Windows Analysis Report
http://https-mail-tiscali-it-emam.weebly.com/

Overview

General Information

Sample URL:	http://https-mail-tiscali-it-emam.weebly.com/
Analysis ID:	1521296
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish10

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://https-mail-tiscali-it-emam.weebly.com/

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://https-mail-tiscali-it-emam.weebly.com/

LLM: Score: 9 Reasons: The URL contains 'weebly.com', which is a website builder platform and not associated with Tiscali., The legitimate domain for Tiscali is 'tiscali.it'., The URL structure 'https-mail-tiscali-it-emam.weebly.com' is suspicious due to the use of multiple hyphens and the inclusion of 'weebly.com'., Phishing sites often use well-known brand names in combination with website builder platforms to create a sense of legitimacy. DOM: 0.1.pages.csv

Yara detected HtmlPhish10

Source: Yara match

File source: dropped/chromecache_111, type: DROPPED

Source: https://https-mail-tiscali-it-emam.weebly.com/

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49774 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.5:49774 -> 23.1.237.91:443 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49748 version: TLS 1.2

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2032366 - Severity 2 - ET PHISHING Phishing Landing via Weebly.com M1 2016-02-02 : 74.115.51.8:443 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2032367 - Severity 2 - ET PHISHING Phishing Landing via Weebly.com M2 2016-02-02 : 74.115.51.8:443 -> 192.168.2.5:49711

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49774 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.5:49774 -> 23.1.237.91:443 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ
Source: global traffic	HTTP traffic detected: GET /css/sites.css?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/social-icons.css?buildtime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/old/fancybox.css?1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Lato/font.css?2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/main_style.css?1720488947 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /fonts/Cabin/font.css?2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Roboto/font.css?2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/templateArtifacts.js?1720488947 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /js/jquery-1.8.3.min.js HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/site/main.js?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lang/en/stl.js?buildTime=1720477481& HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/site/footer/footer-toast-published-image-1.png HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/site/footerSignup.js?buildTime=1727448693 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/templateArtifacts.js?1720488947 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /files/theme/plugins.js?1583952700 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /files/theme/custom.js?1583952700 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /js/site/main-customer-accounts-site.js?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploads/1/5/0/1/150187548/background-images/1811372873.png HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /fonts/Lato/regular.woff2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://https-mail-tiscali-it-emam.weebly.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn2.editmysite.com/fonts/Lato/font.css?2Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Cabin/regular.woff2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://https-mail-tiscali-it-emam.weebly.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn2.editmysite.com/fonts/Cabin/font.css?2Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery-1.8.3.min.js HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/site/footerSignup.js?buildTime=1727448693 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/site/footer/footer-toast-published-image-1.png HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lang/en/stl.js?buildTime=1720477481& HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/site/main.js?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/theme/plugins.js?1583952700 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /css/free-footer-v3.css?buildtime=1727448693 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/wsnbn/snowday262.js HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/theme/custom.js?1583952700 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /js/site/main-customer-accounts-site.js?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploads/1/5/0/1/150187548/background-images/1811372873.png HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?_=1727501062388 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/wsnbn/snowday262.js HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails] HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en; _snow_ses.0b9a=*; _snow_id.0b9a=61a5ee6d-7ec4-4142-b3df-7c41469e4cfa.1727501064.1.1727501064.1727501064.490901e5-c1af-4853-b675-d9cad7594956
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?_=1727501062388 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en; _snow_ses.0b9a=; _snow_id.0b9a=61a5ee6d-7ec4-4142-b3df-7c41469e4cfa.1727501064.1.1727501064.1727501064.490901e5-c1af-4853-b675-d9cad7594956
Source: global traffic	HTTP traffic detected: GET /com.snowplowanalytics.snowplow/tp2 HTTP/1.1Host: ec.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sp=aedd4583-f652-4eb3-a576-e257dfe6726e
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en; _snow_ses.0b9a=*; _snow_id.0b9a=61a5ee6d-7ec4-4142-b3df-7c41469e4cfa.1727501064.1.1727501064.1727501064.490901e5-c1af-4853-b675-d9cad7594956
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: https-mail-tiscali-it-emam.weebly.com
Source: global traffic	DNS traffic detected: DNS query: cdn2.editmysite.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ec.editmysite.com

