touchfoundation.info Open in urlscan Pro
206.221.182.74  Malicious Activity! Public Scan

Submitted URL: https://touchfoundation.info/otp1.php
Effective URL: https://touchfoundation.info/index.php
Submission: On May 11 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 206.221.182.74, located in United States and belongs to RELIABLESITE, US. The main domain is touchfoundation.info.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 15th 2022. Valid for: 3 months.
This is the only time touchfoundation.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Credit Agricole (Banking)

Domain & IP information

IP Address AS Autonomous System
13 206.221.182.74 23470 (RELIABLESITE)
13 1
Apex Domain
Subdomains
Transfer
13 touchfoundation.info
touchfoundation.info
117 KB
13 1
Domain Requested by
13 touchfoundation.info touchfoundation.info
13 1

This site contains links to these domains. Also see Links.

Domain
www.credit-agricole.it
Subject Issuer Validity Valid
touchfoundation.info
cPanel, Inc. Certification Authority
2022-04-15 -
2022-07-14
3 months crt.sh

This page contains 2 frames:

Primary Page: https://touchfoundation.info/index.php
Frame ID: F8AA12C4262748D732245330B3C2CFDA
Requests: 9 HTTP requests in this frame

Frame: https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Frame ID: EC111C77C29B898FF680D5FFDC62EEDD
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Crédit Agricole - Accesso Home Banking

Page URL History Show full URLs

  1. https://touchfoundation.info/otp1.php Page URL
  2. https://touchfoundation.info/index.php?reset=1 Page URL
  3. https://touchfoundation.info/index.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

117 kB
Transfer

410 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://touchfoundation.info/otp1.php Page URL
  2. https://touchfoundation.info/index.php?reset=1 Page URL
  3. https://touchfoundation.info/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
otp1.php
touchfoundation.info/
75 B
326 B
Document
General
Full URL
https://touchfoundation.info/otp1.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed / PHP/7.4.12
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-encoding
br
content-length
61
content-type
text/html; charset=UTF-8
date
Wed, 11 May 2022 17:15:16 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.12
index.php
touchfoundation.info/
67 B
296 B
Document
General
Full URL
https://touchfoundation.info/index.php?reset=1
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/otp1.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed / PHP/7.4.12
Resource Hash

Request headers

Referer
https://touchfoundation.info/otp1.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-length
51
content-type
text/html; charset=UTF-8
date
Wed, 11 May 2022 17:15:16 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.12
Primary Request index.php
touchfoundation.info/
341 KB
54 KB
Document
General
Full URL
https://touchfoundation.info/index.php
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/index.php?reset=1
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed / PHP/7.4.12
Resource Hash
2768d481493a89a6028ee177ce23cbb17609b259958b040511227991ef86ef21

Request headers

Referer
https://touchfoundation.info/index.php?reset=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 11 May 2022 17:15:16 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.12
live.php
touchfoundation.info/pannello2/ Frame EC11
122 B
105 B
Document
General
Full URL
https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/index.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed / PHP/7.4.12
Resource Hash
8e82660b6bfdc51a6984939cd1e4b578dd3d60ca7feb9bca1727c08232862529

Request headers

Referer
https://touchfoundation.info/index.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-length
85
content-type
text/html; charset=UTF-8
date
Wed, 11 May 2022 17:15:16 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.12
ca_logo.svg
touchfoundation.info/cartella/
8 KB
3 KB
Image
General
Full URL
https://touchfoundation.info/cartella/ca_logo.svg
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/index.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
906593415d0df2881d81176b9be0ae598ee9cf6b08cc1ce72df7b62e12baa85d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://touchfoundation.info/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 17:15:17 GMT
content-encoding
br
last-modified
Thu, 04 Mar 2021 16:21:14 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
2687
expires
Wed, 18 May 2022 17:15:17 GMT
loader.gif
touchfoundation.info/assets/images/
25 KB
26 KB
Image
General
Full URL
https://touchfoundation.info/assets/images/loader.gif
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/index.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
6136eca91040992f1422b4fd16a4d18e3a2e649125c76d8e81746edb5ea819fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://touchfoundation.info/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 17:15:17 GMT
last-modified
Thu, 04 Mar 2021 17:17:22 GMT
server
LiteSpeed
content-type
image/gif
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
26089
expires
Wed, 18 May 2022 17:15:17 GMT
reset.svg
touchfoundation.info/assets/images/
2 KB
665 B
Image
General
Full URL
https://touchfoundation.info/assets/images/reset.svg
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/index.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
8f1b28aa6bd74b5dbb284cf651700ce84a594ce1d0cd3866d778d3f1c1473425

