTC) from FR — Scanned from IT

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 195.78.66.225, located in Swarzedz, Poland and belongs to CF-GDA, PL. The main domain is supporto-bper-login-sicuro-website-webclient.cfolks.pl.
TLS certificate: Issued by Certum Domain Validation CA SHA2 on August 3rd 2022. Valid for: a year.

This is the only time supporto-bper-login-sicuro-website-webclient.cfolks.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BPER Banca (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 12	195.78.66.225 195.78.66.225	41079 (CF-GDA) (CF-GDA)
11	1

1 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cfg.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 195.78.66.225 (Swarzedz, Poland) 1 redirects

ASN41079 (CF-GDA, PL)
PTR: s130.cyber-folks.pl

supporto-bper-login-sicuro-website-webclient.cfolks.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	cfolks.pl 1 redirects supporto-bper-login-sicuro-website-webclient.cfolks.pl	193 KB
1	cfg.me 1 redirects cfg.me	1003 B
11	2

	Domain	Requested by
12	supporto-bper-login-sicuro-website-webclient.cfolks.pl	1 redirects supporto-bper-login-sicuro-website-webclient.cfolks.pl
1	cfg.me	1 redirects
11	2

This site contains no links.

Subject Issuer	Validity	Valid
*.cfolks.pl Certum Domain Validation CA SHA2	`2022-08-03` - `2023-08-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php
Frame ID: E156651C480B000B23886FC4B8173FF1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BPER

Page URL History Show full URLs

http://cfg.me/webBPER HTTP 303
https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/ HTTP 302
https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Pure CSS (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+(?:([\d.])+/)?pure(?:-min)?\.css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