Source: unknown

HTTP traffic detected: POST /ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails] HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveContent-Length: 83sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/javascript, */*; q=0.01Content-Type: application/json; charset=UTF-8X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://https-mail-tiscali-it-emam.weebly.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en

Source: chromecache_112.2.dr, chromecache_99.2.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: http://www.google-analytics.com
Source: chromecache_111.2.dr	String found in binary or memory: https://cdn2.editmysite.com/images/site/footer/og-image-placeholder-blank.png
Source: chromecache_90.2.dr, chromecache_98.2.dr	String found in binary or memory: https://cdn2.editmysite.com/js/
Source: chromecache_111.2.dr	String found in binary or memory: https://cdn2.editmysite.com/js/jquery-1.8.3.min.js
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_111.2.dr	String found in binary or memory: https://https-mail-tiscali-it-emam.weebly.com/
Source: chromecache_85.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_85.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: chromecache_85.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_112.2.dr, chromecache_99.2.dr	String found in binary or memory: https://twitter.com/jacobrossi/status/480596438489890816
Source: chromecache_113.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?
Source: chromecache_111.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chromecache_100.2.dr, chromecache_101.2.dr, chromecache_85.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/xds0rzGrktR88uEZ2JUvdgOY/recaptcha__.
Source: chromecache_100.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/xds0rzGrktR88uEZ2JUvdgOY/recaptcha__en.js
Source: chromecache_111.2.dr	String found in binary or memory: https://www.weebly.com/signup?utm_source=internal&utm_medium=footer

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49748 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@17/76@20/11

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2380,i,11652341117594909242,5101623831493754951,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https-mail-tiscali-it-emam.weebly.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2380,i,11652341117594909242,5101623831493754951,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
74.115.51.8	unknown	United States	27647	WEEBLYUS	false
74.115.51.9	https-mail-tiscali-it-emam.weebly.com	United States	27647	WEEBLYUS	true
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
151.101.1.46	unknown	United States	54113	FASTLYUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
54.148.226.32	sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.129.46	weebly.map.fastly.net	United States	54113	FASTLYUS	false

