bnpparibsfortis.servehttp.com
Open in
urlscan Pro
111.90.159.43
Malicious Activity!
Public Scan
Effective URL: https://bnpparibsfortis.servehttp.com/klant/
Submission: On January 31 via manual from BE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 31st 2019. Valid for: 3 months.
This is the only time bnpparibsfortis.servehttp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNP Paribas (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 111.90.159.43 111.90.159.43 | 45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd) | |
10 | 193.58.4.82 193.58.4.82 | 25215 (BNP-PARIB...) (BNP-PARIBAS France) | |
17 | 2 |
ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
technicalpresentationsthatwow.com | |
bnpparibsfortis.servehttp.com |
ASN25215 (BNP-PARIBAS France, FR)
PTR: helloandyou.be
www.bnpparibasfortis.be |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
bnpparibasfortis.be
www.bnpparibasfortis.be |
183 KB |
6 |
servehttp.com
bnpparibsfortis.servehttp.com |
541 KB |
1 |
technicalpresentationsthatwow.com
technicalpresentationsthatwow.com |
4 KB |
17 | 3 |
Domain | Requested by | |
---|---|---|
10 | www.bnpparibasfortis.be |
bnpparibsfortis.servehttp.com
|
6 | bnpparibsfortis.servehttp.com |
technicalpresentationsthatwow.com
bnpparibsfortis.servehttp.com |
1 | technicalpresentationsthatwow.com | |
17 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.bnpparibasfortis.be |
branch.bnpparibasfortis.be |
www.cardstop.be |
twitter.com |
www.facebook.com |
www.linkedin.com |
www.youtube.com |
itunes.apple.com |
play.google.com |
www.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
bnpparibsfortis.servehttp.com cPanel, Inc. Certification Authority |
2019-01-31 - 2019-05-01 |
3 months | crt.sh |
www.bnpparibasfortis.be Entrust Certification Authority - L1M |
2017-10-24 - 2020-01-23 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://bnpparibsfortis.servehttp.com/klant/
Frame ID: 4904D204A43DAD8287BB1F2155C9BB8B
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://technicalpresentationsthatwow.com/ Page URL
- https://bnpparibsfortis.servehttp.com/klant/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
29 Outgoing links
These are links going to different origins than the main page.
Title: 'Aanmelden met een kaartlezer Comfort Voice' spraaksynthese (pdf)
Search URL Search Domain Scan URL
Title: 'Aanmelden met een kaartlezer Comfort Voice' grootletterdruk (pdf)
Search URL Search Domain Scan URL
Title: Vraag hem online aan
Search URL Search Domain Scan URL
Title: online aanvraagformulier
Search URL Search Domain Scan URL
Title: BNP Paribas Fortis-kantoor
Search URL Search Domain Scan URL
Title: Volledige lijst veelgestelde vragen
Search URL Search Domain Scan URL
Title: Card Stop
Search URL Search Domain Scan URL
Title: Schadegeval aangeven
Search URL Search Domain Scan URL
Title: Contacteer ons
Search URL Search Domain Scan URL
Title: FAQ
Search URL Search Domain Scan URL
Title: Algemene voorwaarden
Search URL Search Domain Scan URL
Title: Tarieven
Search URL Search Domain Scan URL
Title: Depositogarantie
Search URL Search Domain Scan URL
Title: Suggesties of klachten
Search URL Search Domain Scan URL
Title: Veiligheid
Search URL Search Domain Scan URL
Title: Particulieren
Search URL Search Domain Scan URL
Title: Ondernemers
Search URL Search Domain Scan URL
Title: Private Banking
Search URL Search Domain Scan URL
Title: Expats
Search URL Search Domain Scan URL
Title: Nieuwsbrieven
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Call Me
Search URL Search Domain Scan URL
Title: vindt u in het cookiebeleid
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://technicalpresentationsthatwow.com/ Page URL
