www.pallavoloantares.it

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 89.46.104.40, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.pallavoloantares.it.
TLS certificate: Issued by Actalis Domain Validation Server CA G3 on August 24th 2020. Valid for: 10 months.

This is the only time www.pallavoloantares.it was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a00:1450:400... 2a00:1450:4001:800::2013	15169 (GOOGLE) (GOOGLE)
2 8	89.46.104.40 89.46.104.40	31034 (ARUBA-ASN) (ARUBA-ASN)
6	2

1 2a00:1450:4001:800::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

arahd.aramlicy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 89.46.104.40 (Arezzo, Italy) 2 redirects

ASN31034 (ARUBA-ASN, IT)
PTR: webx1030.aruba.it

www.pallavoloantares.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	pallavoloantares.it 2 redirects www.pallavoloantares.it	199 KB
1	aramlicy.com 1 redirects arahd.aramlicy.com	249 B
6	2

	Domain	Requested by
8	www.pallavoloantares.it	2 redirects www.pallavoloantares.it
1	arahd.aramlicy.com	1 redirects
6	2

This site contains no links.

Subject Issuer	Validity	Valid
*.pallavoloantares.it Actalis Domain Validation Server CA G3	`2020-08-24` - `2021-06-25`	10 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982
Frame ID: C9FD239E6D7FD7E41FD30F11EAE981F7
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://arahd.aramlicy.com/ HTTP 301
https://www.pallavoloantares.it/03/wp/DHI/ HTTP 302
https://www.pallavoloantares.it/03/wp/DHI/F004f19441/index.php?valid=true&id=16783953 HTTP 302
https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 Page URL