Private

IP
192.168.2.6
192.168.2.5

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
https-mail-tiscali-it-emam.weebly.com	74.115.51.9	true
sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com	54.148.226.32	true
weebly.map.fastly.net	151.101.129.46	true
www.google.com	142.250.185.132	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
ec.editmysite.com	unknown	unknown
cdn2.editmysite.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/recaptcha/api.js?_=1727501062388	false		unknown
https://https-mail-tiscali-it-emam.weebly.com/	true		unknown
https://cdn2.editmysite.com/fonts/Lato/regular.woff2	false		unknown
https://cdn2.editmysite.com/js/site/main.js?buildTime=1720477481	false		unknown
https://cdn2.editmysite.com/js/site/footerSignup.js?buildTime=1727448693	false		unknown
https://cdn2.editmysite.com/fonts/Cabin/regular.woff2	false		unknown
https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1720477481&	false		unknown
https://cdn2.editmysite.com/css/sites.css?buildTime=1720477481	false		unknown
https://cdn2.editmysite.com/css/old/fancybox.css?1720477481	false		unknown
https://cdn2.editmysite.com/images/site/footer/footer-toast-published-image-1.png	false		unknown
https://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1720477481	false		unknown
https://cdn2.editmysite.com/fonts/Lato/font.css?2	false		unknown
https://cdn2.editmysite.com/css/free-footer-v3.css?buildtime=1727448693	false		unknown
https://cdn2.editmysite.com/fonts/Roboto/font.css?2	false		unknown
https://https-mail-tiscali-it-emam.weebly.com/uploads/1/5/0/1/150187548/background-images/1811372873.png	true		unknown
https://https-mail-tiscali-it-emam.weebly.com/files/theme/custom.js?1583952700	true		unknown
https://https-mail-tiscali-it-emam.weebly.com/files/templateArtifacts.js?1720488947	true		unknown
https://cdn2.editmysite.com/fonts/Cabin/font.css?2	false		unknown
https://https-mail-tiscali-it-emam.weebly.com/files/theme/plugins.js?1583952700	true		unknown
https://cdn2.editmysite.com/css/social-icons.css?buildtime=1720477481	false		unknown
https://cdn2.editmysite.com/js/jquery-1.8.3.min.js	false		unknown
https://https-mail-tiscali-it-emam.weebly.com/favicon.ico	true		unknown
http://https-mail-tiscali-it-emam.weebly.com/	true		unknown
https://https-mail-tiscali-it-emam.weebly.com/files/main_style.css?1720488947	true		unknown
https://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2	false	URL Reputation: safe	unknown
https://https-mail-tiscali-it-emam.weebly.com/ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails]	true		unknown
https://cdn2.editmysite.com/js/wsnbn/snowday262.js	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:24:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	52D7F95413CD9EDE6A94DB2F508CAB61	1D396AE05F25492E05219FAD78747F0D25DB6E91	E92FD643CFBD0BE98ED99A4669664149982916B2631A3B8E436E7545D81CE6B3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:24:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9E4D0D1DD1FAD97EDD43FE8EAA966C87	F7520952368568814F68DD14291CE641F3606C04	BC0DB757BEE95998B0A9585E67B3C8DF07648756EAEB748C7831411DD5BF9F54
