axelvefis.sa.com - urlscan.io

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 66.90.95.11, located in Moscow, Russian Federation and belongs to SOVAM-AS, RU. The main domain is axelvefis.sa.com.
TLS certificate: Issued by R11 on November 3rd 2024. Valid for: 3 months.

This is the only time axelvefis.sa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Unicredit (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:20:... 2606:4700:20::ac43:5384	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	66.90.95.11 66.90.95.11	3216 (SOVAM-AS) (SOVAM-AS)
7	1

1 2606:4700:20::ac43:5384 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

is.gd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 66.90.95.11 (Moscow, Russian Federation)

ASN3216 (SOVAM-AS, RU)

axelvefis.sa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	sa.com axelvefis.sa.com	23 KB
1	is.gd 1 redirects is.gd — Cisco Umbrella Rank: 167573	342 B
7	2

	Domain	Requested by
7	axelvefis.sa.com	axelvefis.sa.com
1	is.gd	1 redirects
7	2

This site contains no links.

Subject Issuer	Validity	Valid
axelvefis.sa.com R11	`2024-11-03` - `2025-02-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://axelvefis.sa.com/milano/
Frame ID: 2F0071D9C2F54829B8197B03FF0E9579
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

UniCredit

Page URL History Show full URLs

https://is.gd/areaunicreditprivata HTTP 301
https://axelvefis.sa.com/milano/ Page URL

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

23 kB
Transfer

21 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://is.gd/areaunicreditprivata HTTP 301
https://axelvefis.sa.com/milano/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response axelvefis.sa.com/milano/ Redirect Chain https://is.gd/areaunicreditprivata https://axelvefis.sa.com/milano/	6 KB 7 KB	1221ms 751ms	Document text/html	66.90.95.11 SOVAM-AS
General Check archive.org Show headers Download Go to Full URL https://axelvefis.sa.com/milano/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 66.90.95.11 Moscow, Russian Federation, ASN3216 (SOVAM-AS, RU), Reverse DNS Software Apache / Resource Hash `c9ab4381d64e6608bf322c202332140645c8ba464846ba0eddbf7ee6d689d44f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Connection Keep-Alive Content-Length 6505 Content-Type text/html; charset=UTF-8 Date Fri, 08 Nov 2024 13:58:47 GMT Keep-Alive timeout=5, max=100 Server Apache Redirect headers cf-cache-status DYNAMIC cf-ray 8df6146e696818dc-FRA content-type text/html; charset=UTF-8 date Fri, 08 Nov 2024 13:58:47 GMT location https://axelvefis.sa.com/milano/ server cloudflare
GET H/1.1	200 OK	home.png axelvefis.sa.com/milano/	3 KB 3 KB	84ms 83ms	Image image/png	66.90.95.11 SOVAM-AS
General Check archive.org Show headers Download Go to Show image Full URL https://axelvefis.sa.com/milano/home.png Requested by Host: axelvefis.sa.com URL: https://axelvefis.sa.com/milano/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 66.90.95.11 Moscow, Russian Federation, ASN3216 (SOVAM-AS, RU), Reverse DNS Software Apache / Resource Hash `825ff7e698273277b498ff7a2ccdfd6c2db7712e0f6904a30e4d944e5adbb611` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://axelvefis.sa.com/milano/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 2738 Keep-Alive timeout=5, max=99 Date Fri, 08 Nov 2024 13:58:48 GMT Last-Modified Mon, 30 Oct 2023 14:16:16 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	logo.png axelvefis.sa.com/milano/	3 KB 3 KB	170ms 85ms	Image image/png	66.90.95.11 SOVAM-AS
General Check archive.org Show headers Download Go to Show image Full URL https://axelvefis.sa.com/milano/logo.png Requested by Host: axelvefis.sa.com URL: https://axelvefis.sa.com/milano/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 66.90.95.11 Moscow, Russian Federation, ASN3216 (SOVAM-AS, RU), Reverse DNS Software Apache / Resource Hash `ce2a90b7453d592f36994cf622a4c7a016e6050c5dc115c97127e15f9adb2bab` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://axelvefis.sa.com/milano/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 2879 Keep-Alive timeout=5, max=98 Date Fri, 08 Nov 2024 13:58:48 GMT Last-Modified Mon, 30 Oct 2023 14:20:04 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	help.png axelvefis.sa.com/milano/	2 KB 3 KB	241ms 85ms	Image image/png	66.90.95.11 SOVAM-AS
General Check archive.org Show headers Download Go to Show image Full URL https://axelvefis.sa.com/milano/help.png Requested by Host: axelvefis.sa.com URL: https://axelvefis.sa.com/milano/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 66.90.95.11 Moscow, Russian Federation, ASN3216 (SOVAM-AS, RU), Reverse DNS Software Apache / Resource Hash `6953f2685dc754d4e2489826d52fbf36a5c8d0aa18fb8c23be70dc2ba5e71402` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://axelvefis.sa.com/milano/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 2325 Keep-Alive timeout=5, max=100 Date Fri, 08 Nov 2024 13:58:48 GMT Last-Modified Mon, 30 Oct 2023 14:20:42 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	logo-splash-msite.png axelvefis.sa.com/milano/	7 KB 7 KB	239ms 83ms	Image image/png	66.90.95.11 SOVAM-AS
General Check archive.org Show headers Download Go to Show image Full URL https://axelvefis.sa.com/milano/logo-splash-msite.png Requested by Host: axelvefis.sa.com URL: https://axelvefis.sa.com/milano/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 66.90.95.11 Moscow, Russian Federation, ASN3216 (SOVAM-AS, RU), Reverse DNS Software Apache / Resource Hash `e62e38d3cda262687803f85dcfeb47f8a8960e01a4f493475b95bf0be235481f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://axelvefis.sa.com/milano/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 7123 Keep-Alive timeout=5, max=100 Date Fri, 08 Nov 2024 13:58:48 GMT Last-Modified Mon, 30 Oct 2023 14:36:12 GMT Content-Type image/png Server Apache
GET H/1.1	404 Not Found	favicon.ico axelvefis.sa.com/	315 B 515 B	81ms 80ms	Other text/html	66.90.95.11 SOVAM-AS
General Check archive.org Show headers Download Go to Full URL https://axelvefis.sa.com/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 66.90.95.11 Moscow, Russian Federation, ASN3216 (SOVAM-AS, RU), Reverse DNS Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://axelvefis.sa.com/milano/ Response headers Keep-Alive timeout=5, max=99 Content-Length 315 Date Fri, 08 Nov 2024 13:58:48 GMT Content-Type text/html; charset=iso-8859-1 Server Apache Connection Keep-Alive
GET H/1.1	200 OK	visite.php Show response axelvefis.sa.com/milano/	0 186 B	1759ms 1759ms	XHR text/html	66.90.95.11 SOVAM-AS
General Check archive.org Show headers Download Go to Full URL https://axelvefis.sa.com/milano/visite.php?pagina=index Requested by Host: axelvefis.sa.com URL: https://axelvefis.sa.com/milano/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 66.90.95.11 Moscow, Russian Federation, ASN3216 (SOVAM-AS, RU), Reverse DNS Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://axelvefis.sa.com/milano/ Response headers Keep-Alive timeout=5, max=98 Content-Length 0 Date Fri, 08 Nov 2024 13:58:51 GMT Content-Type text/html; charset=UTF-8 Server Apache Connection Keep-Alive