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

216 kB
Transfer

415 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://arahd.aramlicy.com/ HTTP 301
https://www.pallavoloantares.it/03/wp/DHI/ HTTP 302
https://www.pallavoloantares.it/03/wp/DHI/F004f19441/index.php?valid=true&id=16783953 HTTP 302
https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 11644210b.php Show response www.pallavoloantares.it/03/wp/DHI/F004f19441/ Redirect Chain http://arahd.aramlicy.com/ https://www.pallavoloantares.it/03/wp/DHI/ https://www.pallavoloantares.it/03/wp/DHI/F004f19441/index.php?valid=true&id=16783953 https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982	4 KB 4 KB	106ms 106ms	Document text/html	89.46.104.40 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 89.46.104.40 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1030.aruba.it Software aruba-proxy / Resource Hash `bf01f76203ba815ad1b0e714e52cc45e55593f83e6a697848a4b5956dcf70f84` Request headers :method GET :authority www.pallavoloantares.it :scheme https :path /03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US cookie PHPSESSID=41bd0af10c7686e8eaa99263a9bcf4ea Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 server aruba-proxy date Sun, 04 Oct 2020 11:10:19 GMT content-type text/html; charset-UTF-8;charset=UTF-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache x-servername ipvsproxy16.ad.aruba.it Redirect headers status 302 server aruba-proxy date Sun, 04 Oct 2020 11:10:19 GMT content-type text/html; charset-UTF-8;charset=UTF-8 location ./11644210b.php?web=succes&local=_&id=1227982 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache x-servername ipvsproxy16.ad.aruba.it
GET H2	200	style.css www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/css/	208 KB 71 KB	108ms 107ms	Stylesheet text/css	89.46.104.40 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/css/style.css Requested by Host: www.pallavoloantares.it URL: https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 89.46.104.40 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1030.aruba.it Software aruba-proxy / Resource Hash `c652ac586c83328798771921bd81f059de32ddd1cd5a75a3f1821b633ff4057c` Request headers Referer https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-servername ipvsproxy16.ad.aruba.it date Sun, 04 Oct 2020 11:10:19 GMT content-encoding gzip last-modified Fri, 02 Oct 2020 12:51:01 GMT server aruba-proxy etag W/"33e18-5b0af95bfb3cd" vary Accept-Encoding content-type text/css status 200
GET H2	200	style.js Show response www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/js/	96 KB 34 KB	108ms 108ms	Script application/javascript	89.46.104.40 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/js/style.js Requested by Host: www.pallavoloantares.it URL: https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 89.46.104.40 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1030.aruba.it Software aruba-proxy / Resource Hash `a0a2972d1010b99a62268e6b5c416ad75c1f1abbe374ea6123d1b5e332fb544f` Request headers Referer https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-servername ipvsproxy16.ad.aruba.it date Sun, 04 Oct 2020 11:10:19 GMT content-encoding gzip last-modified Fri, 02 Oct 2020 12:51:01 GMT server aruba-proxy etag W/"17eff-5b0af95c43bef" vary Accept-Encoding content-type application/javascript status 200
GET H2	200	lg.svg www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/img/	2 KB 914 B	105ms 104ms	Image image/svg+xml	89.46.104.40 ARUBA-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/img/lg.svg Requested by Host: www.pallavoloantares.it URL: https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 89.46.104.40 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1030.aruba.it Software aruba-proxy / Resource Hash `aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1` Request headers Referer https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-servername ipvsproxy16.ad.aruba.it date Sun, 04 Oct 2020 11:10:19 GMT content-encoding gzip last-modified Fri, 02 Oct 2020 12:51:01 GMT server aruba-proxy etag W/"7f8-5b0af95c10853" vary Accept-Encoding content-type image/svg+xml status 200
GET H2	200	pub.jpg www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/img/	80 KB 80 KB	74ms 74ms	Image image/jpeg	89.46.104.40 ARUBA-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/img/pub.jpg Requested by Host: www.pallavoloantares.it URL: https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 89.46.104.40 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1030.aruba.it Software aruba-proxy / Resource Hash `fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5` Request headers Referer https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-servername ipvsproxy16.ad.aruba.it date Sun, 04 Oct 2020 11:10:19 GMT last-modified Fri, 02 Oct 2020 12:51:01 GMT server aruba-proxy etag "140d5-5b0af95c30f2e" content-type image/jpeg status 200 accept-ranges bytes content-length 82133
GET H2	200	pubr.gif www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/img/	8 KB 8 KB	77ms 77ms	Image image/gif	89.46.104.40 ARUBA-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.pallavoloantares.it/03/wp/DHI/F004f19441/layout/img/pubr.gif Requested by Host: www.pallavoloantares.it URL: https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 89.46.104.40 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1030.aruba.it Software aruba-proxy / Resource Hash `38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6` Request headers Referer https://www.pallavoloantares.it/03/wp/DHI/F004f19441/11644210b.php?web=succes&local=_&id=1227982 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-servername ipvsproxy16.ad.aruba.it date Sun, 04 Oct 2020 11:10:19 GMT last-modified Fri, 02 Oct 2020 12:51:01 GMT server aruba-proxy etag "2098-5b0af95c331db" content-type image/gif status 200 accept-ranges bytes content-length 8344
GET DATA	200 OK	truncated /	17 KB 17 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171` Request headers Origin https://www.pallavoloantares.it Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/font-woff2;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.pallavoloantares.it/	1969-12-31 23:59:59	Name: PHPSESSID Value: 41bd0af10c7686e8eaa99263a9bcf4ea

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

arahd.aramlicy.com
www.pallavoloantares.it
2a00:1450:4001:800::2013
89.46.104.40
38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6
79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171
a0a2972d1010b99a62268e6b5c416ad75c1f1abbe374ea6123d1b5e332fb544f
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
bf01f76203ba815ad1b0e714e52cc45e55593f83e6a697848a4b5956dcf70f84
c652ac586c83328798771921bd81f059de32ddd1cd5a75a3f1821b633ff4057c
fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5

www.pallavoloantares.it Open in urlscan Pro 89.46.104.40 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

216 kBTransfer

415 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

Indicators

www.pallavoloantares.it Open in urlscan Pro
89.46.104.40 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

216 kB
Transfer

415 kB
Size

1
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!