cr.lnet.org.il
Open in
urlscan Pro
82.80.206.57
Malicious Activity!
Public Scan
URL:
https://cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index2.php?cmd=_account-details&session=a9b...
Submission: On March 03 via automatic, source openphish
Submission: On March 03 via automatic, source openphish
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 23 HTTP transactions.
The main IP is 82.80.206.57, located in
Kfar Saba, Israel and
belongs to BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone, IL.
The main domain is cr.lnet.org.il.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 10th 2020. Valid for: a year.
This is the only time cr.lnet.org.il was scanned on urlscan.io!
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 10th 2020. Valid for: a year.
This is the only time cr.lnet.org.il was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Regions Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 23 | 82.80.206.57 82.80.206.57 | 8551 (BEZEQ-INT...) (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone) | |
| 23 | 1 |
23
82.80.206.57
(Kfar Saba, Israel)
ASN8551 (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone, IL)
PTR: bzq-82-80-206-57.red.bezeqint.net
ASN8551 (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone, IL)
PTR: bzq-82-80-206-57.red.bezeqint.net
| cr.lnet.org.il |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 23 |
lnet.org.il
cr.lnet.org.il |
69 KB |
| 23 | 1 |
| Domain | Requested by | |
|---|---|---|
| 23 | cr.lnet.org.il |
cr.lnet.org.il
|
| 23 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.lnet.org.il Go Daddy Secure Certificate Authority - G2 |
2020-09-10 - 2021-09-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index2.php?cmd=_account-details&session=a9bcb87b64d9b3d4bc379bc9bfc2ecb9&dispatch=249153f3fa89ce6f2c7f4abdf583f8d442076b3f
Frame ID: D18CFD7D5343B5C47D735F176D023C33
Requests: 23 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Windows Server
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
IIS
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index2.php
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/ |
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
s44977309593409
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
analytics.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
js
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
d6e7433c8cee728f806e4548723eaa72.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aaed6ca3a40617bbda790c79347c4690.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
serverComponent.php
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
392 B 595 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
com-regions.min.css
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
243 KB 49 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
com-regions.min.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
regions-logo-no-r.svg
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
5 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
equal-housing-lender.svg
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
member-fdic.svg
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
global-overlays.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Bootstrap.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
com-regions.min.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
source-sans-pro-700-webfont.woff
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
glyphicons-halflings-regular.woff2
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
source-sans-pro-regular-webfont.woff
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
com-regions.min.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
glyphicons-halflings-regular.woff
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
global-overlays.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
glyphicons-halflings-regular.ttf
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Bootstrap.js.download
cr.lnet.org.il/wp-content/uploads/2020/12/button2/detalle/REG/1/run/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Regions Bank (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| cr.lnet.org.il/ | Name: TestCookie Value: testcookie |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cr.lnet.org.il
82.80.206.57
5c1672a0938ead29c435de5cc103e27c98a40698f689f8d1ffb3a9d4be61fd9d
8b69a3707a2ef4a748dd6c9923a1fa17d1ed5d32eee6e60240540217cf30b324
912f72af9fe61099bc2452960df7b72ee662d5c3e6188ab246767de1fe367913
9562f0b0d20b48deb112d1c7e183b5fddd4d5bfaf45ddb7e3e93cafa0289d7d2
b11b129e363e51edb304b5996900cd6d4e70f5ce319acf18a47b87d8877fa2c8
e4bc94279e093f25720c2867e7a08dbfaaa140636f11eab5ac4e204a93a3751e