fortiustelecom.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 107.189.161.150, located in Phoenix, United States and belongs to IOFLOOD, US. The main domain is fortiustelecom.com.
TLS certificate: Issued by R3 on May 17th 2023. Valid for: 3 months.

This is the only time fortiustelecom.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Intesa Sanpaolo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:20:... 2606:4700:20::681a:dc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:20:... 2606:4700:20::681a:cc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	107.189.161.150 107.189.161.150	53755 (IOFLOOD) (IOFLOOD)
1	2606:4700::68... 2606:4700::6810:7baf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2

1 2606:4700:20::681a:dc9 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

t.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:cc9 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

t.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 107.189.161.150 (Phoenix, United States)

ASN53755 (IOFLOOD, US)
PTR: khanika.ethii.com

fortiustelecom.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7baf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	fortiustelecom.com fortiustelecom.com	53 KB
2	t.ly 2 redirects t.ly — Cisco Umbrella Rank: 180861	2 KB
1	unpkg.com unpkg.com — Cisco Umbrella Rank: 1035	4 KB
6	3

	Domain	Requested by
5	fortiustelecom.com	fortiustelecom.com
2	t.ly	2 redirects
1	unpkg.com	fortiustelecom.com
6	3

This site contains no links.

Subject Issuer	Validity	Valid
fortiustelecom.com R3	`2023-05-17` - `2023-08-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://fortiustelecom.com/intesa-verifica/
Frame ID: 65B2F83B897100286A653CCF30B3C070
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://t.ly/CertificaIntesa HTTP 301
https://t.ly/CertificaIntesa HTTP 302
https://fortiustelecom.com/intesa-verifica/ Page URL

Detected technologies

Pure CSS (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+(?:([\d.])+/)?pure(?:-min)?\.css
<div[^>]+class="[^"]*pure-u-(?:sm-|md-|lg-|xl-)?\d-\d

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

57 kB
Transfer

127 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://t.ly/CertificaIntesa HTTP 301
https://t.ly/CertificaIntesa HTTP 302
https://fortiustelecom.com/intesa-verifica/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
fortiustelecom.com/intesa-verifica/
Redirect Chain

http://t.ly/CertificaIntesa
https://t.ly/CertificaIntesa
https://fortiustelecom.com/intesa-verifica/

4 KB
2 KB

834ms
308ms

Document
text/html

107.189.161.150
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://fortiustelecom.com/intesa-verifica/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.189.161.150 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: khanika.ethii.com
Software: /
Resource Hash: fd6d89c02e8057a51c111f87870555e034c0c61a03655384a685fcaf85155871

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 1420
content-type: text/html; charset=UTF-8
date: Tue, 20 Jun 2023 07:45:17 GMT
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 7da26431c83abaac-MXP
content-type: text/html; charset=UTF-8
date: Tue, 20 Jun 2023 07:45:17 GMT
location: https://fortiustelecom.com/intesa-verifica/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MQSNYIcoqb%2Bm8cSbqo2Tfeq%2FkRJICxGXAYmEntsf6bdi9kmSL6LMKYi4o4bTPTAwg%2B4d%2BtBkKOt3bR%2FCiwAmLRBiv%2Fztmq70ornvmMp10zXCo0ypNE2hlYahZiInHurdncM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-whom: tly-2
x-xss-protection: 1; mode=block

GET
H2 200 intesalogo.jpg
fortiustelecom.com/intesa-verifica/ 17 KB
17 KB 367ms
365ms Image
image/jpeg 107.189.161.150
IOFLOOD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fortiustelecom.com/intesa-verifica/intesalogo.jpg
Requested by: Host: fortiustelecom.com
URL: https://fortiustelecom.com/intesa-verifica/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.189.161.150 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: khanika.ethii.com
Software: /
Resource Hash: 8300913dfabbb5fa7db0891abcf099fb928d48985198560ef318757c9c8ec65a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fortiustelecom.com/intesa-verifica/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/jpeg
date: Tue, 20 Jun 2023 07:45:18 GMT
cache-control: public, max-age=604800
last-modified: Wed, 16 Feb 2022 15:21:48 GMT
accept-ranges: bytes
content-length: 17151
expires: Tue, 27 Jun 2023 07:45:18 GMT

GET
H2 200 pure-min.css
unpkg.com/purecss@2.0.5/build/ 16 KB
4 KB 81ms
31ms Stylesheet
text/css 2606:4700::6810:7baf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/purecss@2.0.5/build/pure-min.css

Requested by

Host: fortiustelecom.com
URL: https://fortiustelecom.com/intesa-verifica/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7baf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d0b11cc95b046dabdab9a5bbe9c3035d2db1d7036e644acbb9e00b7c639f3f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fortiustelecom.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 07:45:18 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 31278354
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01G67PW15P5J00F32MTZKGF6R2-cdg
server: cloudflare
etag: W/"4195-XLNKX4yxaMYG7+jslQdUA8knpHQ"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7da264386e78bb23-MXP

