f0767472.xsph.ru
Open in
urlscan Pro
141.8.192.151
Malicious Activity!
Public Scan
URL:
http://f0767472.xsph.ru/secure-fr-credit2nord-fr/m/espace/login.php?ID=85900584522
Submission: On January 18 via automatic, source phishtank — Scanned from DE
Submission: On January 18 via automatic, source phishtank — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 16 HTTP transactions.
The main IP is 141.8.192.151, located in
Russian Federation and
belongs to SPRINTHOST, RU.
The main domain is f0767472.xsph.ru.
This is the only time f0767472.xsph.ru was scanned on urlscan.io!
This is the only time f0767472.xsph.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Credit du Nord (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 16 | 141.8.192.151 141.8.192.151 | 35278 (SPRINTHOST) (SPRINTHOST) | |
| 16 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 16 |
xsph.ru
f0767472.xsph.ru |
742 KB |
| 16 | 1 |
| Domain | Requested by | |
|---|---|---|
| 16 | f0767472.xsph.ru |
f0767472.xsph.ru
|
| 16 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://f0767472.xsph.ru/secure-fr-credit2nord-fr/m/espace/login.php?ID=85900584522
Frame ID: 5C90CDFA37B56779799716DB6ECE8DED
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
ConnexionDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
login.php
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/espace/ |
9 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/css/ |
152 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
helpers.css
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/css/ |
41 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fonts.css
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/css/ |
4 KB 811 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.css
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo2.png
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
left-content.png
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/images/ |
90 KB 90 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
right-content.png
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/js/ |
86 KB 33 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
popper.min.js
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/js/ |
20 KB 8 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/js/ |
129 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fontawesome.min.js
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/js/ |
1 MB 405 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.payment.js
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/js/ |
17 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.js
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/js/ |
2 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
img.jpg
f0767472.xsph.ru/secure-fr-credit2nord-fr/m/assets/images/ |
116 KB 116 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Credit du Nord (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| $ function| jQuery function| Popper object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome boolean| isShift string| seperator string| dash function| cc_date function| date_of_birth0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
f0767472.xsph.ru
141.8.192.151
0b9704379696c137fb3380b9d79713289b3128a7d87eb34dac6ca1b4f24eccbd
16e8f08eb363930ccc9f0e91f33ded7905fed943045a040078196294db8a9b17
2d44e2c8ceca3b2f8be46ddfbc1431ca8e618df2d65c32d1e4de4336367e84be
34033ffe8b5d88ef59cc47c49e55e1a293128d34e5996ade5e40ec298634ad87
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
4f170247e1768f40ceb39a7e08a9250b3e0d1fe5d85e9ac437b6fba12ccf61ba
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
64b9e1158d25d8d595187dd4c277656d54a8165f9e2c58504b686ea0107e33d7
69477cc4ea8a06114fc1e4de99a378f36749c064696c9e1930849710526e2c50
86d7c9abfa683b2cd4282b25ae927db3c7fd0fd3bd2b49a9a9cad06c81685420
a65d5b4abb65aad37f302c96f1751362e2422a8869f7f889112556d77e384813
a7b74b21f2f1392a25d1f6f1227eff5acd9636719d7bc8b8e722b660fee071af
bac5f2ce50081b02f191dd8c69ead03566a1c47056235c701aec779f432fc417
d2b9f29ea1f42a60a8beb1c04f76868287f2a48d6ec50fb39d6b888584a03c49
d87b5b8af707d4a29e31ecda11abebd11e4790a0eab5dda357e7c83efd963586
f87ae8f3875c0e3dfea234e2b36af52cada0b04da1131f52a2c01e5cc363055b