![](/screenshots/2bd80aff-7d77-4f26-8b43-0c7747c13cf3.png)
messe-notdienst.de
Open in
urlscan Pro
52.152.233.170
Malicious Activity!
Public Scan
Submission: On March 21 via manual from FR — Scanned from DE
Summary
This is the only time messe-notdienst.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Crédit Lyonnais (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 52.152.233.170 52.152.233.170 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2606:4700::68... 2606:4700::6810:5514 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 159.65.250.72 159.65.250.72 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 37.48.65.182 37.48.65.182 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
17 | 4 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
messe-notdienst.de |
ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
extreme-ip-lookup.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
messe-notdienst.de
messe-notdienst.de |
577 KB |
1 |
extreme-ip-lookup.com
extreme-ip-lookup.com — Cisco Umbrella Rank: 18832 |
692 B |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 403 |
24 KB |
17 | 3 |
Domain | Requested by | |
---|---|---|
9 | messe-notdienst.de |
messe-notdienst.de
|
1 | extreme-ip-lookup.com |
messe-notdienst.de
|
1 | cdn.jsdelivr.net |
messe-notdienst.de
|
17 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-03 - 2022-07-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://messe-notdienst.de/monespace-lcl-pro/Mypro/index.html
Frame ID: E43493A4830FF9A26301CC0A6DAA494D
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/2bd80aff-7d77-4f26-8b43-0c7747c13cf3.png)
Page Title
Synthèse des comptes | LCL Mon espaceDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Socket.io.png)
Detected patterns
- socket\.io.*\.js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
messe-notdienst.de/monespace-lcl-pro/Mypro/ |
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
messe-notdienst.de/monespace-lcl-pro/Mypro/js/ |
86 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
socket.io.js
messe-notdienst.de/monespace-lcl-pro/Mypro/js/ |
67 KB 67 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loging.css
messe-notdienst.de/monespace-lcl-pro/Mypro/css/ |
14 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loadi.css
messe-notdienst.de/monespace-lcl-pro/Mypro/css/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.0-beta1/dist/css/ |
150 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
server.js
messe-notdienst.de/monespace-lcl-pro/Mypro/js/ |
16 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
159.65.250.72/socket.io/ |
103 B 436 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Login.html
messe-notdienst.de/monespace-lcl-pro/Mypro/divs/ |
7 KB 8 KB |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
extreme-ip-lookup.com/json/ |
432 B 692 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logosvg.svg
messe-notdienst.de/monespace-lcl-pro/Mypro/imgs/login/ |
27 KB 27 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background.jpg
messe-notdienst.de/monespace-lcl-pro/Mypro/imgs/login/ |
351 KB 351 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
159.65.250.72/socket.io/ |
2 B 317 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
159.65.250.72/socket.io/ |
58 B 390 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
159.65.250.72/socket.io/ |
2 B 317 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
159.65.250.72/socket.io/ |
154 B 487 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
159.65.250.72/socket.io/ |
3 B 334 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Crédit Lyonnais (Banking)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery function| io function| changeFunc function| Validate_Inputs function| showClavierAllUser function| hideClavierAllUser function| showClavierLetter function| showmethenumbers number| countDownDate number| x0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
extreme-ip-lookup.com
messe-notdienst.de
159.65.250.72
2606:4700::6810:5514
37.48.65.182
52.152.233.170
0267260045096457f26914277f49eef5da5ec54ac6aee8579be4810332e518b6
0435b0bb08de0bdae44e6db8d2b367004e97c4e477922308f3c38b1396748c6f
0eb711e5b5a743010b0429ed6281f3398be8383d8d375a2c6277b65bc8b007cd
1ec7b11a14b404abc74d5ff5abae483ddf51ffd7598e10a5df532627f3c69ab9
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
2fdce5dec4c613affb74659e4c46125530f4914beedffd5ba0a763a36070cd3d
4671523c0a3b598d9b78c80f08c054af7ca3250d448ea59eed23d0145a88bc78
5673ce875286e3de66805a301db623b5957d27b1e6390cb821f4f026da7d4151
56fc0519eb3697a04a557b9a765b2994e830595495fc2f83f01c94aa60c52291
5a447b0ee932cde3ebd1124a9707e77d7e7cf90d0cd965a1364f8fa21434f243
62325dfc1fc675255519674da6e2c4aad5f51cc6c3217ed3c6fbf6cabe0d86b0
7b33d5da1c6e9bc14cda99dedd766a1b2e9da3ed0cdf3f349e5dab3999c44ee5
7ba3fbc5eb91b072d3d6308829d1ea41dbe82f5d827597940f4e1e9e37256436
8265030e9a6916441d8717869e026f96f54efbe55c16f4b627953aba760dab0e
b0606f6d85632a232a60b68fcb3abd5b05ffaf6e27cb0a202970507144582b60