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FDFB63F191A29DEBEC08CE1B75FC0FFE	D5B01B3C3086756ADE8BC64B6AE824A244104518	D9007BC909CA17C4E4340B78DD68AEE9042D9D15295E7DB44240CCF3A83D4E75
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:24:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	67BD8FAFC5BFA383E77164E453638CB8	FC99E476AD9B5FB5A0937B407F854651A0818C2D	81034560640994AF3C02C7C988CEABDA6F302E0E4D630D70C41210E190A8912A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:24:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3185EB882FF2FB0A02EC930AD479D2E6	95B5C69FFEF757A971632571442741ABA8D62BCC	522C7659C81BA92832C20891506BF1D02DD3A7EF41B7568FE15933D71356AB1B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:24:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6851AF355D5933456104C59CE63DAE12	C64C565AD2E146C855C11D97CF97246E982A6AE4	F563068530D5FAF314C76A5C82C8E0164E73A9D21A868CA16F48B7C69FCC6EA8
Chrome Cache Entry: 100	ASCII text, with very long lines (1434), with no line terminators	E7F4945A3458503BDEE0AD9476537604	CD049E2F8F9D05ABC087BBEF7EFEDA01EFB0F3A6	8AB3BC08E25F6A7E24EF75EE66ED06360BCEEACE487D22822D7724B3F2BBED50
Chrome Cache Entry: 101	ASCII text, with very long lines (724)	33AFF52B82A1DF246136E75500D93220	4675754451AF81F996EAB925923C31EF5115A9F4	B5E8EC5D4DCC080657DEB2D004F65D974BF4EC9E9AA5D621E10749182FFF8731
Chrome Cache Entry: 102	ASCII text, with very long lines (32029)	5295FC679EEA80780246F38A98DF4119	AB671B1376AE82788886E2E18C4FDB7B7AC6FCC7	C1CD4E7693F8C40D13259E8AC271CD0B6870875CA6C69B78D50AEDE9EEB63B67
Chrome Cache Entry: 103	ASCII text, with very long lines (65536), with no line terminators	13C487170BFCBFFD16C49C7858C89268	924A4541909070CBB5D83F2E5E41E53F60CDDCA3	4C8459201BFF441161411730D82AE15E6DB376ADF116B2C745BA8FA3522D828E
Chrome Cache Entry: 104	PNG image data, 1920 x 1063, 8-bit/color RGBA, non-interlaced	97906B102593B0B3FCA2D353A2F08C3C	2C3E0DA510D09A5F3BD17A38FE665F745D055DD1	7F43C67B91989EDCC76B625C833FC7404FCE645C337CEEC73DA90FEA411C0FD0
Chrome Cache Entry: 105	ASCII text, with very long lines (2632)	B09E83D2AEAC55C0D3B67186CD5009FF	FA87CEC84CC36FC2E70804867DA24578EA331999	251A983A1B4B2CC76542AA398AE6B3499978A788860B54A8081D35D7A843303C
Chrome Cache Entry: 106	Web Open Font Format (Version 2), TrueType, length 15476, version 1.0	083F5CAFE748B8AC91823B36986D7FDA	0D763699E5BCE633AA6ADC03370B8630B87C1B31	A3D8AFCBC68D3AE65312E50CE252F5EB4CB817D3FE39452BD37A76F896AB5921
Chrome Cache Entry: 107	ASCII text, with no line terminators	E9AB25068A8FD4522789892F354338D7	E937FB798A1228C60574749D0DA040F750D06D33	267D6FFC9933ECC15F98D91D40396859E091CBA23239EA597A9E2B3D1926B90E
Chrome Cache Entry: 108	ASCII text, with very long lines (571)	89BAD71F9A3F0CFB52BE4B0CCC38FF9F	563D4B270105B00EEE3EAB9CAF0CFDA082E17BBF	01C6855467719691A45E89089123470AA347A23F18EF06584C02FEDF42B9AB17
Chrome Cache Entry: 109	Web Open Font Format (Version 2), TrueType, length 23580, version 1.0	E1B3B5908C9CF23DFB2B9C52B9A023AB	FCD4136085F2A03481D9958CC6793A5ED98E714C	918B7DC3E2E2D015C16CE08B57BCB64D2253BAFC1707658F361E72865498E537
Chrome Cache Entry: 110	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	4D27526198AC873CCEC96935198E0FB9	B98D8B73AD6A0F7477C3397561B4AAB37BF262AA	40A2146151863BCF46C786D596E81A308D1B0D26D74635BE441E92656F29B1B4
