![](/screenshots/6eeb0c08-92b7-433c-acaf-2c301bd08875.png)
leboncoin.info389.com
Open in
urlscan Pro
2a06:98c1:3121::3
Malicious Activity!
Public Scan
Submission: On March 14 via manual from PT — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on March 12th 2024. Valid for: 3 months.
This is the only time leboncoin.info389.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Leboncoin (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
29 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3035::ac43:96b5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
32 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
29 |
info389.com
leboncoin.info389.com |
238 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 228 |
5 KB |
1 |
freepng.ru
img1.freepng.ru |
17 KB |
32 | 3 |
Domain | Requested by | |
---|---|---|
29 | leboncoin.info389.com |
leboncoin.info389.com
cdnjs.cloudflare.com |
1 | cdnjs.cloudflare.com |
leboncoin.info389.com
|
1 | img1.freepng.ru |
leboncoin.info389.com
|
32 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
leboncoin.eu-clpay.com |
assistance.leboncoin.info |
Subject Issuer | Validity | Valid | |
---|---|---|---|
info389.com GTS CA 1P5 |
2024-03-12 - 2024-06-10 |
3 months | crt.sh |
freepng.ru E1 |
2024-02-24 - 2024-05-24 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://leboncoin.info389.com/get/200502802
Frame ID: F71E26106A4C5122FA46BE929C0CD83A
Requests: 20 HTTP requests in this frame
Frame:
https://leboncoin.info389.com/supportChatFrame/200502802
Frame ID: A4D082CF29597BE5F0661FAF19DFDE70
Requests: 13 HTTP requests in this frame
Screenshot
![](/screenshots/6eeb0c08-92b7-433c-acaf-2c301bd08875.png)
Page Title
leboncoin site de petites annonces gratuitesMondial Relay logoColissimo logoLogo courrier suiviCourrier suivi logoMondial Relay logoColissimo logoColissimo logoCourrier suivi logoMondial Relay logoColissimo logoDetected technologies
![](/vendor/wappa/icons/React.png)
Detected patterns
- <[^>]+data-react
![](/vendor/wappa/icons/Socket.io.png)
Detected patterns
- socket\.io.*\.js
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: aller au contenu
Search URL Search Domain Scan URL
Title: aller au footer
Search URL Search Domain Scan URL
Title: En savoir plus.
Search URL Search Domain Scan URL
Title: En savoir plus.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
200502802
leboncoin.info389.com/get/ |
75 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
leboncoin.info389.com/css/myleboncoin/ |
8 KB 9 KB |
Stylesheet
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
support_parent.css
leboncoin.info389.com/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
leboncoin.info389.com/css/myleboncoin/ |
334 KB 63 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.css
leboncoin.info389.com/css/myleboncoin/ |
34 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
support_parent.css
leboncoin.info389.com/css/myleboncoin/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kisspng-chronopost-logistics-logo-delivery-brand-small-cube-5b61624b3e3be3.4538408715331088112549.jpg
img1.freepng.ru/20180801/zyc/ |
16 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
930 B 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
leboncoin.info389.com/css/myleboncoin/ |
87 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.js
leboncoin.info389.com/css/myleboncoin/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
leboncoin.info389.com/css/myleboncoin/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
socket.io.js
leboncoin.info389.com/socket.io/ |
132 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
200502802
leboncoin.info389.com/supportChatFrame/ Frame A4D0 |
24 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
supportIcon.svg
leboncoin.info389.com/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
leboncoin.info389.com/socket.io/ |
118 B 531 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
leboncoin.info389.com/socket.io/ |
2 B 416 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
leboncoin.info389.com/socket.io/ |
32 B 459 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
support_chat.css
leboncoin.info389.com/css/ Frame A4D0 |
101 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
axios.min.js
leboncoin.info389.com/js/ Frame A4D0 |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
support.js
leboncoin.info389.com/js/ Frame A4D0 |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
socket.io.js
leboncoin.info389.com/socket.io/ Frame A4D0 |
132 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
leboncoin.info389.com/socket.io/ |
1 B 424 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
leboncoin.info389.com/socket.io/ |
2 B 417 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
leboncoin.info389.com/api/support/ Frame A4D0 |
15 B 487 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
leboncoin.info389.com/socket.io/ Frame A4D0 |
118 B 528 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
leboncoin.info389.com/socket.io/ Frame A4D0 |
2 B 414 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
leboncoin.info389.com/socket.io/ Frame A4D0 |
32 B 451 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
leboncoin.info389.com/socket.io/ Frame A4D0 |
1 B 427 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
leboncoin.info389.com/socket.io/ Frame A4D0 |
2 B 412 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
244931048
leboncoin.info389.com/api/getUser/ |
160 B 559 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
leboncoin.info389.com/api/support/ Frame A4D0 |
15 B 490 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
leboncoin.info389.com/api/support/ Frame A4D0 |
15 B 491 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- leboncoin.info389.com
- URL
- https://leboncoin.info389.com/css/myleboncoin/support_parent.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Leboncoin (E-commerce)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery function| axios function| run string| adid function| io1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
leboncoin.info389.com/ | Name: connect.sid Value: s%3Az9DmJ7pkeb5UWenge4lU5GaWyNS_hVPV.ZIY5jpGxSLSrKsV6i6aNIHsJIxDt3fL6GMUV8oSwozs |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
img1.freepng.ru
leboncoin.info389.com
leboncoin.info389.com
2606:4700:3035::ac43:96b5
2606:4700::6811:190e
2a06:98c1:3121::3
1b7027c7a8383c58e6c5023ea0f524291389e23b692a905412ddeefd0426b384
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
386ed7ec82b89fbf216b1fd5bc85fb8f5b750f1384028ce33d026762834e1ebe
3c4c9388e388743574368c6d0c9a66b08f24edac103700d709297faba2d91d42
3ec02539093978c02394f866f2b7ad3616d618c0d0e7d77d951de4691f004530
5c94a94ba32c642ce70f8f04d45426d11627b40486eaa091b50dd6b1c208004f
5e4ce7b36ba37b78a5d5f9fd08e6b7b54ba6879d651aa46ec9e1d6fa24ebe30a
719ef703372014065f14caab11999d3336fa83e502d238471cb14f8af8bfa1a5
75856275079776c1d3ba5d45c69b80dd9b5d829f8ec00a125de79b3b20e030df
9afd537e6723bb869397626212305906f739306bc96bfff09e9e6f45c206f715
a219b96d0ba8e32441c99acedc91641e7531a1bd04b2e70abf34c0e19510f3b8
a4139f3d399157062c1adeea7c5594539461e84cc2e942c13b4c1a35466b5925
ad472174a8f00b62381a776cfe24b6acc732368553c28d1f2fea65108afea3b0
bd5202a33820f8400fbc0da2dc777d14d0a52eb9d414c283656dc3cfeaf41dab
c927b291c4eba04a79b1f86023315fb824c8a11d3dc065d6e400dae8211b66d7
cdc714eeffa640a09147d34f7f7801d58ff76a0e6627a561c57f9fe7301fe8cd
d35e73edc030e667b728e2e626c782ec2b4d3b0a3044730c02b9a25dbf46be59
d40c636c6f5df8e97ce5d56c336a9c1379bfa2b963053386d670b6865be2913f
e0a4c8b2744779b88a5e21dd8d47aaac2a77fa7a3721f11c2c6bef327a42a621
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
ea52c2604519304144d7267cf90f912ee6b092b2c5505576948568fe653dcac0
ec43a29e4cb8738d5a9548250fd112a794877bd46e114b150f06152caf43b9f8
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d