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Unicredit (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			axelvefis.sa.com/milano	1970-01-21 10:27:14	Name: COOKIE_KEY Value: 173107432833
			.is.gd/	1970-01-21 00:51:16	Name: __cf_bm Value: CZtBNpcZRzigoLYOO.gAPDWw4osyEmMmH4EiiTfXor8-1731074327-1.0.1.1-23Yq36Yr0FpekaaZx0Zt9oTR4Z3vQ.oFuu.BunQCl_yy4PL3gwvUsENXTYyspExk3uEavVZ3Shk0t6C1HGunzA

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://axelvefis.sa.com/milano/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://axelvefis.sa.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

axelvefis.sa.com
is.gd
2606:4700:20::ac43:5384
66.90.95.11
6953f2685dc754d4e2489826d52fbf36a5c8d0aa18fb8c23be70dc2ba5e71402
825ff7e698273277b498ff7a2ccdfd6c2db7712e0f6904a30e4d944e5adbb611
c9ab4381d64e6608bf322c202332140645c8ba464846ba0eddbf7ee6d689d44f
ce2a90b7453d592f36994cf622a4c7a016e6050c5dc115c97127e15f9adb2bab
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e62e38d3cda262687803f85dcfeb47f8a8960e01a4f493475b95bf0be235481f

axelvefis.sa.com Open in urlscan Pro 66.90.95.11 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

23 kBTransfer

21 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

2 Cookies

2 Console Messages

Indicators

axelvefis.sa.com Open in urlscan Pro
66.90.95.11 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

23 kB
Transfer

21 kB
Size

2
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!