institut-paradis-guitare.fr Open in urlscan Pro
163.172.22.60 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/
Submission: On December 15 via automatic, source openphish (December 15th 2021, 1:00:33 am UTC) — Scanned from FR

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 163.172.22.60, located in France and belongs to Online SAS, FR. The main domain is institut-paradis-guitare.fr.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 5th 2021. Valid for: 3 months.

This is the only time institut-paradis-guitare.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BT (Telecommunication)

Domain & IP information

	IP Address		AS Autonomous System
9	163.172.22.60 163.172.22.60		12876 (Online SAS) (Online SAS)
9	1

9 163.172.22.60 (France)

ASN12876 (Online SAS, FR)
PTR: pollux.ipfixe.info

institut-paradis-guitare.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	institut-paradis-guitare.fr institut-paradis-guitare.fr	68 KB
9	1

	Domain	Requested by
9	institut-paradis-guitare.fr	institut-paradis-guitare.fr
9	1

This site contains no links.

Subject Issuer	Validity	Valid
institut-paradis-guitare.fr cPanel, Inc. Certification Authority	`2021-12-05` - `2022-03-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/
Frame ID: 26A52B67BDE0BCB9F5342133706BF22F
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BT.com Business

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

68 kB
Transfer

487 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/	77 KB 11 KB	212ms 91ms	Document text/html	163.172.22.60 Online SAS
General Check archive.org Show headers Download Go to Full URL https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 163.172.22.60 , France, ASN12876 (Online SAS, FR), Reverse DNS pollux.ipfixe.info Software LiteSpeed / Resource Hash `9b8851124a6a281f5b455885313bdf260cd02ead3f0eee4562391a23266f4f3e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language fr-FR,fr;q=0.9 Response headers vary Accept-Encoding content-type text/html; charset=UTF-8 content-encoding gzip date Wed, 15 Dec 2021 01:00:28 GMT server LiteSpeed alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET H2	200	app.css institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/	400 KB 48 KB	39ms 38ms	Stylesheet text/css	163.172.22.60 Online SAS
General Check archive.org Show headers Download Go to Full URL https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/app.css Requested by Host: institut-paradis-guitare.fr URL: https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 163.172.22.60 , France, ASN12876 (Online SAS, FR), Reverse DNS pollux.ipfixe.info Software LiteSpeed / Resource Hash `c210b57691848960fca23fbfe958c0e8a50e414280ae884f8435078c2b62ac49` Request headers Accept-Language fr-FR,fr;q=0.9 Referer https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 01:00:28 GMT content-encoding br last-modified Wed, 21 Apr 2021 15:42:20 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 49468 expires Wed, 22 Dec 2021 01:00:28 GMT
GET H2	200	bt-logo.png institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/img/	2 KB 2 KB	64ms 64ms	Image image/png	163.172.22.60 Online SAS
General Check archive.org Show headers Download Go to Show image Full URL https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/img/bt-logo.png Requested by Host: institut-paradis-guitare.fr URL: https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 163.172.22.60 , France, ASN12876 (Online SAS, FR), Reverse DNS pollux.ipfixe.info Software LiteSpeed / Resource Hash `712fa317d781d2e0119f795213ba35afb8ada6c3d9e1c46b71d24ababd20c12a` Request headers Accept-Language fr-FR,fr;q=0.9 Referer https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 01:00:28 GMT last-modified Wed, 21 Apr 2021 14:56:00 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 2428 expires Wed, 22 Dec 2021 01:00:28 GMT
GET H2	200	search.svg institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/	1 KB 581 B	63ms 63ms	Image image/svg+xml	163.172.22.60 Online SAS
General Check archive.org Show headers Download Go to Show image Full URL https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/search.svg Requested by Host: institut-paradis-guitare.fr URL: https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 163.172.22.60 , France, ASN12876 (Online SAS, FR), Reverse DNS pollux.ipfixe.info Software LiteSpeed / Resource Hash `a2612713754f61fc38c5968a1c3ce6057ba4c42b5bb2011a78b55e8913b5f13b` Request headers Accept-Language fr-FR,fr;q=0.9 Referer https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 01:00:28 GMT content-encoding br last-modified Wed, 21 Apr 2021 14:55:38 GMT server LiteSpeed vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes content-length 513 expires Wed, 22 Dec 2021 01:00:28 GMT
GET H2	200	promo-My-Account-app-V2.png institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/img/	5 KB 6 KB	63ms 63ms	Image image/png	163.172.22.60 Online SAS
General Check archive.org Show headers Download Go to Show image Full URL https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/img/promo-My-Account-app-V2.png Requested by Host: institut-paradis-guitare.fr URL: https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 163.172.22.60 , France, ASN12876 (Online SAS, FR), Reverse DNS pollux.ipfixe.info Software LiteSpeed / Resource Hash `b7850fe9722613f42e35824c8de185534ebb407fda3f8b600313621b9c6ab122` Request headers Accept-Language fr-FR,fr;q=0.9 Referer https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 01:00:28 GMT last-modified Wed, 21 Apr 2021 14:54:06 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 5621 expires Wed, 22 Dec 2021 01:00:28 GMT