- https://bnpparibsfortis.servehttp.com/klant/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
technicalpresentationsthatwow.com/ |
7 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
Primary Request
Cookie set
/
bnpparibsfortis.servehttp.com/klant/ |
49 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Web-Banking-Unauthenticated.css
www.bnpparibasfortis.be/iwov-resources/fixed-layout/ |
124 B 888 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yaks.css
bnpparibsfortis.servehttp.com/klant/fonts/ |
334 KB 335 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mediaelementplayer.min.css
www.bnpparibasfortis.be/rsc/sys/css/player/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
stopcard.png
www.bnpparibasfortis.be/rsc/contrib/image/footer/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app-ios.png
www.bnpparibasfortis.be/rsc/contrib/image/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app-android.png
www.bnpparibasfortis.be/rsc/contrib/image/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app-windows.png
www.bnpparibasfortis.be/rsc/contrib/image/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bnpp_sans-webfont.ttf
bnpparibsfortis.servehttp.com/klant/fonts/ |
55 KB 55 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bnpiconfont.ttf
bnpparibsfortis.servehttp.com/klant/fonts/ |
40 KB 40 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bnpp_sans_light-webfont.ttf
bnpparibsfortis.servehttp.com/klant/fonts/ |
56 KB 56 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite.svg
www.bnpparibasfortis.be/rsc/contrib/graphicaltheme/bnpp-fortis/images/ |
83 KB 84 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_banner.jpg
www.bnpparibasfortis.be/rsc/contrib/graphicaltheme/bnpp-fortis/images/ |
37 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
print_logo.png
www.bnpparibasfortis.be/rsc/contrib/graphicaltheme/bnpp-fortis/images/ |
19 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hello_icon.png
www.bnpparibasfortis.be/rsc/contrib/graphicaltheme/bnpp-fortis/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bnpp_sans_cond_regular-webfont.ttf
bnpparibsfortis.servehttp.com/klant/fonts/ |
46 KB 46 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNP Paribas (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| changeLanguage function| reloadValues function| checkValues0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bnpparibsfortis.servehttp.com
technicalpresentationsthatwow.com
www.bnpparibasfortis.be
111.90.159.43
193.58.4.82
071b0cea827f8189911730aef96f2a4c53a0a4f6dbc036da77e848c5775eab05
1a2c0603e8ba42c388ce99053ec229e2afb93edfb04f9f953839754c4cafc56f
1bd1a7399ca3e999d66cbc2da96fbd90a5acbbdc48046d5940febfc029261566
31eea3d84d9c828447d50e3d83698c193b88683971ac6616504fdb84255f1eb6
3b68edabd4f2e09a16e9f006199b766df45189872a84b20a49353e4d587639dc
3f6b3048f077663998d7fead9734892be93db35b1c64b94092a932175bfb44e2
43eaedd3523a071f0de1d520ed7b18d5eee105d9b03578fbcec8c597b6376b23
60a1ce266a5ccb14551a31408b149f1c5dbb156a445985c563513ee5b7269457
77d8b27fb385e5ea2bb4a42503a85e3d5087fb535fd6e31a02d2c0824486d47e
a0131e8b032f5053ac90ebb24e27b2b34a8cd180d5b1574bf29143a7d0231735
a56f74eaf471b8d0869d8d9556e4925e89767e210c4f0cf273ee012213086ec2
c2333f5fd1328c003ee0c3fc104f9c7f66d081d32c0245257f78cd7a9bdd2942
c4071ff8d0159e2801c2a0918320b7e6946971f8ef047a9672e17e2459ea5533
dba43a75349cdc1e17fe32d7920ebbe2ea0f5469fa01711d5981d496ba483430
f5b4436ed2738887c1e874535c81cdf29a6386ca738f489c4b5729b2ba70dd0a
fb24c4e4c7255f483ad37fbe79e449071c2f4ff3c6334bca30c005db80344e74
fbaa016361e99e476c170784723e2292bbe7f589a62a1d99ae40dd56385c4eda