sicurezza-portale.com Open in urlscan Pro
162.0.209.237  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index Show response sicurezza-portale.com/	42 KB 7 KB	528ms 200ms	Document text/html	162.0.209.237 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sicurezza-portale.com/index Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.209.237 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business99-1.web-hosting.com Software Apache / Express, Phusion Passenger Resource Hash 3980814edb2767be95f475a06b3e061b0d273eb8e5b1b95b46c1d251c7486319 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority sicurezza-portale.com :scheme https :path /index pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 24 Mar 2021 14:53:12 GMT server Apache x-powered-by Express, Phusion Passenger etag W/"a721-8vYQNCfFseBym8vXPeepM2CZTIw-gzip" status 200 OK vary Accept-Encoding content-encoding gzip content-length 6655 content-type text/html; charset=utf-8 x-frame-options SAMEORIGIN x-xss-protection 1; mode=block x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload; referrer-policy no-referrer-when-downgrade
GET H2	200	w.login.digitalBanking.min.css sicurezza-portale.com/cmn/assets/css/catalogo/	43 KB 8 KB	179ms 178ms	Stylesheet text/css	162.0.209.237 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sicurezza-portale.com/cmn/assets/css/catalogo/w.login.digitalBanking.min.css Requested by Host: sicurezza-portale.com URL: https://sicurezza-portale.com/index Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.209.237 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business99-1.web-hosting.com Software Apache / Express, Phusion Passenger Resource Hash 8e70e6b61f5299937b13e4569deb744f91b78f63eeb990ce0892a83e752401f1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sicurezza-portale.com/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 24 Mar 2021 14:53:12 GMT content-encoding gzip x-content-type-options nosniff x-powered-by Express, Phusion Passenger status 200 OK strict-transport-security max-age=31536000; includeSubDomains; preload; content-length 7365 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Mar 2021 12:12:40 GMT server Apache x-frame-options SAMEORIGIN etag W/"ac2c-1785f005522-gzip" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=0 accept-ranges bytes
GET H2	200	iconaSpeechAssistantred.png sicurezza-portale.com/libs/img/loginBI/	6 KB 6 KB	173ms 173ms	Image image/png	162.0.209.237 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sicurezza-portale.com/libs/img/loginBI/iconaSpeechAssistantred.png Requested by Host: sicurezza-portale.com URL: https://sicurezza-portale.com/index Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.209.237 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business99-1.web-hosting.com Software Apache / Express, Phusion Passenger Resource Hash ecbc0f0662de667c37059cbcf31103ae13563b54db11405941b0ac3f294b2ed8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sicurezza-portale.com/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 24 Mar 2021 14:53:12 GMT referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Mar 2021 12:12:33 GMT server Apache x-powered-by Express, Phusion Passenger x-frame-options SAMEORIGIN content-type image/png status 200 OK x-xss-protection 1; mode=block cache-control public, max-age=0 etag W/"161a-1785f003a08" strict-transport-security max-age=31536000; includeSubDomains; preload; accept-ranges bytes content-length 5658 x-content-type-options nosniff
GET H2	200	jquery-latest.min.js Show response sicurezza-portale.com/cdn/	87 KB 31 KB	327ms 326ms	Script application/javascript	162.0.209.237 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sicurezza-portale.com/cdn/jquery-latest.min.js Requested by Host: sicurezza-portale.com URL: https://sicurezza-portale.com/index Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.209.237 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business99-1.web-hosting.com Software Apache / Express, Phusion Passenger Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sicurezza-portale.com/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 24 Mar 2021 14:53:12 GMT content-encoding gzip x-content-type-options nosniff x-powered-by Express, Phusion Passenger status 200 OK strict-transport-security max-age=31536000; includeSubDomains; preload; content-length 30910 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Mar 2021 12:12:21 GMT server Apache x-frame-options SAMEORIGIN etag W/"15d84-1785f000afe-gzip" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=0 accept-ranges bytes
GET H2	200	script.js Show response sicurezza-portale.com/cdn/	521 B 668 B	179ms 179ms	Script application/javascript	162.0.209.237 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sicurezza-portale.com/cdn/script.js Requested by Host: sicurezza-portale.com URL: https://sicurezza-portale.com/index Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.209.237 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business99-1.web-hosting.com Software Apache / Express, Phusion Passenger Resource Hash 08466a59f0043fabcc355e23d2fe66ebe6a472b9e35d668ff2c444e7fff28685 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sicurezza-portale.com/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 24 Mar 2021 14:53:12 GMT content-encoding gzip x-content-type-options nosniff x-powered-by Express, Phusion Passenger status 200 OK strict-transport-security max-age=31536000; includeSubDomains; preload; content-length 212 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Mar 2021 12:12:22 GMT server Apache x-frame-options SAMEORIGIN etag W/"209-1785f000d94-gzip" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=0 accept-ranges bytes
