www.antisdrucciolo.it
Open in
urlscan Pro
89.46.105.33
Malicious Activity!
Public Scan
Effective URL: https://www.antisdrucciolo.it/agricole/hmgfizdk=/?country.x=&countryCode=&Token=8554f640c525098f93aa8ba5256ba5ac
Submission: On March 19 via automatic, source openphish
Summary
TLS certificate: Issued by Actalis Domain Validation Server CA G3 on March 2nd 2021. Valid for: a year.
This is the only time www.antisdrucciolo.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Credit Agricole (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 3 | 89.46.105.33 89.46.105.33 | 31034 (ARUBA-ASN) (ARUBA-ASN) | |
1 | 2 |
ASN31034 (ARUBA-ASN, IT)
PTR: webx1064.aruba.it
www.antisdrucciolo.it |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
antisdrucciolo.it
2 redirects
www.antisdrucciolo.it |
219 KB |
1 | 1 |
Domain | Requested by | |
---|---|---|
3 | www.antisdrucciolo.it | 2 redirects |
1 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.antisdrucciolo.it Actalis Domain Validation Server CA G3 |
2021-03-02 - 2022-03-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.antisdrucciolo.it/agricole/hmgfizdk=/?country.x=&countryCode=&Token=8554f640c525098f93aa8ba5256ba5ac
Frame ID: DB53B1EE0C0D4446FF36B140177D6598
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.antisdrucciolo.it/agricole/hmgfizdk=?country.x=&countryCode=&Token=8554f640c525098f93aa8ba5256...
HTTP 301
http://www.antisdrucciolo.it/agricole/hmgfizdk=/?country.x=&countryCode=&Token=8554f640c525098f93aa8ba525... HTTP 301
https://www.antisdrucciolo.it/agricole/hmgfizdk=/?country.x=&countryCode=&Token=8554f640c525098f93aa8ba525... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.antisdrucciolo.it/agricole/hmgfizdk=?country.x=&countryCode=&Token=8554f640c525098f93aa8ba5256ba5ac
HTTP 301
http://www.antisdrucciolo.it/agricole/hmgfizdk=/?country.x=&countryCode=&Token=8554f640c525098f93aa8ba5256ba5ac HTTP 301
https://www.antisdrucciolo.it/agricole/hmgfizdk=/?country.x=&countryCode=&Token=8554f640c525098f93aa8ba5256ba5ac Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
1 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.antisdrucciolo.it/agricole/hmgfizdk=/ Redirect Chain
|
322 KB 218 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
18 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
167 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Credit Agricole (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.antisdrucciolo.it
89.46.105.33
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc
40eebb3469219ff9cea327b5f7ae1f68ba59a52d539e4a07303cdd8c8cbfc7cb
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
9c8763a933239ec276a86c0b10d09a2513177df656c2ffcf5ce10a2b980b3b29
f8e9befa13e3ff93d974729ae3c727461555d582bb63bb388a4bd497619ef20b