www.lescollecteurs.fr Open in urlscan Pro
94.23.19.150 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bit.ly/2Bxo3h8
Effective URL:
http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Submission: On December 27 via automatic, source phishtank (December 27th 2017, 7:26:55 pm UTC)

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 94.23.19.150, located in France and belongs to OVH, FR. The main domain is www.lescollecteurs.fr.

This is the only time www.lescollecteurs.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Landesbank Berlin (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	395224 (BITLY-AS) (BITLY-AS - Bitly Inc)
1	204.93.89.69 204.93.89.69	13364 (JIVE-HOSTING) (JIVE-HOSTING - Jive Software Inc.)
1	143.95.251.7 143.95.251.7	36024 (COLO4-CO) (COLO4-CO - Colo4)
10	94.23.19.150 94.23.19.150	16276 (OVH) (OVH)
12	3

1 67.199.248.10 (United States) 1 redirects

ASN395224 (BITLY-AS - Bitly Inc, US)

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 204.93.89.69 (Palo Alto, United States)

ASN13364 (JIVE-HOSTING - Jive Software Inc., US)

historyhub.history.gov	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.95.251.7 (Los Angeles, United States)

ASN36024 (COLO4-CO - Colo4, LLC, US)
PTR: ip-143-95-251-7.iplocal

drupal.411webserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 94.23.19.150 (France)

ASN16276 (OVH, FR)
PTR: kiwi.seproduction.com

www.lescollecteurs.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	lescollecteurs.fr www.lescollecteurs.fr
1	411webserver.com drupal.411webserver.com
1	history.gov historyhub.history.gov
1	bit.ly 1 redirects bit.ly	413 B
12	4

	Domain	Requested by
10	www.lescollecteurs.fr	www.lescollecteurs.fr
1	drupal.411webserver.com
1	historyhub.history.gov
1	bit.ly	1 redirects
12	4

This site contains no links.

Subject Issuer	Validity	Valid
history.gov Entrust Certification Authority - L1K	`2016-11-17` - `2018-09-14`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Frame ID: (2364973A59703215B342B661D1B5B098)
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://bit.ly/2Bxo3h8 HTTP 301
https://historyhub.history.gov/external-link.jspa?url=http://drupal.411webserver.com/Lbb.htm Page URL
http://drupal.411webserver.com/Lbb.htm Page URL
http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/ Page URL
http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

12
Requests

8 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

0 kB
Transfer

55 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bit.ly/2Bxo3h8 HTTP 301
https://historyhub.history.gov/external-link.jspa?url=http://drupal.411webserver.com/Lbb.htm Page URL
http://drupal.411webserver.com/Lbb.htm Page URL
http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/ Page URL
http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://bit.ly/2Bxo3h8 HTTP 301
https://historyhub.history.gov/external-link.jspa?url=http://drupal.411webserver.com/Lbb.htm

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set external-link.jspa Show response
historyhub.history.gov/
Redirect Chain

http://bit.ly/2Bxo3h8
https://historyhub.history.gov/external-link.jspa?url=http://drupal.411webserver.com/Lbb.htm

285 B
0

645ms
193ms

Document
text/html

204.93.89.69
Jive Software Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://historyhub.history.gov/external-link.jspa?url=http://drupal.411webserver.com/Lbb.htm

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

204.93.89.69 Palo Alto, United States, ASN13364 (JIVE-HOSTING - Jive Software Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

0a62815faa059523183902d20a70a3169e3da994c95d1b3bdc9d63093a0490a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection: keep-alive
Accept-Encoding: gzip, deflate
Host: historyhub.history.gov
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:44 GMT
Content-Encoding: gzip
X-Jive-Request-Id: dfdc15f0-eb3b-11e7-8b7b-0050568b01c2
Transfer-Encoding: chunked
P3P: CP="CAO PSA OUR"
Connection: Keep-Alive
X-JSL: D=45363 t=1514402804942636
Server: Apache
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding,User-Agent
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Language: en-US
Cache-Control: no-store, no-cache, must-revalidate, private, max-age=0
Set-Cookie: jive.login.ts=1514402804943; Path=/; HttpOnly JSESSIONID=D7E2E56FB4E488961F20701947CD9999; Path=/; Secure; HttpOnly jive.security.context=T6zu86N+MxcMSMhRtvVxpv//////////tXkpRC9pxJep4OF9Nwmk0gVZU90zkce82v4OvDagQ+10LQUUJ3iX69xL0+/BFD5Kb/6pmudYVVFxGrQQP8+3jra4jywkY1TN; Path=/; HttpOnly BIGipServerpool_naraecn.hosted.jivesoftware.com=2856561674.20480.0000; path=/
Content-Type: text/html;charset=UTF-8
Keep-Alive: timeout=5, max=100
X-Jive-Flow-Id: dfdc15f1-eb3b-11e7-8b7b-0050568b01c2
Expires: Wed, 27 Dec 2017 19:26:44 GMT

