servicecredit.fr
Open in
urlscan Pro
81.169.145.87
Malicious Activity!
Public Scan
Submission: On January 23 via manual from US
Summary
TLS certificate: Issued by STRATO TLS RSA CA on January 21st 2018. Valid for: a year.
This is the only time servicecredit.fr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 16 | 81.169.145.87 81.169.145.87 | 6724 (STRATO ST...) (STRATO STRATO AG) | |
1 | 2.21.161.21 2.21.161.21 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 2 | 176.120.18.70 176.120.18.70 | 198911 (BML-AS) (BML-AS) | |
17 | 3 |
ASN6724 (STRATO STRATO AG, DE)
PTR: w87.rzone.de
servicecredit.fr |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
servicecredit.fr
1 redirects
servicecredit.fr |
159 KB |
3 |
paypal.com
1 redirects
c.paypal.com b.stats.paypal.com dub.stats.paypal.com |
19 KB |
17 | 2 |
Domain | Requested by | |
---|---|---|
16 | servicecredit.fr |
1 redirects
servicecredit.fr
|
1 | dub.stats.paypal.com | |
1 | b.stats.paypal.com | 1 redirects |
1 | c.paypal.com |
servicecredit.fr
|
17 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.paypal.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.servicecredit.fr STRATO TLS RSA CA |
2018-01-21 - 2019-01-21 |
a year | crt.sh |
This page contains 5 frames:
Primary Page:
https://servicecredit.fr/
Frame ID: (FCF5B95871E9142B5A255021C49C943A)
Requests: 11 HTTP requests in this frame
Frame:
https://servicecredit.fr/acceuil_files/saved_resource.html
Frame ID: (5C2CAA24D6380ACB55A985D7D74AB12B)
Requests: 1 HTTP requests in this frame
Frame:
https://servicecredit.fr/acceuil_files/saved_resource(1).html
Frame ID: (D7E7651C501B3027EDCF7E5F627D3694)
Requests: 2 HTTP requests in this frame
Frame:
https://servicecredit.fr/acceuil_files/i.html
Frame ID: (54404EE97155DB03377E254C4E5A8E69)
Requests: 2 HTTP requests in this frame
Frame:
https://dub.stats.paypal.com/counter2.cgi
Frame ID: (8439667A04E9EEC972EAD36A96194C68)
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
UNIX (Operating Systems) ExpandDetected patterns
- headers server /Unix/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
PayPal (Payment Processors) Expand
Detected patterns
- env /^PAYPAL$/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- env /^Modernizr$/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Encore plus d'options
Search URL Search Domain Scan URL
Title: Vous n'arrivez pas à vous connecter ?
Search URL Search Domain Scan URL
Title: Ouvrir un compte
Search URL Search Domain Scan URL
Title: Respect de la vie privée
Search URL Search Domain Scan URL
Title: PayPal
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- http://servicecredit.fr/logo.jpg HTTP 302
- https://servicecredit.fr/logo.jpg
- https://b.stats.paypal.com/v1/counter.cgi?r=cD02YWMyNjBmZDgyY2M0ZjM5OGEzODQwYzZlYWZjN2NmNCZpPTQxLjIwNy4xOTcuMTEmdD0xNTE1OTYyOTc3Ljg4MyZhPTIxJnM9VU5JRklFRF9MT0dJTmBcO9yAC7DCmbtkQ55ndoKNq1lM HTTP 302
- https://dub.stats.paypal.com/counter2.cgi
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
servicecredit.fr/ |
80 KB 80 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
contextualLogin.css
servicecredit.fr/acceuil_files/ |
68 KB 69 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js.t%C3%A9l%C3%A9chargement
servicecredit.fr/acceuil_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb-all-prod.pp2.min.js.t%C3%A9l%C3%A9chargement
servicecredit.fr/acceuil_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w
servicecredit.fr/acceuil_files/ |
0 67 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
logo.jpg
servicecredit.fr/ Redirect Chain
|
9 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js.t%C3%A9l%C3%A9chargement
servicecredit.fr/acceuil_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
saved_resource.html
servicecredit.fr/acceuil_files/ Frame (5C2 |
149 B 211 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb-all-prod.pp2.min.js.t%C3%A9l%C3%A9chargement
servicecredit.fr/acceuil_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
saved_resource(1).html
servicecredit.fr/acceuil_files/ Frame (D7E |
243 B 305 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
counter.cgi
servicecredit.fr/acceuil_files/ Frame (D7E |
42 B 110 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i.html
servicecredit.fr/acceuil_files/ Frame (544 |
367 B 429 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb-all-prod.pp2.min.js.t%C3%A9l%C3%A9chargement
servicecredit.fr/acceuil_files/ Frame (544 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
challenge.js
servicecredit.fr/auth/createchallenge/9692ea8379fed273/ |
248 B 276 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb-all-prod.pp2.min.js
c.paypal.com/webstatic/r/fb/ |
58 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
client-log
servicecredit.fr/signin/ |
215 B 242 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter2.cgi
dub.stats.paypal.com/ Frame (843 Redirect Chain
|
42 B 494 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| html5 object| Modernizr function| isEligibleIntegration object| antiClickjack object| PAYPAL function| $ object| _0x2785 function| _0x5278 object| d function| aafdcbbffbde object| err function| AjaxRequest string| PP_SERVICE_URL string| BASE_SWF_URL string| BEACON_BASE_URL string| PP_IFRAME_JS_URL string| PP_NEW_SERVICE_URL string| PP_VERSION object| Configuration object| PFB_4732Config object| PFB_4732 object| dataCollector object| fp undefined| runFb function| initTsFb object| jstz function| SwfStore function| SlvtStore0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.stats.paypal.com
c.paypal.com
dub.stats.paypal.com
servicecredit.fr
176.120.18.70
2.21.161.21
81.169.145.87
3985213ce89eec8dda7f1a9839c529647c2a8e04f8993e413ac1e44d74c25808
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
67666e9419f7ffc223d56982ff79c687d00e4fdf3decdde4fcc460db5669f016
69e441736749272216f8872d3ea021c9dafcf1046764523233620f7c961a8001
97f9b10039b05e1af4a3c9b778fc72ba44cf68a376e4ec1d55f2558f16cf3e50
b4b9816afb106e420db8f264b402faa4680ce2c1949a70ed96326f3660f51152
b5842f04757e243504c24a4c721456363cc560a2279a592f323eb4387f61187b
e1be756cc31d8c4d367f236578455aa2f6e6f92ed42f760db23fd00bf8425905
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eda0a3b80b9a6c146817151721cb4e4c38bb88bae41419df26f5f67156fa14b3
fc0d080815c2306c3972fa2b8fcb63a5896d78c4032340e9db1964a584b1ef7f