192 kB
Transfer

276 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cfg.me/webBPER HTTP 303
https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/ HTTP 302
https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request area-riservata.php Show response supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/ Redirect Chain http://cfg.me/webBPER https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/ https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php	6 KB 2 KB	49ms 48ms	Document text/html	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `31dfddeb8efda4bc2f2e68a80df3cf3e54cdc970f7b5531058badfae31c23217` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers content-encoding br content-length 2080 content-type text/html; charset=UTF-8 date Tue, 31 Jan 2023 07:15:53 GMT server LiteSpeed vary Accept-Encoding,User-Agent Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-cache, no-store, must-revalidate, max-age=0 content-length 0 content-type text/html; charset=UTF-8 date Tue, 31 Jan 2023 07:15:53 GMT location ./area-riservata.php server LiteSpeed vary User-Agent
GET H2	200	logo1.jpg supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/	14 KB 14 KB	46ms 46ms	Image image/jpeg	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Show image Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/logo1.jpg Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `5000659534ad5673ed8f0292fe8942fe248e552d4a05ce3d580ad8a9ec560a5d` Request headers accept-language it-IT,it;q=0.9 Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 07:15:53 GMT last-modified Fri, 13 Jan 2023 13:58:34 GMT server LiteSpeed etag "372c-63c1638a-e3a95838b7aeb26c;;;" vary User-Agent content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 14124 expires Tue, 07 Feb 2023 07:15:53 GMT
GET H2	200	pure-min.css supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/	16 KB 4 KB	49ms 49ms	Stylesheet text/css	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/pure-min.css Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `2d0b11cc95b046dabdab9a5bbe9c3035d2db1d7036e644acbb9e00b7c639f3f6` Request headers accept-language it-IT,it;q=0.9 Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 07:15:53 GMT content-encoding br last-modified Fri, 13 Jan 2023 13:58:36 GMT server LiteSpeed etag "4195-63c1638c-ba3d00920ddd09c9;br" vary Accept-Encoding,User-Agent content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 3492 expires Tue, 07 Feb 2023 07:15:53 GMT
GET H2	200	jquery-latest.min.js Show response supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/	84 KB 29 KB	52ms 50ms	Script application/javascript	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/jquery-latest.min.js Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e` Request headers accept-language it-IT,it;q=0.9 Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 07:15:53 GMT content-encoding br last-modified Fri, 13 Jan 2023 13:58:36 GMT server LiteSpeed etag "14e4a-63c1638c-132bc58915c8eb5b;br" vary Accept-Encoding,User-Agent content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 29167 expires Tue, 07 Feb 2023 07:15:53 GMT
GET H2	200	jquery.payform.min.js Show response supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/	16 KB 4 KB	103ms 102ms	Script application/javascript	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/jquery.payform.min.js Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `ddda7da0b1510e2f6916258890d06a64da32e94be54489117ff249f4630fd999` Request headers accept-language it-IT,it;q=0.9 Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 07:15:53 GMT content-encoding br last-modified Fri, 13 Jan 2023 13:58:36 GMT server LiteSpeed etag "4001-63c1638c-b93071c2d41c06cb;br" vary Accept-Encoding,User-Agent content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 4194 expires Tue, 07 Feb 2023 07:15:53 GMT
GET H2	200	bperlogo.jpg supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/	15 KB 15 KB	106ms 105ms	Image image/jpeg	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Show image Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/bperlogo.jpg Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `d9ae869c3dd00f983666dde345708c6939f7f9f2c40077524de594c7783a7951` Request headers accept-language it-IT,it;q=0.9 Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 07:15:53 GMT last-modified Fri, 13 Jan 2023 13:58:36 GMT server LiteSpeed etag "3bab-63c1638c-97edbc6a7baadaa2;;;" vary User-Agent content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 15275 expires Tue, 07 Feb 2023 07:15:53 GMT
GET H2	200	barra.jpg supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/	8 KB 8 KB	121ms 121ms	Image image/jpeg	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Show image Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/barra.jpg Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `4712e2649e9407f997c8708642b3f01a854b61f686d39b4f40979eef1219b2d1` Request headers accept-language it-IT,it;q=0.9 Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 07:15:53 GMT last-modified Fri, 13 Jan 2023 13:58:36 GMT server LiteSpeed etag "1f3f-63c1638c-91c468684ef7a38e;;;" vary User-Agent content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 7999 expires Tue, 07 Feb 2023 07:15:53 GMT
GET H2	200	ludzik.png supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/	19 KB 19 KB	128ms 127ms	Image image/png	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Show image Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/BPER_files/ludzik.png Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `3dd9640aff16fc1e98bc67dfc847817e83f5037234a076a2003511484f8d6cfc` Request headers accept-language it-IT,it;q=0.9 Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 07:15:53 GMT last-modified Fri, 13 Jan 2023 13:58:36 GMT server LiteSpeed etag "4ce2-63c1638c-73133c199241611e;;;" vary User-Agent content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 19682 expires Tue, 07 Feb 2023 07:15:53 GMT
GET H3	200	unicredit-regular.otf supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/fonts/	98 KB 98 KB	46ms 46ms	Font application/x-font-otf	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/fonts/unicredit-regular.otf Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H3 Security QUIC, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `fb3eee259238bb8f097a10f92ad30df49fe02fa3889ee4ee64407514840383a5` Request headers Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Origin https://supporto-bper-login-sicuro-website-webclient.cfolks.pl accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 07:15:53 GMT last-modified Fri, 13 Jan 2023 13:58:34 GMT server LiteSpeed etag "186c0-63c1638a-c3dea60565e50ac6;;;" vary User-Agent content-type application/x-font-otf accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 100032
GET H3	200	push.php Show response supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/	0 54 B	47ms 47ms	XHR text/html	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/push.php?startTime=1675149353&L=&P=&T=&S=START Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H3 Security QUIC, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language it-IT,it;q=0.9 Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers access-control-allow-origin * date Tue, 31 Jan 2023 07:15:55 GMT server LiteSpeed content-length 0 vary User-Agent content-type text/html; charset=UTF-8
GET H3	200	push.php Show response supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/	0 34 B	48ms 47ms	XHR text/html	195.78.66.225 CF-GDA
General Check archive.org Show headers Download Go to Full URL https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/push.php?startTime=1675149353&L=&P=&T=&S=START Requested by Host: supporto-bper-login-sicuro-website-webclient.cfolks.pl URL: https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php Protocol H3 Security QUIC, , AES_128_GCM Server 195.78.66.225 Swarzedz, Poland, ASN41079 (CF-GDA, PL), Reverse DNS s130.cyber-folks.pl Software LiteSpeed / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language it-IT,it;q=0.9 Referer https://supporto-bper-login-sicuro-website-webclient.cfolks.pl/application/mobile/public/webapp/digital-login/area-riservata.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers access-control-allow-origin * date Tue, 31 Jan 2023 07:15:57 GMT server LiteSpeed content-length 0 vary User-Agent content-type text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BPER Banca (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cfg.me
supporto-bper-login-sicuro-website-webclient.cfolks.pl
195.78.66.225
2a06:98c1:3121::3
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2d0b11cc95b046dabdab9a5bbe9c3035d2db1d7036e644acbb9e00b7c639f3f6
31dfddeb8efda4bc2f2e68a80df3cf3e54cdc970f7b5531058badfae31c23217
3dd9640aff16fc1e98bc67dfc847817e83f5037234a076a2003511484f8d6cfc
4712e2649e9407f997c8708642b3f01a854b61f686d39b4f40979eef1219b2d1
5000659534ad5673ed8f0292fe8942fe248e552d4a05ce3d580ad8a9ec560a5d
d9ae869c3dd00f983666dde345708c6939f7f9f2c40077524de594c7783a7951
ddda7da0b1510e2f6916258890d06a64da32e94be54489117ff249f4630fd999
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb3eee259238bb8f097a10f92ad30df49fe02fa3889ee4ee64407514840383a5

supporto-bper-login-sicuro-website-webclient.cfolks.pl Open in urlscan Pro 195.78.66.225 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

192 kBTransfer

276 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

supporto-bper-login-sicuro-website-webclient.cfolks.pl Open in urlscan Pro
195.78.66.225 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

192 kB
Transfer

276 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!