GET H3	404	newbt-webfont.woff institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/	0 0	35ms 34ms	Font text/html	163.172.22.60 Online SAS
General Check archive.org Show headers Download Go to Full URL https://institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/newbt-webfont.woff Requested by Host: institut-paradis-guitare.fr URL: https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/app.css Protocol H3 Security QUIC, , AES_128_GCM Server 163.172.22.60 , France, ASN12876 (Online SAS, FR), Reverse DNS pollux.ipfixe.info Software LiteSpeed / Resource Hash Request headers Referer https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/app.css Origin https://institut-paradis-guitare.fr Accept-Language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 01:00:28 GMT content-encoding br server LiteSpeed link <https://institut-paradis-guitare.fr/wp-json/>; rel="https://api.w.org/" x-litespeed-cache hit vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H3	404	bt.woff institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/	0 0	40ms 39ms	Font text/html	163.172.22.60 Online SAS
General Check archive.org Show headers Download Go to Full URL https://institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/bt.woff?-rgl3n4 Requested by Host: institut-paradis-guitare.fr URL: https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/app.css Protocol H3 Security QUIC, , AES_128_GCM Server 163.172.22.60 , France, ASN12876 (Online SAS, FR), Reverse DNS pollux.ipfixe.info Software LiteSpeed / Resource Hash Request headers Referer https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/app.css Origin https://institut-paradis-guitare.fr Accept-Language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 01:00:28 GMT content-encoding br server LiteSpeed x-litespeed-cache hit vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 link <https://institut-paradis-guitare.fr/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H3	404	newbt-webfont.ttf institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/	0 0	35ms 35ms	Font text/html	163.172.22.60 Online SAS
General Check archive.org Show headers Download Go to Full URL https://institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/newbt-webfont.ttf Requested by Host: institut-paradis-guitare.fr URL: https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/app.css Protocol H3 Security QUIC, , AES_128_GCM Server 163.172.22.60 , France, ASN12876 (Online SAS, FR), Reverse DNS pollux.ipfixe.info Software LiteSpeed / Resource Hash Request headers Referer https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/app.css Origin https://institut-paradis-guitare.fr Accept-Language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 01:00:28 GMT content-encoding br server LiteSpeed x-litespeed-cache hit vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 link <https://institut-paradis-guitare.fr/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H3	404	bt.ttf institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/	0 0	40ms 39ms	Font text/html	163.172.22.60 Online SAS
General Check archive.org Show headers Download Go to Full URL https://institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/bt.ttf?-rgl3n4 Requested by Host: institut-paradis-guitare.fr URL: https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/app.css Protocol H3 Security QUIC, , AES_128_GCM Server 163.172.22.60 , France, ASN12876 (Online SAS, FR), Reverse DNS pollux.ipfixe.info Software LiteSpeed / Resource Hash Request headers Referer https://institut-paradis-guitare.fr/billingbtsecure/secure.business.bt/app.css Origin https://institut-paradis-guitare.fr Accept-Language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 01:00:29 GMT content-encoding br server LiteSpeed x-litespeed-cache hit vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 link <https://institut-paradis-guitare.fr/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BT (Telecommunication)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/newbt-webfont.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/bt.woff?-rgl3n4 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/newbt-webfont.ttf Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://institut-paradis-guitare.fr/Content/GroupsAndPermissions/assets/fonts/bt.ttf?-rgl3n4 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

institut-paradis-guitare.fr
163.172.22.60
712fa317d781d2e0119f795213ba35afb8ada6c3d9e1c46b71d24ababd20c12a
9b8851124a6a281f5b455885313bdf260cd02ead3f0eee4562391a23266f4f3e
a2612713754f61fc38c5968a1c3ce6057ba4c42b5bb2011a78b55e8913b5f13b
b7850fe9722613f42e35824c8de185534ebb407fda3f8b600313621b9c6ab122
c210b57691848960fca23fbfe958c0e8a50e414280ae884f8435078c2b62ac49

institut-paradis-guitare.fr Open in urlscan Pro 163.172.22.60 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

68 kBTransfer

487 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

institut-paradis-guitare.fr Open in urlscan Pro
163.172.22.60 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

68 kB
Transfer

487 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!