![](/screenshots/55ee6790-1454-4186-b076-0abb3ab7cfcc.png)
2620228.zc493525.web.hosting-test.net
Open in
urlscan Pro
91.206.201.61
Malicious Activity!
Public Scan
Effective URL: http://2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/
Submission: On April 12 via api from JP — Scanned from JP
Summary
This is the only time 2620228.zc493525.web.hosting-test.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Orange (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.197 104.244.42.197 | 13414 (TWITTER) (TWITTER) | |
9 | 91.206.201.61 91.206.201.61 | 200000 (UKRAINE-AS) (UKRAINE-AS) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 2a01:c9c0:b3:... 2a01:c9c0:b3:3000::137 | 24600 (WANADOOPO...) (WANADOOPORTAILS-AS Wanadoo PortailsDirection technique) | |
1 | 2a01:c9c0:a3:... 2a01:c9c0:a3:8::247 | 8891 (FTBGPDM) (FTBGPDM) | |
1 | 2a04:4e42:400... 2a04:4e42:400::485 | 54113 (FASTLY) (FASTLY) | |
2 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
18 | 8 |
ASN200000 (UKRAINE-AS, UA)
PTR: web828.default-host.net
2620228.zc493525.web.hosting-test.net |
ASN24600 (WANADOOPORTAILS-AS Wanadoo PortailsDirection technique, FR)
c.woopic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
hosting-test.net
2620228.zc493525.web.hosting-test.net |
137 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220 |
358 KB |
2 |
woopic.com
c.woopic.com — Cisco Umbrella Rank: 192255 gp.cdn.woopic.com — Cisco Umbrella Rank: 206195 |
71 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 374 |
23 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 756 |
83 KB |
1 |
t.co
t.co — Cisco Umbrella Rank: 525 |
773 B |
18 | 6 |
Domain | Requested by | |
---|---|---|
9 | 2620228.zc493525.web.hosting-test.net |
t.co
2620228.zc493525.web.hosting-test.net |
2 | cdnjs.cloudflare.com |
2620228.zc493525.web.hosting-test.net
|
1 | cdn.jsdelivr.net |
2620228.zc493525.web.hosting-test.net
|
1 | gp.cdn.woopic.com |
2620228.zc493525.web.hosting-test.net
|
1 | c.woopic.com |
2620228.zc493525.web.hosting-test.net
|
1 | code.jquery.com |
2620228.zc493525.web.hosting-test.net
|
1 | t.co | |
18 | 7 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert TLS RSA SHA256 2020 CA1 |
2022-12-25 - 2023-12-25 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
cdn.woopic.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-10-14 - 2023-06-27 |
8 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/
Frame ID: 84D09461A0898ACF96FCC613D6B5BFE3
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/55ee6790-1454-4186-b076-0abb3ab7cfcc.png)
Page Title
Identifiez-vousPage URL History Show full URLs
- https://t.co/4GBnxzhTL9 Page URL
- http://2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/ Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
38 Outgoing links
These are links going to different origins than the main page.
