![](/screenshots/473be088-f129-4374-8b47-3127c23e1c41.png)
d0054110.atservers.net
Open in
urlscan Pro
178.159.242.190
Malicious Activity!
Public Scan
Effective URL: http://d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/xN9dG1/login.php?id=48720895
Submission: On March 08 via manual from FR — Scanned from FR
Summary
This is the only time d0054110.atservers.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banque Postale (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 155.254.244.40 155.254.244.40 | 19969 (JOESDATAC...) (JOESDATACENTER) | |
2 17 | 178.159.242.190 178.159.242.190 | 6697 (BELPAK-AS...) (BELPAK-AS BELPAK) | |
2 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
2 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:400d:80c::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2003 | 15169 (GOOGLE) (GOOGLE) | |
23 | 7 |
ASN19969 (JOESDATACENTER, US)
lbpactualisationsecurewebone.somee.com |
ASN6697 (BELPAK-AS BELPAK, BY)
PTR: mail.by150.atservers.net
d0054110.atservers.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
atservers.net
2 redirects
d0054110.atservers.net |
125 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 195 |
413 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 339 |
45 KB |
1 |
gstatic.com
fonts.gstatic.com |
44 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 36 |
1 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 693 |
30 KB |
1 |
somee.com
lbpactualisationsecurewebone.somee.com |
350 B |
23 | 7 |
Domain | Requested by | |
---|---|---|
17 | d0054110.atservers.net |
2 redirects
d0054110.atservers.net
|
2 | cdnjs.cloudflare.com |
d0054110.atservers.net
|
2 | cdn.jsdelivr.net |
d0054110.atservers.net
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
d0054110.atservers.net
|
1 | code.jquery.com |
d0054110.atservers.net
|
1 | lbpactualisationsecurewebone.somee.com | |
23 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-02-08 - 2023-05-03 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-02-20 - 2023-05-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/xN9dG1/login.php?id=48720895
Frame ID: EFCA242E8A32729674DAA18B6DFEFC92
Requests: 23 HTTP requests in this frame
Screenshot
![](/screenshots/473be088-f129-4374-8b47-3127c23e1c41.png)
Page Title
Connexion à l'espace clientPage URL History Show full URLs
- http://lbpactualisationsecurewebone.somee.com/ Page URL
-
http://d0054110.atservers.net/websrviteckpleksonepotsale2023/
HTTP 302
http://d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/?pwd=bp HTTP 302
http://d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/xN9dG1/login.php?id=48720895 Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://lbpactualisationsecurewebone.somee.com/ Page URL
-
http://d0054110.atservers.net/websrviteckpleksonepotsale2023/
HTTP 302
http://d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/?pwd=bp HTTP 302
http://d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/xN9dG1/login.php?id=48720895 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
lbpactualisationsecurewebone.somee.com/ |
106 B 350 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.php
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/xN9dG1/ Redirect Chain
|
8 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ |
152 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
helpers.css
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/css/ |
41 KB 41 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/css/ |
11 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.svg
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
top-header-left.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
top-header-right.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
10 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mainmenu.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
search.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
504 B 735 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
search2.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
574 B 805 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon1.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon2.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
595 B 826 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon3.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
425 B 656 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon4.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
115 B 345 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
content.png
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/imgs/ |
36 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/ |
77 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/ |
1 MB 410 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js.js
d0054110.atservers.net/websrviteckpleksonepotsale2023/auth/media/js/ |
27 B 269 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
11 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banque Postale (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery number| uidEvent object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| $jscomp boolean| loaded2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
lbpactualisationsecurewebone.somee.com/ | Name: ASPSESSIONIDSQBRCSTR Value: APBPNLAAGPFHCEDAFIFMKKFL |
|
d0054110.atservers.net/ | Name: PHPSESSID Value: 4e821de9aa3f76549f5c7a9cdda1e2bd |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
d0054110.atservers.net
fonts.googleapis.com
fonts.gstatic.com
lbpactualisationsecurewebone.somee.com
155.254.244.40
178.159.242.190
2001:4de0:ac18::1:a:1b
2606:4700::6811:180e
2a00:1450:4001:812::2003
2a00:1450:400d:80c::200a
2a04:4e42::485
05ad001e147e3583d7d603c670cb9889aa6eef4c9baf122d4515477ef15e935f
09f63cf35c0b6e3ba2c824771f1d61a30fa0a13f92fb12b38e8ccabbf0c2991f
23d2e3be2eaa742bec97ea3d58b3e9a4fa73cd6c64ff528b4239ee07fd0f9ae8
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
2c6705c6926c9aff2fff430f09691beabf9ba75fd43270da9eee68567e9d5423
40f6337b25d143814a5b1ae613d18193d627bd64af62a0878ba54876daa5ac61
4cc8568a46bfe5b7edd8d83958af7c6d8f621e0c97033321ff1d7b068a00f9b6
687b9cf5f1e5b96981c19d155945c536e79ff46899f26dd88089fa3792ce8b97
692867e1ef6e6460f5409c913679273d4c72e7fbea300896ce9ada6160f170a9
6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e
73d459f960272e67e497b41661e1e6821cb5d87de13f18c65341971b6a4d7b00
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
80efa3cf2e355e99b5f014c588fcfc9013167bae09e2b9aeb409040fc0a2592b
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
8a5265f7c1f22927b5f04c567520fc52e7ab2b420af3564e875345d1c7101486
90419bcd869510282afb6d26e137e59a9538c2cf9b0b9b80bfcd147a984abf86
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
bb85447f30f830edadf6f4cba140e9c9636a06f651229daa828022c8abfa7728
bc0168b42eefacf908f868fb00c902c6ea9b58e04090c317eb9a73f38f753d92
dec36602fef5a765ea2a6fdabf58074f0176b3c544bab5325619526a6b268441
f0d75449bdbfcd8a287ae550af08002d0032cf6e98d072894f6b3de684cee82b
faaf31755cec36fde7c8c08e1250f7b52b1c23e30f5db5fb92098ec3d5be78a5