Redirect headers

Date: Wed, 27 Dec 2017 19:26:44 GMT
Server: nginx
Content-Type: text/html; charset=utf-8
Location: https://historyhub.history.gov/external-link.jspa?url=http://drupal.411webserver.com/Lbb.htm
Set-Cookie: _bit=hbrjqI-c9ad39f3ad6ec9eee7-00f; Domain=bit.ly; Expires=Mon, 25 Jun 2018 19:26:44 GMT
Cache-Control: private, max-age=90
Connection: keep-alive
Content-Length: 179

GET
H/1.1 200
OK Lbb.htm Show response
drupal.411webserver.com/ 104 B
0 447ms
144ms Document
text/html 143.95.251.7
Colo4

General

Check archive.org

Show headers Download Go to

Full URL: http://drupal.411webserver.com/Lbb.htm
Protocol: HTTP/1.1
Server: 143.95.251.7 Los Angeles, United States, ASN36024 (COLO4-CO - Colo4, LLC, US),
Reverse DNS: ip-143-95-251-7.iplocal
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: e2f0ba08c56925a460af231136fe6b146ee3440ca9ea3ef379095da0633ec424

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: drupal.411webserver.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Dec 2017 05:50:04 GMT
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
ETag: "08e42bbc36cd31:0"
Vary: Accept-Encoding
Content-Type: text/html
Accept-Ranges: bytes
Content-Length: 209

GET
H/1.1 200
OK / Show response
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/ 322 B
0 41ms
14ms Document
text/html 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.22
Resource Hash: 0e06e7e0fc6155f2c0e7b250894d0fd3f2b27c35421684ce44c7d38eb67640c8

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://drupal.411webserver.com/Lbb.htm
Connection: keep-alive
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Referer: http://drupal.411webserver.com/Lbb.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:45 GMT
Content-Encoding: gzip
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.22
Vary: Accept-Encoding
Content-Type: text/html
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 223

GET
H/1.1 200
OK Primary Request Cookie set identification.php Show response
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/ 8 KB
0 279ms
278ms Document
text/html 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Requested by: Host: www.lescollecteurs.fr
URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.22
Resource Hash: 2f33b918d66e229752fcfe3c61a9aa5db134017a7a4ee4736b1da23ae94602c5

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/
Connection: keep-alive
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 27 Dec 2017 19:26:45 GMT
Content-Encoding: gzip
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.22
Vary: Accept-Encoding
Content-Type: text/html
Set-Cookie: PHPSESSID=1simmd5ftu39mfp5t9ni1sa0e2; path=/
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 2384
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK lbb.css
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/ 8 KB
0 14ms
14ms Stylesheet
text/css 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/lbb.css
Requested by: Host: www.lescollecteurs.fr
URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash: 6b9c93af56696bd088e3262471458b4b09369d3a897f4f7822d42ad82fa869aa

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Cookie: PHPSESSID=1simmd5ftu39mfp5t9ni1sa0e2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:45 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Dec 2017 05:45:53 GMT
Server: Apache/2.4.7 (Ubuntu)
ETag: "2188-55f7d3b4c780f-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1724

GET
H/1.1 404
Not Found Titellogo1.gif
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/ 14 KB
0 210ms
196ms Image
text/html 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/Titellogo1.gif
Requested by: Host: www.lescollecteurs.fr
URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.22
Resource Hash: ed09a8dc41a3ca7a7df181ef6656318da4a506a059e65c0cc2a5bf1c7015b915

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Cookie: PHPSESSID=1simmd5ftu39mfp5t9ni1sa0e2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 27 Dec 2017 19:26:45 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.22
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://www.lescollecteurs.fr/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=100
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK metaarea.gif
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/ 49 B
0 15ms
14ms Image
image/gif 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/metaarea.gif
Requested by: Host: www.lescollecteurs.fr
URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Cookie: PHPSESSID=1simmd5ftu39mfp5t9ni1sa0e2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:45 GMT
Last-Modified: Mon, 04 Dec 2017 05:45:53 GMT
Server: Apache/2.4.7 (Ubuntu)
ETag: "31-55f7d3b4c87af"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 49

GET
H/1.1 200
OK Banklogo.gif
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/ 43 B
0 28ms
13ms Image
image/gif 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/Banklogo.gif
Requested by: Host: www.lescollecteurs.fr
URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Cookie: PHPSESSID=1simmd5ftu39mfp5t9ni1sa0e2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:45 GMT
Last-Modified: Mon, 04 Dec 2017 05:45:53 GMT
Server: Apache/2.4.7 (Ubuntu)
ETag: "2b-55f7d3b4c780f"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 43