Chrome Cache Entry: 111	HTML document, ASCII text, with very long lines (914)	AF9F94B9A9C0D10D6BB03197563D2F5B	A60E7919B2712F507DCFF8E45D4C7C260467A2F6	62C3E14C8B94B9A73E68A719A55F71DC4A81865E460E1D2248C7974D9539F39D
Chrome Cache Entry: 112	ASCII text	64497D2AB794CDB5E3C5C86CF7C5A611	34ACD67927409D0795EE025F64F99757494AFFED	637B5D2A661D0201F239A7AFCD1278BF55BEC7EF7ADA6CC6C0485C4E45D9B702
Chrome Cache Entry: 113	ASCII text, with very long lines (1305)	E9372F0EBBCF71F851E3D321EF2A8E5A	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
Chrome Cache Entry: 114	PNG image data, 1920 x 1063, 8-bit/color RGBA, non-interlaced	97906B102593B0B3FCA2D353A2F08C3C	2C3E0DA510D09A5F3BD17A38FE665F745D055DD1	7F43C67B91989EDCC76B625C833FC7404FCE645C337CEEC73DA90FEA411C0FD0
Chrome Cache Entry: 115	ASCII text	883E3027B65CEF38BA8624069F989DCB	02D28332B36E73F9A1FF855ADFCE7466119117C9	B4F2DE5B6B0CE67EB0BDB6BDB1A0272CE6C6A17D9632EC9A090565D339836AB1
Chrome Cache Entry: 116	PNG image data, 199 x 97, 8-bit colormap, non-interlaced	6E0F7AD31BF187E0D88FC5787573BA71	14E8B85CC32A01C8901E4AC0160582D29A45E9E6	580EF6409E067A4EC4A427400C7D6216184869E2DA53343DF20753CC1F8A46CD
Chrome Cache Entry: 117	ASCII text, with very long lines (2512)	99BBE560926E583B8E99036251DEB783	8D81B73AE06F664F9D9E53DD5829A799BF434491	648E766BF519673F9A90CC336CBECEDE80DCBE3419B43D36ECBB25D88F5584A3
Chrome Cache Entry: 118	ASCII text, with very long lines (65483)	3576A6E73C9DCCDBBC4A2CF8FF544AD7	06E872300088B9BA8A08427D28ED0EFCDF9C6FF5	61C6CAEBD23921741FB5FFE6603F16634FCA9840C2BF56AC8201E9264D6DACCF
Chrome Cache Entry: 119	exported SGML document, ASCII text, with very long lines (1630)	AE81AB7069097A055829FB9919258138	7DC529F16FB595BBBFC5937ADFE1D0A5CF563F8A	5A630B41E7C3D34392BCB150A5731B6261BC6314D71D5DB8407A646AF15BF8AF
Chrome Cache Entry: 120	ASCII text	031AFC1E38DF9F7A75040672E5D7625C	B4393D10E75A500B9C3701CECD2E06D9AB8894F7	66EA3B4259912AD511FDDC6E8EDD1A8AA28D7F623D14FC65E746146AB568A039
Chrome Cache Entry: 121	JSON data	F6BF880CA34C3E868763365FDC30B392	9B1B41E6AAE16E4FDCC28DBE92679D564352C8C5	B884D8BFFBC6E1C794D4EAE301A9698B535F857D1837B9B9D60C4651A78A2E1E
Chrome Cache Entry: 122	ASCII text, with very long lines (3910)	1DCEBBB5A1EB8B028310CEEB72A339B3	E254B7A35AC189FD1CE9CF8BD78593BEBFE27D7D	865CB87DE9FC4D6530EDCE21F0103107ABAE6ABE45CABDFF2AD9AF067B3D8E0A
Chrome Cache Entry: 123	PNG image data, 199 x 97, 8-bit colormap, non-interlaced	6E0F7AD31BF187E0D88FC5787573BA71	14E8B85CC32A01C8901E4AC0160582D29A45E9E6	580EF6409E067A4EC4A427400C7D6216184869E2DA53343DF20753CC1F8A46CD
Chrome Cache Entry: 124	ASCII text, with very long lines (13080)	63FAADBECF44212B7D69C604CC560FF8	E7B2384F6A743A7DCFD7802F45546D7F38AB543E	7AA561E5E8A51E3EE882E742F7D8D785015CDDF1481FED0709523B41987F99E5
Chrome Cache Entry: 125	ASCII text	031AFC1E38DF9F7A75040672E5D7625C	B4393D10E75A500B9C3701CECD2E06D9AB8894F7	66EA3B4259912AD511FDDC6E8EDD1A8AA28D7F623D14FC65E746146AB568A039
Chrome Cache Entry: 83	exported SGML document, ASCII text, with very long lines (1630)	AE81AB7069097A055829FB9919258138	7DC529F16FB595BBBFC5937ADFE1D0A5CF563F8A	5A630B41E7C3D34392BCB150A5731B6261BC6314D71D5DB8407A646AF15BF8AF