Title: Maintenant
Search URL Search Domain Scan URL
Title: Ce soir
Search URL Search Domain Scan URL
Title: Programme TV
Search URL Search Domain Scan URL
Title: Le Mag TV
Search URL Search Domain Scan URL
Title: Mes enregistrements
Search URL Search Domain Scan URL
Title: Cinéma
Search URL Search Domain Scan URL
Title: Séries
Search URL Search Domain Scan URL
Title: Jeunesse
Search URL Search Domain Scan URL
Title: Tout le replay
Search URL Search Domain Scan URL
Title: Tout le catalogue
Search URL Search Domain Scan URL
Title: Mes vidéos
Search URL Search Domain Scan URL
Title: Ma liste
Search URL Search Domain Scan URL
Title: Mon compte prépayé
Search URL Search Domain Scan URL
Title: Jeux vidéo
Search URL Search Domain Scan URL
Title: France
Search URL Search Domain Scan URL
Title: Météo
Search URL Search Domain Scan URL
Title: Politique
Search URL Search Domain Scan URL
Title: Société
Search URL Search Domain Scan URL
Title: Economie
Search URL Search Domain Scan URL
Title: Auto
Search URL Search Domain Scan URL
Title: Toute l'actualité
Search URL Search Domain Scan URL
Title: En direct
Search URL Search Domain Scan URL
Title: Football
Search URL Search Domain Scan URL
Title: Rugby
Search URL Search Domain Scan URL
Title: Tennis
Search URL Search Domain Scan URL
Title: Tous les sports
Search URL Search Domain Scan URL
Title: Bien-être
Search URL Search Domain Scan URL
Title: Art de vivre
Search URL Search Domain Scan URL
Title: Environnement
Search URL Search Domain Scan URL
Title: Culture Pop
Search URL Search Domain Scan URL
Title: Mode Beauté
Search URL Search Domain Scan URL
Title: Toutes les tendances
Search URL Search Domain Scan URL
Title: Sorties de la semaine
Search URL Search Domain Scan URL
Title: Au programme
Search URL Search Domain Scan URL
Title: Actus cinéma
Search URL Search Domain Scan URL
Title: Actus séries
Search URL Search Domain Scan URL
Title: Vidéos
Search URL Search Domain Scan URL
Title: Tout cinéma et séries
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/4GBnxzhTL9 Page URL
- http://2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
4GBnxzhTL9
t.co/ |
387 B 773 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/ |
75 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.3.js
code.jquery.com/ |
278 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/css/ |
924 KB 125 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-orange.png
c.woopic.com/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
567x302_Orange%20bank%20juin%202022.jpg
gp.cdn.woopic.com/magic/ |
67 KB 67 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/ |
82 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/js/ |
1 MB 355 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.payment.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.payment/3.0.0/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
2620228.zc493525.web.hosting-test.net/assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue75_W1G.woff2
2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
o-icomoon.woff
c.woopic.com/Magic/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue55_W1G.woff2
2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue75_W1G.woff
2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue55_W1G.woff
2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue75_W1G.ttf
2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelvNeue55_W1G.ttf
2620228.zc493525.web.hosting-test.net/SERVICE--ORANGE.FR/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
o-icomoon.ttf
c.woopic.com/Magic/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- c.woopic.com
- URL
- http://c.woopic.com/Magic/o-icomoon.woff?1xeygc
- Domain
- c.woopic.com
- URL
- http://c.woopic.com/Magic/o-icomoon.ttf?1xeygc
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Orange (Telecommunication)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery boolean| c_email boolean| _pass function| toggalClass function| nextStep function| validateEmail object| bootstrap object| jQuery111306912067493535217 object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: 9a744460-9805-40e2-9a28-5e0d0decc7b0 |
|
.t.co/ | Name: muc_ads Value: 9a744460-9805-40e2-9a28-5e0d0decc7b0 |
12 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | referrer always; |
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
2620228.zc493525.web.hosting-test.net
c.woopic.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
gp.cdn.woopic.com
t.co
c.woopic.com
104.244.42.197
2001:4de0:ac18::1:a:3b
2606:4700::6811:190e
2a01:c9c0:a3:8::247
2a01:c9c0:b3:3000::137
2a04:4e42:400::485
91.206.201.61
0fe2ef604972ea9b7f74eb327ae73bd0070f980cdafef32045e73f37b7435896
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed
20a3ef6979bbe5e4de1afaecc703e1d34cbc5e3ceab36d378539506327692d72
6c4ba1c662b440b3aefe5e5147ea2df72f80e510e4979c65485a7b0fff894e37
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
b0df968f659f02b3d6b2d6462423ed045067969709552d46d7e977beb7fd5ecb
b36e8ca10880ffc8a3903cd991589fbbe8aa75cbff6315f475be1ed0e9bda472
c5a52c9d4196a06ac427fbfb645331093d2de54227418817d39bf5f06ebcdb43