GET H2	200	logo.jpg sicurezza-portale.com/	11 KB 11 KB	294ms 293ms	Image image/jpeg	162.0.209.237 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sicurezza-portale.com/logo.jpg Requested by Host: sicurezza-portale.com URL: https://sicurezza-portale.com/index Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.209.237 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business99-1.web-hosting.com Software Apache / Express, Phusion Passenger Resource Hash 0a0c6433b58c72136375414d6f7a6a511932eeaac396f7c0991a2b953fa2eaaa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sicurezza-portale.com/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 24 Mar 2021 14:53:13 GMT referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Mar 2021 12:12:17 GMT server Apache x-powered-by Express, Phusion Passenger x-frame-options SAMEORIGIN content-type image/jpeg status 200 OK x-xss-protection 1; mode=block cache-control public, max-age=0 etag W/"2ad0-1785efff93b" strict-transport-security max-age=31536000; includeSubDomains; preload; accept-ranges bytes content-length 10960 x-content-type-options nosniff
GET H2	200	info%20tooltip_UI.svg sicurezza-portale.com/cmn/	985 B 944 B	370ms 370ms	Image image/svg+xml	162.0.209.237 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sicurezza-portale.com/cmn/info%20tooltip_UI.svg Requested by Host: sicurezza-portale.com URL: https://sicurezza-portale.com/index Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.209.237 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business99-1.web-hosting.com Software Apache / Express, Phusion Passenger Resource Hash 1d03224aaedf962946f538daa11fea6d3ad2d1baec4cd05818206c435eff02d0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sicurezza-portale.com/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 24 Mar 2021 14:53:13 GMT content-encoding gzip x-content-type-options nosniff x-powered-by Express, Phusion Passenger status 200 OK strict-transport-security max-age=31536000; includeSubDomains; preload; content-length 512 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Mar 2021 12:12:26 GMT server Apache x-frame-options SAMEORIGIN etag W/"3d9-1785f001c50-gzip" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=0 accept-ranges bytes
GET H2	200	ico_informazioni.svg sicurezza-portale.com/libs/img/loginBI/	2 KB 2 KB	437ms 437ms	Image image/svg+xml	162.0.209.237 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sicurezza-portale.com/libs/img/loginBI/ico_informazioni.svg Requested by Host: sicurezza-portale.com URL: https://sicurezza-portale.com/index Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.209.237 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business99-1.web-hosting.com Software Apache / Express, Phusion Passenger Resource Hash cbf3a6670f3feb53f2dfcd7d46c1008e1e6b5436d693bdec2c3910efdb4e425c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sicurezza-portale.com/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 24 Mar 2021 14:53:13 GMT content-encoding gzip x-content-type-options nosniff x-powered-by Express, Phusion Passenger status 200 OK strict-transport-security max-age=31536000; includeSubDomains; preload; content-length 1222 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Mar 2021 12:12:33 GMT server Apache x-frame-options SAMEORIGIN etag W/"971-1785f003a03-gzip" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=0 accept-ranges bytes
GET H2	200	ico_ingranaggio.svg sicurezza-portale.com/libs/img/loginBI/	5 KB 2 KB	369ms 368ms	Image image/svg+xml	162.0.209.237 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sicurezza-portale.com/libs/img/loginBI/ico_ingranaggio.svg Requested by Host: sicurezza-portale.com URL: https://sicurezza-portale.com/cmn/assets/css/catalogo/w.login.digitalBanking.min.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.209.237 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business99-1.web-hosting.com Software Apache / Express, Phusion Passenger Resource Hash 4bf72a1f952f827f34a5d8ae1a34f345f1ff99771a058547ce237ec01b937e95 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sicurezza-portale.com/cmn/assets/css/catalogo/w.login.digitalBanking.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 24 Mar 2021 14:53:13 GMT content-encoding gzip x-content-type-options nosniff x-powered-by Express, Phusion Passenger status 200 OK strict-transport-security max-age=31536000; includeSubDomains; preload; content-length 2071 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Mar 2021 12:12:34 GMT server Apache x-frame-options SAMEORIGIN etag W/"1214-1785f003e58-gzip" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=0 accept-ranges bytes
GET H/1.1	200 OK	/ Show response api.ipify.org/	22 B 260 B	419ms 112ms	XHR application/json	54.225.155.11 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: sicurezza-portale.com URL: https://sicurezza-portale.com/cdn/jquery-latest.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.225.155.11 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-225-155-11.compute-1.amazonaws.com Software Cowboy / Resource Hash a57f01ab5541bd32ac17e515c89539811c4ccc254180897b0bec4f97b1c07fe0 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://sicurezza-portale.com/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 24 Mar 2021 14:53:13 GMT Via 1.1 vegur Server Cowboy Vary Origin Content-Type application/json Access-Control-Allow-Origin https://sicurezza-portale.com Connection keep-alive Content-Length 22

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Monte dei Paschi (Banking)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| closeCookies function| isEnabled function| getMobileOperatingSystem function| login function| next

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
sicurezza-portale.com
162.0.209.237
54.225.155.11
08466a59f0043fabcc355e23d2fe66ebe6a472b9e35d668ff2c444e7fff28685
0a0c6433b58c72136375414d6f7a6a511932eeaac396f7c0991a2b953fa2eaaa
1d03224aaedf962946f538daa11fea6d3ad2d1baec4cd05818206c435eff02d0
3980814edb2767be95f475a06b3e061b0d273eb8e5b1b95b46c1d251c7486319
4bf72a1f952f827f34a5d8ae1a34f345f1ff99771a058547ce237ec01b937e95
8e70e6b61f5299937b13e4569deb744f91b78f63eeb990ce0892a83e752401f1
a57f01ab5541bd32ac17e515c89539811c4ccc254180897b0bec4f97b1c07fe0
cbf3a6670f3feb53f2dfcd7d46c1008e1e6b5436d693bdec2c3910efdb4e425c
ecbc0f0662de667c37059cbcf31103ae13563b54db11405941b0ac3f294b2ed8
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d