Chrome Cache Entry: 84	ASCII text, with very long lines (65024)	F0B78CD42142EA43D52682266F170ADF	F830FC2592E8E08D425D8137E9AEFCDAE884CD89	BEDFAFC1C7CDC9BE81CF5B836F6BD001FC4C25DEC659DC22EE78B4DAFB98E31C
Chrome Cache Entry: 85	ASCII text, with very long lines (724)	33AFF52B82A1DF246136E75500D93220	4675754451AF81F996EAB925923C31EF5115A9F4	B5E8EC5D4DCC080657DEB2D004F65D974BF4EC9E9AA5D621E10749182FFF8731
Chrome Cache Entry: 86	ASCII text	8748EEC74F3E1353FF5D59C4FC793928	5C585058EBE43354156E0C7F1C40937128804FA7	CB2642E037C6E74EACE100541B7E6776ECAF14371B49E4DECF7831BFB0A7147B
Chrome Cache Entry: 87	ASCII text, with very long lines (65483)	3576A6E73C9DCCDBBC4A2CF8FF544AD7	06E872300088B9BA8A08427D28ED0EFCDF9C6FF5	61C6CAEBD23921741FB5FFE6603F16634FCA9840C2BF56AC8201E9264D6DACCF
Chrome Cache Entry: 88	ASCII text, with very long lines (1434), with no line terminators	E7F4945A3458503BDEE0AD9476537604	CD049E2F8F9D05ABC087BBEF7EFEDA01EFB0F3A6	8AB3BC08E25F6A7E24EF75EE66ED06360BCEEACE487D22822D7724B3F2BBED50
Chrome Cache Entry: 89	ASCII text, with very long lines (65024)	A025B2B246E67310913096285E10C489	3B4224E2FE4ADD92DB5EA2D8C987F8713635E05F	F04AAADBE7CE02DFE54548FE006966BAED53181E8189FBEF5334A34559A0EA56
Chrome Cache Entry: 90	ASCII text, with very long lines (3600), with no line terminators	40B81B2D52BA9D2E2C64C31FF6A24CD7	6B5689250661646ECBB841F2475F1556A113373C	E06BACA13F25DF9C7D684FC1B1FDFBBBB95070A1D5A9CD648632DA7BCCC90B96
Chrome Cache Entry: 91	ASCII text, with very long lines (32029)	5295FC679EEA80780246F38A98DF4119	AB671B1376AE82788886E2E18C4FDB7B7AC6FCC7	C1CD4E7693F8C40D13259E8AC271CD0B6870875CA6C69B78D50AEDE9EEB63B67
Chrome Cache Entry: 92	ASCII text, with very long lines (2512)	99BBE560926E583B8E99036251DEB783	8D81B73AE06F664F9D9E53DD5829A799BF434491	648E766BF519673F9A90CC336CBECEDE80DCBE3419B43D36ECBB25D88F5584A3
Chrome Cache Entry: 93	ASCII text, with very long lines (32147)	016FFAE66513FCAE583BCC64A0B66869	CD2CCF7CC47BD6ADBC1FB46F8A88D610824F7037	55F966D09AFC4A653A1F26B57E57412D5C42191D5692157D94110B23CA74C9D2
Chrome Cache Entry: 94	ASCII text	05F181094C6A399A6A095B872FDD62A2	DCD242A26E18EAA525C20AE2BC6E32D2393664F6	926C730CD097087583D7B2EAF8CFA55FABCB061F576CFBF154BE708DFE672C77
Chrome Cache Entry: 95	ASCII text, with very long lines (1305)	E9372F0EBBCF71F851E3D321EF2A8E5A	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
Chrome Cache Entry: 96	ASCII text, with very long lines (32147)	016FFAE66513FCAE583BCC64A0B66869	CD2CCF7CC47BD6ADBC1FB46F8A88D610824F7037	55F966D09AFC4A653A1F26B57E57412D5C42191D5692157D94110B23CA74C9D2
Chrome Cache Entry: 97	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	4D27526198AC873CCEC96935198E0FB9	B98D8B73AD6A0F7477C3397561B4AAB37BF262AA	40A2146151863BCF46C786D596E81A308D1B0D26D74635BE441E92656F29B1B4
Chrome Cache Entry: 98	ASCII text, with very long lines (3600), with no line terminators	40B81B2D52BA9D2E2C64C31FF6A24CD7	6B5689250661646ECBB841F2475F1556A113373C	E06BACA13F25DF9C7D684FC1B1FDFBBBB95070A1D5A9CD648632DA7BCCC90B96
Chrome Cache Entry: 99	ASCII text	64497D2AB794CDB5E3C5C86CF7C5A611	34ACD67927409D0795EE025F64F99757494AFFED	637B5D2A661D0201F239A7AFCD1278BF55BEC7EF7ADA6CC6C0485C4E45D9B702

