valisetours.com Open in urlscan Pro
92.205.129.49 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://icscards.online-identificatie.intraglobal.mx/
Effective URL:
https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/
Submission Tags: @ecarlesi threat phishing Search All
Submission: On December 14 via api (December 14th 2023, 12:38:30 pm UTC) from IT — Scanned from IT

Summary HTTP 14 Redirects Links 35 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 92.205.129.49, located in Strasbourg, France and belongs to GODADDY-SXB, DE. The main domain is valisetours.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 21st 2023. Valid for: 3 months.

This is the only time valisetours.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: International Card Services (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 1	38.124.220.142 38.124.220.142	270179 (PC ONLINE) (PC ONLINE)
2 16	92.205.129.49 92.205.129.49	21499 (GODADDY-SXB) (GODADDY-SXB)
14	2

1 38.124.220.142 (Monterrey, Mexico) 1 redirects

ASN270179 (PC ONLINE, MX)
PTR: ls93.tusite.com

icscards.online-identificatie.intraglobal.mx	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 92.205.129.49 (Strasbourg, France) 2 redirects

ASN21499 (GODADDY-SXB, DE)
PTR: 49.129.205.92.host.secureserver.net

valisetours.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	valisetours.com 2 redirects valisetours.com	4 MB
1	intraglobal.mx 1 redirects icscards.online-identificatie.intraglobal.mx	239 B
14	2

	Domain	Requested by
16	valisetours.com	2 redirects valisetours.com
1	icscards.online-identificatie.intraglobal.mx	1 redirects
14	2

This site contains links to these domains. Also see Links.

Domain
www.
www.icsbusiness.nl

Subject Issuer	Validity	Valid
valisetours.com cPanel, Inc. Certification Authority	`2023-11-21` - `2024-02-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/
Frame ID: 403E366A23830F7F48A51E996528DEB6
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Inloggen - Mijn ICS | International Card Services

Page URL History Show full URLs

https://icscards.online-identificatie.intraglobal.mx/ HTTP 301
https://valisetours.com/online/19297-00284/service/ Page URL
https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea HTTP 301
https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/ HTTP 302
https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

4406 kB
Transfer

4414 kB
Size

2
Cookies

35 Outgoing links

These are links going to different origins than the main page.

URL: https://www./
Title: Particulier

Search URL Search Domain Scan URL

URL: https://www.icsbusiness.nl/?aid=BUS228
Title: Zakelijk

Search URL Search Domain Scan URL

URL: https://www./creditcard-aanvragen
Title: Creditcard aanvragen

Search URL Search Domain Scan URL

URL: https://www./mijn-card
Title: Mijn Card

Search URL Search Domain Scan URL

URL: https://www./ics-aanbiedingen
Title: Card-voordeel

Search URL Search Domain Scan URL

URL: https://www./tips
Title: Tips

Search URL Search Domain Scan URL

URL: https://www./klantenservice
Title: Klantenservice

Search URL Search Domain Scan URL

URL: https://www./login
Title: Inloggen Mijn ICS

Search URL Search Domain Scan URL

URL: https://www./enrollment/identify-user?enrollmentProcessType=ACTIVATION
Title: Nog geen gebruiker? Activeer nu Mijn ICS.

Search URL Search Domain Scan URL

URL: https://www./enrollment/identify-user?enrollmentProcessType=CHANGEPASSWORD
Title: Inlognaam en/of wachtwoord vergeten?

Search URL Search Domain Scan URL

URL: https://www./producten/creditcards-vergelijken
Title: Heeft u nog geen Card? Vraag er een aan!

Search URL Search Domain Scan URL

URL: https://www./klantenservice/aanvragen/card-activeren-deblokkeren
Title: Card activeren

Search URL Search Domain Scan URL

URL: https://www./klantenservice/activeren-en-inloggen/account-activeren
Title: Mijn ICS activeren

Search URL Search Domain Scan URL

URL: https://www./klantenservice/uw-gegevens/pincode-vergeten
Title: Pincode vergeten

Search URL Search Domain Scan URL

URL: https://www./klantenservice/veiligheid/onterechte-betaling
Title: Onterechte betaling

