riv.mlg.mybluehost.me
Open in
urlscan Pro
96.125.174.158
Malicious Activity!
Public Scan
Submission: On May 08 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on April 30th 2024. Valid for: 3 months.
This is the only time riv.mlg.mybluehost.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Credit Agricole (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
17 | 96.125.174.158 96.125.174.158 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 | 158.191.172.47 158.191.172.47 | 9159 (Credit Ag...) (Credit Agricole) | |
1 | 104.26.12.205 104.26.12.205 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
21 | 4 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5942.bluehost.com
riv.mlg.mybluehost.me |
ASN9159 (Credit Agricole, FR)
PTR: www.credit-agricole.fr
www.credit-agricole.fr |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
mybluehost.me
riv.mlg.mybluehost.me |
640 KB |
2 |
credit-agricole.fr
www.credit-agricole.fr — Cisco Umbrella Rank: 215474 |
246 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 33 |
3 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2924 |
166 B |
21 | 4 |
Domain | Requested by | |
---|---|---|
17 | riv.mlg.mybluehost.me |
riv.mlg.mybluehost.me
|
2 | www.credit-agricole.fr |
riv.mlg.mybluehost.me
|
1 | fonts.googleapis.com |
riv.mlg.mybluehost.me
|
1 | api.ipify.org |
riv.mlg.mybluehost.me
|
21 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.website-7a7e7fc5.ms-smartsecurity.com R3 |
2024-04-30 - 2024-07-29 |
3 months | crt.sh |
www.credit-agricole.fr Sectigo RSA Organization Validation Secure Server CA |
2023-07-24 - 2024-07-23 |
a year | crt.sh |
ipify.org GTS CA 1P5 |
2024-03-21 - 2024-06-19 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/index_.html
Frame ID: 48786D682F5656A59CD63A9DAFF9972F
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
Accès CR - Crédit AgricoleDetected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Bootstrap (Web Frameworks) Expand
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
AngularJS (JavaScript Frameworks) Expand
Detected patterns
- \bangular.{0,32}\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index_.html
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/ |
24 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular.min.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
163 KB 69 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
86 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.CardValidator.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.min.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
22 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
18 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
2 KB 896 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/css/ |
138 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.css
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/css/ |
40 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/css/ |
1 KB 351 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NPC-logo_Agir_chaque_jour_CA_H_Desktop-1.svg
www.credit-agricole.fr/content/dam/assetsca/master/public/commun/images/autre/images/ |
22 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
58 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
1 MB 421 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/js/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cmd.js
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/system/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipify.org/ |
31 B 166 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
49 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
acces_cr_part_carre.jpg
www.credit-agricole.fr/content/dam/assetsca/master/public/commun/images/zone-de-gauche/connect%C3%A9/ |
238 KB 239 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.png
riv.mlg.mybluehost.me/website_61090eb1/wp-includes/images/.cacr/crc-h/style/ |
11 KB 11 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Credit Agricole (Banking)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| angular function| $ function| jQuery function| preventBack function| Popper object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome boolean| isShift string| seperator string| dash function| cc_date function| date_of_birth function| validatePhoneNumber object| phoneNumberInput function| getIP0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipify.org
fonts.googleapis.com
riv.mlg.mybluehost.me
www.credit-agricole.fr
104.26.12.205
158.191.172.47
2a00:1450:4001:81c::200a
96.125.174.158
0906eba4f72e2f3305c8ba7f86e04210b11540806b64f45c18691f12e867ee8d
16e8f08eb363930ccc9f0e91f33ded7905fed943045a040078196294db8a9b17
2a6536dfb04e99526ca10907b63b77bd89acf583d1e0a5351a64983b65a860ab
2c3246ef3086a1f328b1ea25eeef141908b7daa166b753da5203450c18f06487
2e31f31633d04598c60731878851d821eaa4403af63b930d58bb10bc9c0428a2
306ab8dd287ef041231a510b7e4c027a11e28b20c3408a9185d895c091dc72a4
3358b6f2d9351fd1fec303210400a4514cc55a851ad97d202cfc0f840e3f54a7
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
5c44321c0ba44a1fa665ba4c928fbebd869a3082c458bd2d20a0d07a4e5fcc24
5d2350032234ad0508325e9c6c3de06675cf78bf2e5e3394efce4993f2489191
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
86c051eb57fe97e4dc99fd4cba7334c3faef8e6d3655da6f2b04176f523d96f5
8965eaf1598037b1a608ede6ff9633e6944b70039d631f80f635e25c79030da8
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
c4966ab5e78e2270952b89576c4a0a386e8a7ea673c56f0f396d620abf4f81b8
cd8873d8c03fd90eacd976f57b300327972964a89c7ac37d27e369d0324b9999
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d2b9f29ea1f42a60a8beb1c04f76868287f2a48d6ec50fb39d6b888584a03c49
e13d6a03d88c0ee199a9a6dbfe88f2684ebda8fbde5ead6b82eb93024fddf535
e2b9f36b8c9a6d642cbb09c32390383a14d179b5fdded58fe8a5ef3be390acfe
f29fea0b102cdce8cd295d4d8b55c2b40e2329f086656c3c7169dc4a849aad8d