GET
H/1.1 200
OK background.gif
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/ 24 KB
0 29ms
14ms Image
image/gif 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/background.gif
Requested by: Host: www.lescollecteurs.fr
URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash: c7808138a4b8a00e35e54c062201202e9e5523a2af47b5f3f480a89929279182

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/lbb.css
Cookie: PHPSESSID=1simmd5ftu39mfp5t9ni1sa0e2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/lbb.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:45 GMT
Last-Modified: Mon, 04 Dec 2017 05:45:53 GMT
Server: Apache/2.4.7 (Ubuntu)
ETag: "5f56-55f7d3b4c780f"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 24406

GET
H/1.1 200
OK meta.gif
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/ 81 B
0 29ms
14ms Image
image/gif 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/meta.gif
Requested by: Host: www.lescollecteurs.fr
URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash: b8db428a0d53deeaa8ff46ba403fb22afcb0e9ef754fafd1aee08957f58c856a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/lbb.css
Cookie: PHPSESSID=1simmd5ftu39mfp5t9ni1sa0e2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/lbb.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:45 GMT
Last-Modified: Mon, 04 Dec 2017 05:45:53 GMT
Server: Apache/2.4.7 (Ubuntu)
ETag: "51-55f7d3b4c780f"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 81

GET
H/1.1 200
OK button.gif
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/ 67 B
0 27ms
14ms Image
image/gif 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/button.gif
Requested by: Host: www.lescollecteurs.fr
URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash: 918eabacb055e7cf2ef8c1a2006f910874383910fb86b6457d26fece62d7aa65

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/lbb.css
Cookie: PHPSESSID=1simmd5ftu39mfp5t9ni1sa0e2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/lbb.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:45 GMT
Last-Modified: Mon, 04 Dec 2017 05:45:53 GMT
Server: Apache/2.4.7 (Ubuntu)
ETag: "43-55f7d3b4c780f"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 67

GET
H/1.1 200
OK link.gif
www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/ 67 B
0 14ms
14ms Image
image/gif 94.23.19.150
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/img/lbb/link.gif
Requested by: Host: www.lescollecteurs.fr
URL: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/identification.php?referrer=026&intid=164062de0f6d78bfb6449d00759906cb
Protocol: HTTP/1.1
Server: 94.23.19.150 , France, ASN16276 (OVH, FR),
Reverse DNS: kiwi.seproduction.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash: f8ff5491f83963d4027ce74232bfabbcb7a089e5a8331282913ccb377d7a1186

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.lescollecteurs.fr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/lbb.css
Cookie: PHPSESSID=1simmd5ftu39mfp5t9ni1sa0e2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.lescollecteurs.fr/wp-content/-/AppleUz/Lbb/BB/css/lbb.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 27 Dec 2017 19:26:45 GMT
Last-Modified: Mon, 04 Dec 2017 05:45:53 GMT
Server: Apache/2.4.7 (Ubuntu)
ETag: "43-55f7d3b4c780f"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 67

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Landesbank Berlin (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.lescollecteurs.fr/	1970-01-01 00:00:00	Name: PHPSESSID Value: 1simmd5ftu39mfp5t9ni1sa0e2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
drupal.411webserver.com
historyhub.history.gov
www.lescollecteurs.fr
143.95.251.7
204.93.89.69
67.199.248.10
94.23.19.150
0a62815faa059523183902d20a70a3169e3da994c95d1b3bdc9d63093a0490a3
0e06e7e0fc6155f2c0e7b250894d0fd3f2b27c35421684ce44c7d38eb67640c8
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
2f33b918d66e229752fcfe3c61a9aa5db134017a7a4ee4736b1da23ae94602c5
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
6b9c93af56696bd088e3262471458b4b09369d3a897f4f7822d42ad82fa869aa
918eabacb055e7cf2ef8c1a2006f910874383910fb86b6457d26fece62d7aa65
b8db428a0d53deeaa8ff46ba403fb22afcb0e9ef754fafd1aee08957f58c856a
c7808138a4b8a00e35e54c062201202e9e5523a2af47b5f3f480a89929279182
e2f0ba08c56925a460af231136fe6b146ee3440ca9ea3ef379095da0633ec424
ed09a8dc41a3ca7a7df181ef6656318da4a506a059e65c0cc2a5bf1c7015b915
f8ff5491f83963d4027ce74232bfabbcb7a089e5a8331282913ccb377d7a1186

www.lescollecteurs.fr Open in urlscan Pro 94.23.19.150 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

8 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

0 kBTransfer

55 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

www.lescollecteurs.fr Open in urlscan Pro
94.23.19.150 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

8 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

0 kB
Transfer

55 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!