Search URL Search Domain Scan URL

URL: https://www./info/identificatie
Title: Identificeren

Search URL Search Domain Scan URL

URL: https://www./creditcards-vergelijken
Title: Creditcards vergelijken

Search URL Search Domain Scan URL

URL: https://www./ics-info/contact
Title: Contact

Search URL Search Domain Scan URL

URL: https://www./creditcard-aanvragen/visa-world-card
Title: World Card

Search URL Search Domain Scan URL

URL: https://www./creditcard-aanvragen/visa-world-card-gold
Title: World Card Gold

Search URL Search Domain Scan URL

URL: https://www./creditcard-aanvragen/visa-world-card-platinum
Title: World Card Platinum

Search URL Search Domain Scan URL

URL: https://www./creditcard-aanvragen/gocard
Title: ICS GO Card

Search URL Search Domain Scan URL

URL: https://www./mijn-card/app
Title: App downloaden

Search URL Search Domain Scan URL

URL: https://www./abnamro
Title: ABN AMRO portal

Search URL Search Domain Scan URL

URL: https://www./anwb
Title: ANWB portal

Search URL Search Domain Scan URL

URL: https://www./gold
Title: Mastercard Gold portal

Search URL Search Domain Scan URL

URL: https://www./info/over-ics
Title: Over ICS

Search URL Search Domain Scan URL

URL: https://www./ics-info/pers
Title: Pers

Search URL Search Domain Scan URL

URL: https://www./info/disclaimer
Title: Disclaimer

Search URL Search Domain Scan URL

URL: https://www./ics-info/algemene-voorwaarden
Title: Algemene Voorwaarden

Search URL Search Domain Scan URL

URL: https://www./ics-info/privacy-statement
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://www./cookies
Title: Cookies

Search URL Search Domain Scan URL

URL: http://www.icsbusiness.nl/?aid=BUS228
Title: Zakelijke Cards

Search URL Search Domain Scan URL

URL: https://www./info/werken-bij-ics
Title: Werken bij ICS

Search URL Search Domain Scan URL

URL: https://www./sca-login
Title: onze cookie-instellingen.

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://icscards.online-identificatie.intraglobal.mx/ HTTP 301
https://valisetours.com/online/19297-00284/service/ Page URL
https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea HTTP 301
https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/ HTTP 302
https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://icscards.online-identificatie.intraglobal.mx/ HTTP 301
https://valisetours.com/online/19297-00284/service/