GET
H2 200 jquery-latest.min.js Show response
fortiustelecom.com/intesa-verifica/ 84 KB
29 KB 366ms
365ms Script
application/javascript 107.189.161.150
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://fortiustelecom.com/intesa-verifica/jquery-latest.min.js
Requested by: Host: fortiustelecom.com
URL: https://fortiustelecom.com/intesa-verifica/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.189.161.150 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: khanika.ethii.com
Software: /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fortiustelecom.com/intesa-verifica/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 07:45:18 GMT
content-encoding: br
last-modified: Tue, 26 Jan 2021 19:11:20 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 29167
expires: Tue, 27 Jun 2023 07:45:18 GMT

GET
H2 200 logobianco.png
fortiustelecom.com/intesa-verifica/ 5 KB
5 KB 367ms
366ms Image
image/png 107.189.161.150
IOFLOOD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fortiustelecom.com/intesa-verifica/logobianco.png
Requested by: Host: fortiustelecom.com
URL: https://fortiustelecom.com/intesa-verifica/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.189.161.150 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: khanika.ethii.com
Software: /
Resource Hash: 559bde803d8dedb905509859f3c1d14c9837788f2d5cf6ee26f1518f528d0cf8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fortiustelecom.com/intesa-verifica/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/png
date: Tue, 20 Jun 2023 07:45:18 GMT
cache-control: public, max-age=604800
last-modified: Thu, 17 Feb 2022 15:27:34 GMT
accept-ranges: bytes
content-length: 5229
expires: Tue, 27 Jun 2023 07:45:18 GMT

GET
H2 200 secure.png
fortiustelecom.com/intesa-verifica/ 858 B
919 B 366ms
365ms Image
image/png 107.189.161.150
IOFLOOD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fortiustelecom.com/intesa-verifica/secure.png
Requested by: Host: fortiustelecom.com
URL: https://fortiustelecom.com/intesa-verifica/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.189.161.150 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: khanika.ethii.com
Software: /
Resource Hash: d09385047ff2267faa9f95e0c6918edbae3aa1a93baa4dc10257138db9de90aa

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fortiustelecom.com/intesa-verifica/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/png
date: Tue, 20 Jun 2023 07:45:18 GMT
cache-control: public, max-age=604800
last-modified: Mon, 17 Apr 2023 07:48:12 GMT
accept-ranges: bytes
content-length: 858
expires: Tue, 27 Jun 2023 07:45:18 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Intesa Sanpaolo (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
fortiustelecom.com/intesa-verifica	1970-01-20 22:16:47	Name: COOKIE_KEY Value: 168724711783
t.ly/	1970-01-20 13:00:56	Name: XSRF-TOKEN Value: eyJpdiI6Ik1JUnp4ajQzZVpTQkxCc3AzRlBIekE9PSIsInZhbHVlIjoiaThTV3ZmL2FmRGZpNHpJT1hwMlJyVXJyYTVCS2U3UHVCK3lXcXhRc2lyeTl2aHVEVS9kNDVYSTNYZVg1RmlLbXFGbVlERUF2cjNwb1l4MU95cmFTZXJHWXdZNHcwNFlmQUtQRHZrV2szQjJHcjZRMGV1QTFZRnhudUtzWFpaOFEiLCJtYWMiOiI3MmQ0MWE1NDc0M2Q4NWE2NTI0NGRjNGQ3MjBlODdlZDY1NTFiYTIyOTdiNDhhNzI4YWZhNjg5MGY4YjMzZDM4IiwidGFnIjoiIn0%3D
t.ly/	1970-01-20 13:00:56	Name: tly_session Value: eyJpdiI6Ikdtd0w1NW4rbVVTbkF0WW8xdkF6UUE9PSIsInZhbHVlIjoiOGxuOEtwZlVZa3dlNjR4TXRTRDU0aU00bWR0UTA5Z0NBWmpucXVqT2tSZ0pJWHNDNmhwRTBuWisvZUJOVmdXcjJOd3lJQUgyTXJrdFNkZWR6UmgrU293K09SYzBHMi9yc2hCb0NSNmNpanlaV2N5Ly8ySEJPS0VXYTI5cUhNaisiLCJtYWMiOiI2NWE2Zjc4MWE0MTczYTkwYjFmNWE0YThmNWM1NTllMmNjMjA3ZGY2ZDZlYTcyNDNhYWNlMDg2ZTYxYzhhNzE0IiwidGFnIjoiIn0%3D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fortiustelecom.com
t.ly
unpkg.com
107.189.161.150
2606:4700:20::681a:cc9
2606:4700:20::681a:dc9
2606:4700::6810:7baf
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2d0b11cc95b046dabdab9a5bbe9c3035d2db1d7036e644acbb9e00b7c639f3f6
559bde803d8dedb905509859f3c1d14c9837788f2d5cf6ee26f1518f528d0cf8
8300913dfabbb5fa7db0891abcf099fb928d48985198560ef318757c9c8ec65a
d09385047ff2267faa9f95e0c6918edbae3aa1a93baa4dc10257138db9de90aa
fd6d89c02e8057a51c111f87870555e034c0c61a03655384a685fcaf85155871

fortiustelecom.com Open in urlscan Pro 107.189.161.150 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

75 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

57 kBTransfer

127 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

3 Cookies

Indicators

fortiustelecom.com Open in urlscan Pro
107.189.161.150 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

57 kB
Transfer

127 kB
Size

3
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!