abhaybk.com
Open in
urlscan Pro
162.241.252.41
Malicious Activity!
Public Scan
Submitted URL: https://buybr.com.br/doudou/ou4/miracule.php
Effective URL: https://abhaybk.com/wps/creditagricole.fr/6267/
Submission: On September 10 via manual from IT — Scanned from FR
Effective URL: https://abhaybk.com/wps/creditagricole.fr/6267/
Submission: On September 10 via manual from IT — Scanned from FR
Summary
This website contacted 6 IPs
in 2 countries
across 6 domains to perform 11 HTTP transactions.
The main IP is 162.241.252.41, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is abhaybk.com.
TLS certificate: Issued by R3 on August 10th 2023. Valid for: 3 months.
This is the only time abhaybk.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on August 10th 2023. Valid for: 3 months.
This is the only time abhaybk.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Credit Agricole (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 162.215.129.174 162.215.129.174 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 3 7 | 162.241.252.41 162.241.252.41 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 1 | 69.16.175.42 69.16.175.42 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
| 2 | 104.16.86.20 104.16.86.20 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 3 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 142.250.185.234 142.250.185.234 | 15169 (GOOGLE) (GOOGLE) | |
| 11 | 6 |
1
162.215.129.174
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: servidor.veritati.com.br
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: servidor.veritati.com.br
| buybr.com.br |
7
162.241.252.41
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5684.bluehost.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5684.bluehost.com
| abhaybk.com |
1
142.250.185.234
(United States)
ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f10.1e100.net
ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f10.1e100.net
| ajax.googleapis.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
abhaybk.com
3 redirects
abhaybk.com |
646 KB |
| 3 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 249 |
424 KB |
| 2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 351 |
39 KB |
| 1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 406 |
88 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 820 |
30 KB |
| 1 |
buybr.com.br
1 redirects
buybr.com.br |
222 B |
| 11 | 6 |
| Domain | Requested by | |
|---|---|---|
| 7 | abhaybk.com |
3 redirects
abhaybk.com
|
| 3 | cdnjs.cloudflare.com |
abhaybk.com
|
| 2 | cdn.jsdelivr.net |
abhaybk.com
|
| 1 | ajax.googleapis.com |
abhaybk.com
|
| 1 | code.jquery.com |
abhaybk.com
|
| 1 | buybr.com.br | 1 redirects |
| 11 | 6 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| wwh-ikc-mybluehost-me.abhaybk.com R3 |
2023-08-10 - 2023-11-08 |
3 months | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2023-08-14 - 2023-11-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://abhaybk.com/wps/creditagricole.fr/6267/
Frame ID: B591AA36F75867EE0EDCEC6D5D8420F9
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
Crédit AgricolePage URL History Show full URLs
-
https://buybr.com.br/doudou/ou4/miracule.php
HTTP 302
https://abhaybk.com/wps/creditagricole.fr HTTP 301
https://abhaybk.com/wps/creditagricole.fr/ HTTP 302
https://abhaybk.com/wps/creditagricole.fr/6267 HTTP 301
https://abhaybk.com/wps/creditagricole.fr/6267/ Page URL
Detected technologies
HCL Digital Experience
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /wps/
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
SweetAlert
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- sweet(?:-)?alert(?:\.min)?\.js
SweetAlert2
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- sweetalert2(?:\.all)?(?:\.min)?\.js
- /npm/sweetalert2@([\d.]+)
- sweetalert2@([\d.]+)/dist/sweetalert2(?:\.all)(?:\.min)\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://buybr.com.br/doudou/ou4/miracule.php
HTTP 302
https://abhaybk.com/wps/creditagricole.fr HTTP 301
https://abhaybk.com/wps/creditagricole.fr/ HTTP 302
https://abhaybk.com/wps/creditagricole.fr/6267 HTTP 301
https://abhaybk.com/wps/creditagricole.fr/6267/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
abhaybk.com/wps/creditagricole.fr/6267/ Redirect Chain
|
655 KB 323 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
22 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
519 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
637 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
296 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
427 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
154 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
16 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
512 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/ |
77 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/ |
1 MB 410 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.mask.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
js.js
abhaybk.com/wps/creditagricole.fr/6267/media/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 88 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sweetalert2.all.min.js
cdn.jsdelivr.net/npm/sweetalert2@7.26.11/dist/ |
60 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sweetalert.min.js
cdnjs.cloudflare.com/ajax/libs/sweetalert/2.1.2/ |
40 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
region.js
abhaybk.com/wps/creditagricole.fr/6267/common/ |
831 B 524 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
238 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
abhaybk.com/wps/creditagricole.fr/6267/ |
655 KB 323 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Credit Agricole (Banking)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery number| uidEvent object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| $jscomp function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal function| setImmediate function| clearImmediate function| region_log0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
193 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
abhaybk.com
ajax.googleapis.com
buybr.com.br
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
104.16.86.20
104.17.25.14
142.250.185.234
162.215.129.174
162.241.252.41
69.16.175.42
0e7d5adfeff493b3088f41aeb3b969081c9a27db2671dbc5e219677fae69c4a5
1528796dea6aabd909887df82c81deb5683e2d17d2402add342572a9901f90b8
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b
355e0131906f32d2affba9e3ba73da45bbcdd56c7696798f201663c9412515d0
36e60f0a233cd0cb67b2c553cd8fb3415d5fbcb43b2c4df3355f05db5495954e
42d69be072790ad156c9a5352cc5f3a5d48239a77178503d5b21abbcb0e31a58
4a3b0d2a941677f6fb37a438d20deacc3cea1d6fdc728f72cf3d7ca099cc0ca9
5c44321c0ba44a1fa665ba4c928fbebd869a3082c458bd2d20a0d07a4e5fcc24
6965c967fe2474e34f024a08618c84e9f995c3482a3c46e793b9eca4b00d82e2
6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e
6fd6839426aabc880cef8714c245bd0d65d6cbf86415c318649b0e48a97ce290
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
c4966ab5e78e2270952b89576c4a0a386e8a7ea673c56f0f396d620abf4f81b8
c50a0d8e11228c0b2aaa14f7a9a7d31275e580d50fcb1a4a576fe152ff5a463a
ec8b74ebc1254dca8342349cd7cc8e3d7c97ee0e680b9ec59d396e4ae00ec772
f44a45ec070ac146064801f229c24fc830ef3888756efacd826a8b129962275e
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d