14 HTTP transactions
12 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response valisetours.com/online/19297-00284/service/ Redirect Chain https://icscards.online-identificatie.intraglobal.mx/ https://valisetours.com/online/19297-00284/service/	728 B 957 B	117ms 49ms	Document text/html	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `3a5973789edf193a30418b958d4cff4f50321adce85b1d1b49e4fd6474b9b5f3` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 14 Dec 2023 12:38:25 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 707 content-type text/html date Thu, 14 Dec 2023 12:38:25 GMT location https://valisetours.com/online/19297-00284/service/ server LiteSpeed
GET H/1.1	200 OK	Primary Request / Show response valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/ Redirect Chain https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea? https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/? https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/?	3 MB 3 MB	63ms 63ms	Document text/html	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `b73278606e4ed71a2d929cf169fa8085c68753d5b55a012db76c761b80f02a05` Request headers Referer https://valisetours.com/online/19297-00284/service/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 14 Dec 2023 12:38:27 GMT Keep-Alive timeout=5, max=97 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Thu, 14 Dec 2023 12:38:27 GMT Keep-Alive timeout=5, max=98 Server Apache location login/?
GET H/1.1	200 OK	jquery.min.js Show response valisetours.com/online/19297-00284/service/bower_components/jquery/dist/	85 KB 85 KB	86ms 30ms	Script application/javascript	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/bower_components/jquery/dist/jquery.min.js Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Thu, 31 Dec 2020 00:07:26 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 86659
GET H/1.1	200 OK	ua-parser.min.js Show response valisetours.com/online/19297-00284/service/bower_components/ua-parser-js/dist/	17 KB 17 KB	86ms 30ms	Script application/javascript	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/bower_components/ua-parser-js/dist/ua-parser.min.js Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Thu, 31 Dec 2020 00:07:26 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 17048
GET H/1.1	200 OK	font-awesome.min.css valisetours.com/online/19297-00284/service/bower_components/font-awesome/css/	30 KB 31 KB	81ms 27ms	Stylesheet text/css	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Thu, 31 Dec 2020 00:07:26 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 31000
GET H/1.1	200 OK	core_form.js Show response valisetours.com/online/19297-00284/service/core/form/	37 KB 37 KB	114ms 29ms	Script application/javascript	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/core/form/core_form.js Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `374ffd4b4b883b179882ea87062403571a10be2a12920123c394df24aa96c464` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Sun, 11 Jun 2023 08:20:14 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 37972
GET H/1.1	200 OK	core_token.js Show response valisetours.com/online/19297-00284/service/core/token/	13 KB 13 KB	120ms 35ms	Script application/javascript	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/core/token/core_token.js Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `7ad9e635f2d2d36caa569ec36928b881f362329a01bc6ac8f47125b5df5952e9` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Sun, 11 Jun 2023 08:20:44 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 12887
GET H/1.1	200 OK	core_form.css valisetours.com/online/19297-00284/service/core/form/	3 KB 3 KB	83ms 29ms	Stylesheet text/css	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/core/form/core_form.css Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `7d6b83b85d4c035952d581a985ea8a299424a80d0ef8f2278b29d7aaf03dfe36` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Thu, 31 Dec 2020 00:07:26 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2790
GET H/1.1	200 OK	css.css valisetours.com/online/19297-00284/service/login/form/	240 B 481 B	82ms 28ms	Stylesheet text/css	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/login/form/css.css Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `bc09c0ebd0c1893c33b04746dc54848a7b6aceedaa4d9af891b0cd5fb7c73893` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Thu, 31 Dec 2020 00:07:26 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 240
GET H/1.1	200 OK	form.js Show response valisetours.com/online/19297-00284/service/login/form/	3 KB 3 KB	29ms 28ms	Script application/javascript	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/login/form/form.js?v=657af74333179 Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Thu, 31 Dec 2020 00:07:26 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 3063
GET H/1.1	200 OK	token.js Show response valisetours.com/online/19297-00284/service/login/token/	1 KB 2 KB	28ms 27ms	Script application/javascript	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/login/token/token.js?v=657af7433317d Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `4990eba8e4dc4cb12cba3e92aad405f4a41a7d60146b85e0b7857502eb53a293` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Thu, 31 Dec 2020 00:07:26 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1289
GET DATA	200 OK	truncated /	68 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	45 KB 45 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `75cbe50301bbf0c1ce3e3c59839aa70c8aea681ea1ce8946e776cdc635fe2ca0` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	48 KB 48 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `aad1197d33ad36bd8a6a85689208863a674ddb3735eb4ff34701b53d656b2610` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	10 KB 10 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `aee0070713b543535d52633e18e27589267fafe5d40479afc8aa301092ba04be` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	49 KB 49 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `308325f39504503bbcef66f7db84c6e8c9e839c74324f3a237442a298f00d3dc` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/font-woff
GET H/1.1	200 OK	newloader.gif valisetours.com/online/19297-00284/service/login/form/	544 KB 544 KB	28ms 27ms	Image image/gif	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Show image Full URL https://valisetours.com/online/19297-00284/service/login/form/newloader.gif Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630` Request headers accept-language it-IT,it;q=0.9 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Last-Modified Thu, 31 Dec 2020 00:07:26 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 557122
GET DATA	200 OK	truncated /	14 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e01dbc2bd9c1ae75e5f25a4d008451cf3f268adfbd63697829a2a1eca4906c58` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	home.php Show response valisetours.com/online/19297-00284/service/	57 B 255 B	43ms 43ms	XHR application/json	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/home.php?pl=token&link=ics&bid=a411e5cb49fa6e7098fc3abd2dca71ea&callback=jQuery32109759866335730594_1702557507294&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1702557507295 Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `bd5425792ef0ceda405229a4f84bac0963b1dc57f11f61adf48857228db795e4` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? X-Requested-With XMLHttpRequest accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Transfer-Encoding chunked Content-Type application/json
GET H/1.1	200 OK	home.php Show response valisetours.com/online/19297-00284/service/	57 B 255 B	44ms 44ms	XHR application/json	92.205.129.49 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://valisetours.com/online/19297-00284/service/home.php?pl=token&link=ics&bid=a411e5cb49fa6e7098fc3abd2dca71ea&callback=jQuery32109759866335730594_1702557507296&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1702557507297 Requested by Host: valisetours.com URL: https://valisetours.com/online/19297-00284/service/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 92.205.129.49 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 49.129.205.92.host.secureserver.net Software Apache / Resource Hash `416f687c85bd2594e2611613d17ddb729b06dfc873a51a18f031db29c56fea04` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://valisetours.com/online/19297-00284/service/a1b2c3/a411e5cb49fa6e7098fc3abd2dca71ea/login/? X-Requested-With XMLHttpRequest accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Thu, 14 Dec 2023 12:38:27 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Transfer-Encoding chunked Content-Type application/json
GET DATA	200 OK	truncated /	42 KB 42 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `419a069f2859715998ec2beda0659052f7e22469385cc25011c7ecbb97266719` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	44 KB 44 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8dc82ad718de0aa2539fca7cba6934e3a32c72030d8286c5642a3688fa24f9a2` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	11 KB 11 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b312d616ed06b80dcbee875489a5ac0e768623c3e0310c265b7cc4a4c4cb08a4` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	27 KB 27 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `056aa00d7d10976fe237567766e3dba2c72ffe4942667f3fe6c9461f3e407024` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	44 KB 44 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `78fff47500f27f2f0d8d777c9d431a87036e566af7577a58ccc0776b4eb4b994` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	14 KB 14 KB		Font application/x-font-truetype
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3b4a6c07b560160a90df8c0f98042b27f129cabd2ad7352bb90b24b861feb64a` Request headers Referer Origin https://valisetours.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type application/x-font-truetype;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: International Card Services (Financial)