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://https-mail-tiscali-it-emam.weebly.com/

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://https-mail-tiscali-it-emam.weebly.com/

Yara detected HtmlPhish10

Source: Yara match

File source: dropped/chromecache_111, type: DROPPED

Source: https://https-mail-tiscali-it-emam.weebly.com/

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49774 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.5:49774 -> 23.1.237.91:443 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49748 version: TLS 1.2

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2032366 - Severity 2 - ET PHISHING Phishing Landing via Weebly.com M1 2016-02-02 : 74.115.51.8:443 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2032367 - Severity 2 - ET PHISHING Phishing Landing via Weebly.com M2 2016-02-02 : 74.115.51.8:443 -> 192.168.2.5:49711

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49774 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.5:49774 -> 23.1.237.91:443 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ
Source: global traffic	HTTP traffic detected: GET /css/sites.css?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/social-icons.css?buildtime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/old/fancybox.css?1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Lato/font.css?2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/main_style.css?1720488947 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /fonts/Cabin/font.css?2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Roboto/font.css?2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/templateArtifacts.js?1720488947 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /js/jquery-1.8.3.min.js HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/site/main.js?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lang/en/stl.js?buildTime=1720477481& HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/site/footer/footer-toast-published-image-1.png HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/site/footerSignup.js?buildTime=1727448693 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/templateArtifacts.js?1720488947 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /files/theme/plugins.js?1583952700 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /files/theme/custom.js?1583952700 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /js/site/main-customer-accounts-site.js?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploads/1/5/0/1/150187548/background-images/1811372873.png HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /fonts/Lato/regular.woff2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://https-mail-tiscali-it-emam.weebly.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn2.editmysite.com/fonts/Lato/font.css?2Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Cabin/regular.woff2 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://https-mail-tiscali-it-emam.weebly.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn2.editmysite.com/fonts/Cabin/font.css?2Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery-1.8.3.min.js HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/site/footerSignup.js?buildTime=1727448693 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/site/footer/footer-toast-published-image-1.png HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/lang/en/stl.js?buildTime=1720477481& HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/site/main.js?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/theme/plugins.js?1583952700 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /css/free-footer-v3.css?buildtime=1727448693 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/wsnbn/snowday262.js HTTP/1.1Host: cdn2.editmysite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/theme/custom.js?1583952700 HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /js/site/main-customer-accounts-site.js?buildTime=1720477481 HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploads/1/5/0/1/150187548/background-images/1811372873.png HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?_=1727501062388 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/wsnbn/snowday262.js HTTP/1.1Host: cdn2.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails] HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en; _snow_ses.0b9a=*; _snow_id.0b9a=61a5ee6d-7ec4-4142-b3df-7c41469e4cfa.1727501064.1.1727501064.1727501064.490901e5-c1af-4853-b675-d9cad7594956
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?_=1727501062388 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://https-mail-tiscali-it-emam.weebly.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en; _snow_ses.0b9a=; _snow_id.0b9a=61a5ee6d-7ec4-4142-b3df-7c41469e4cfa.1727501064.1.1727501064.1727501064.490901e5-c1af-4853-b675-d9cad7594956
Source: global traffic	HTTP traffic detected: GET /com.snowplowanalytics.snowplow/tp2 HTTP/1.1Host: ec.editmysite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sp=aedd4583-f652-4eb3-a576-e257dfe6726e
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: is_mobile=0; __cf_bm=PClJcZeDla58sLWDQT2hHTPc8QuaIjJdybxI69f4O2c-1727501057-1.0.1.1-nBasrYsMCFnxcl7fgfOSil_CY87.PARf1pSLGC6kijfR8BMsr1dPfa1QiC2wAl9zlmYVcUNGUBO.wV.0oLo8NQ; language=en; _snow_ses.0b9a=*; _snow_id.0b9a=61a5ee6d-7ec4-4142-b3df-7c41469e4cfa.1727501064.1.1727501064.1727501064.490901e5-c1af-4853-b675-d9cad7594956
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: https-mail-tiscali-it-emam.weebly.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: https-mail-tiscali-it-emam.weebly.com
Source: global traffic	DNS traffic detected: DNS query: cdn2.editmysite.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ec.editmysite.com

Source: unknown

Source: chromecache_112.2.dr, chromecache_99.2.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: http://www.google-analytics.com
Source: chromecache_111.2.dr	String found in binary or memory: https://cdn2.editmysite.com/images/site/footer/og-image-placeholder-blank.png
Source: chromecache_90.2.dr, chromecache_98.2.dr	String found in binary or memory: https://cdn2.editmysite.com/js/
Source: chromecache_111.2.dr	String found in binary or memory: https://cdn2.editmysite.com/js/jquery-1.8.3.min.js
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_111.2.dr	String found in binary or memory: https://https-mail-tiscali-it-emam.weebly.com/
Source: chromecache_85.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_85.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: chromecache_85.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_112.2.dr, chromecache_99.2.dr	String found in binary or memory: https://twitter.com/jacobrossi/status/480596438489890816
Source: chromecache_113.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: chromecache_95.2.dr, chromecache_113.2.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?
Source: chromecache_111.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chromecache_100.2.dr, chromecache_101.2.dr, chromecache_85.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_101.2.dr, chromecache_85.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/xds0rzGrktR88uEZ2JUvdgOY/recaptcha__.
Source: chromecache_100.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/xds0rzGrktR88uEZ2JUvdgOY/recaptcha__en.js
Source: chromecache_111.2.dr	String found in binary or memory: https://www.weebly.com/signup?utm_source=internal&utm_medium=footer

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49748 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@17/76@20/11

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2380,i,11652341117594909242,5101623831493754951,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https-mail-tiscali-it-emam.weebly.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2380,i,11652341117594909242,5101623831493754951,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1521296
Product:	CloudBasic
Start time:	07:23:21
Start date:	28.09.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://https-mail-tiscali-it-emam.weebly.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://https-mail-tiscali-it-emam.weebly.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://https-mail-tiscali-it-emam.weebly.com/