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://touchfoundation.info/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 17:15:17 GMT
content-encoding
br
last-modified
Thu, 04 Mar 2021 17:17:40 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
617
expires
Wed, 18 May 2022 17:15:17 GMT
manual.svg
touchfoundation.info/assets/images/
1 KB
563 B
Image
General
Full URL
https://touchfoundation.info/assets/images/manual.svg
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/index.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
ad7ec623e72be75d579c7f938a48678fd732bd77506742fcc55b3ab593786a85

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://touchfoundation.info/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 17:15:17 GMT
content-encoding
br
last-modified
Thu, 04 Mar 2021 17:17:50 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
514
expires
Wed, 18 May 2022 17:15:17 GMT
Montserrat-Regular.woff2
touchfoundation.info/assets/fonts/
16 KB
16 KB
Font
General
Full URL
https://touchfoundation.info/assets/fonts/Montserrat-Regular.woff2
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/index.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
3db499acd608730bb66d02f0ba81182b48f69477ffe98a21b7ae0d5467a7f52d

Request headers

Referer
https://touchfoundation.info/index.php
Origin
https://touchfoundation.info
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 17:15:17 GMT
last-modified
Thu, 04 Mar 2021 17:18:28 GMT
server
LiteSpeed
accept-ranges
bytes
content-length
16512
content-type
font/woff2
Montserrat-Bold.woff2
touchfoundation.info/assets/fonts/
16 KB
16 KB
Font
General
Full URL
https://touchfoundation.info/assets/fonts/Montserrat-Bold.woff2
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/index.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed /
Resource Hash
773ca7f3ac524e135c9c3f60b3d816900d62fd2b8a54b02bfdc9921acc4bcbfc

Request headers

Referer
https://touchfoundation.info/index.php
Origin
https://touchfoundation.info
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 11 May 2022 17:15:17 GMT
last-modified
Thu, 04 Mar 2021 17:18:16 GMT
server
LiteSpeed
accept-ranges
bytes
content-length
16504
content-type
font/woff2
live.php
touchfoundation.info/pannello2/ Frame EC11
122 B
126 B
Document
General
Full URL
https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed / PHP/7.4.12
Resource Hash
8e82660b6bfdc51a6984939cd1e4b578dd3d60ca7feb9bca1727c08232862529

Request headers

Referer
https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-length
85
content-type
text/html; charset=UTF-8
date
Wed, 11 May 2022 17:15:18 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.12
live.php
touchfoundation.info/pannello2/ Frame EC11
122 B
126 B
Document
General
Full URL
https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed / PHP/7.4.12
Resource Hash
8e82660b6bfdc51a6984939cd1e4b578dd3d60ca7feb9bca1727c08232862529

Request headers

Referer
https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-length
85
content-type
text/html; charset=UTF-8
date
Wed, 11 May 2022 17:15:19 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.12
live.php
touchfoundation.info/pannello2/ Frame EC11
122 B
126 B
Document
General
Full URL
https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Requested by
Host: touchfoundation.info
URL: https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
206.221.182.74 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
in4.fastwebhost.com
Software
LiteSpeed / PHP/7.4.12
Resource Hash
8e82660b6bfdc51a6984939cd1e4b578dd3d60ca7feb9bca1727c08232862529

Request headers

Referer
https://touchfoundation.info/pannello2/live.php?id=165228931673&pagina=https%3A%2F%2Ftouchfoundation.info%2Findex.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-length
85
content-type
text/html; charset=UTF-8
date
Wed, 11 May 2022 17:15:20 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.12

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Credit Agricole (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails

1 Cookies

Domain/Path Name / Value
touchfoundation.info/ Name: COOKIE_KEY
Value: 165228931698