44 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			valisetours.com/online/19297-00284/service	1969-12-31 23:59:59	Name: real Value: OK
			valisetours.com/	1970-01-20 17:39:09	Name: bid Value: a411e5cb49fa6e7098fc3abd2dca71ea

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

icscards.online-identificatie.intraglobal.mx
valisetours.com
38.124.220.142
92.205.129.49
056aa00d7d10976fe237567766e3dba2c72ffe4942667f3fe6c9461f3e407024
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
308325f39504503bbcef66f7db84c6e8c9e839c74324f3a237442a298f00d3dc
32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630
374ffd4b4b883b179882ea87062403571a10be2a12920123c394df24aa96c464
3a5973789edf193a30418b958d4cff4f50321adce85b1d1b49e4fd6474b9b5f3
3b4a6c07b560160a90df8c0f98042b27f129cabd2ad7352bb90b24b861feb64a
416f687c85bd2594e2611613d17ddb729b06dfc873a51a18f031db29c56fea04
419a069f2859715998ec2beda0659052f7e22469385cc25011c7ecbb97266719
4990eba8e4dc4cb12cba3e92aad405f4a41a7d60146b85e0b7857502eb53a293
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
75cbe50301bbf0c1ce3e3c59839aa70c8aea681ea1ce8946e776cdc635fe2ca0
78fff47500f27f2f0d8d777c9d431a87036e566af7577a58ccc0776b4eb4b994
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7ad9e635f2d2d36caa569ec36928b881f362329a01bc6ac8f47125b5df5952e9
7d6b83b85d4c035952d581a985ea8a299424a80d0ef8f2278b29d7aaf03dfe36
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8dc82ad718de0aa2539fca7cba6934e3a32c72030d8286c5642a3688fa24f9a2
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
aad1197d33ad36bd8a6a85689208863a674ddb3735eb4ff34701b53d656b2610
aee0070713b543535d52633e18e27589267fafe5d40479afc8aa301092ba04be
b312d616ed06b80dcbee875489a5ac0e768623c3e0310c265b7cc4a4c4cb08a4
b73278606e4ed71a2d929cf169fa8085c68753d5b55a012db76c761b80f02a05
bc09c0ebd0c1893c33b04746dc54848a7b6aceedaa4d9af891b0cd5fb7c73893
bd5425792ef0ceda405229a4f84bac0963b1dc57f11f61adf48857228db795e4
e01dbc2bd9c1ae75e5f25a4d008451cf3f268adfbd63697829a2a1eca4906c58

valisetours.com Open in urlscan Pro 92.205.129.49 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

4406 kBTransfer

4414 kBSize

2 Cookies

35 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

valisetours.com Open in urlscan Pro
92.205.129.49 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

4406 kB
Transfer

4414 kB
Size

2
Cookies

14 HTTP transactions
12 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!