messagerie-fr-boursorama.com
Open in
urlscan Pro
217.160.0.65
Malicious Activity!
Public Scan
Submission Tags: 7549201
Submission: On June 14 via api from NL — Scanned from FR
Summary
TLS certificate: Issued by GeoTrust Global TLS RSA4096 SHA256 20... on June 6th 2022. Valid for: a year.
This is the only time messagerie-fr-boursorama.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Boursorama (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 217.160.0.65 217.160.0.65 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
2 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 68.65.122.196 68.65.122.196 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
14 | 7 |
ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: 217-160-0-65.elastic-ssl.ui-r.com
messagerie-fr-boursorama.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium23-2.web-hosting.com
mincex.fun |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
messagerie-fr-boursorama.com
messagerie-fr-boursorama.com |
262 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 444 |
48 KB |
1 |
mincex.fun
mincex.fun |
875 B |
1 |
gstatic.com
fonts.gstatic.com |
44 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67 |
1 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 246 |
355 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 686 |
30 KB |
14 | 7 |
Domain | Requested by | |
---|---|---|
7 | messagerie-fr-boursorama.com |
messagerie-fr-boursorama.com
|
2 | cdn.jsdelivr.net |
messagerie-fr-boursorama.com
|
1 | mincex.fun |
messagerie-fr-boursorama.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
messagerie-fr-boursorama.com
|
1 | cdnjs.cloudflare.com |
messagerie-fr-boursorama.com
|
1 | code.jquery.com |
messagerie-fr-boursorama.com
|
14 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
messagerie-fr-boursorama.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1 |
2022-06-06 - 2023-06-06 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-05-25 - 2022-08-17 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-05-25 - 2022-08-17 |
3 months | crt.sh |
mincex.fun Sectigo RSA Domain Validation Secure Server CA |
2022-04-26 - 2023-04-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://messagerie-fr-boursorama.com/fr/main/login
Frame ID: 1AEE20C56F14A4E33DC5942D9A71F81C
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Espace Client : accédez à vos comptesDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
messagerie-fr-boursorama.com/fr/main/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.css
messagerie-fr-boursorama.com/fr/main/assets/css/ |
41 KB 41 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
messagerie-fr-boursorama.com/fr/main/assets/css/ |
8 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
messagerie-fr-boursorama.com/fr/main/assets/imgs/ |
205 KB 206 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow.png
messagerie-fr-boursorama.com/fr/main/assets/imgs/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sec.png
messagerie-fr-boursorama.com/fr/main/assets/imgs/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/ |
82 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/js/ |
1 MB 355 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
messagerie-fr-boursorama.com/fr/main/assets/js/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v29/ |
44 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
login
mincex.fun/newsystem/pages/get/8892177c4f91d483a99532a779e5b6d0/ |
625 B 875 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Boursorama (Banking)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| $ function| jQuery object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome function| getContent1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
messagerie-fr-boursorama.com/ | Name: PHPSESSID Value: 5cbf24605fa6dc7c91f03edc7dc77d74 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
messagerie-fr-boursorama.com
mincex.fun
2001:4de0:ac18::1:a:2a
217.160.0.65
2606:4700::6810:5814
2606:4700::6811:190e
2a00:1450:4001:811::200a
2a00:1450:4001:828::2003
68.65.122.196
20a3ef6979bbe5e4de1afaecc703e1d34cbc5e3ceab36d378539506327692d72
2ef03123cf2aa61ae5ff52781f04514f769247abef86fa12474b6b0a4ab05cc9
3dfde08996487a75d944d71ba8ea62d4d67520e8a7237fe01e761fda1098c519
57b476f845ffe66c077073166eb11f2aa2b7e3b07c7e4d57e0411231576acdb1
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
942b50839b4c887e66f8a0962cb5ec87a757bab5924b1c1431ac80303b26c895
a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0
b336876f68a3dc4441bbe228992a72820c08602dd1e773fd4477b6eadf97e1c7
b518a9b3efdf3f27fc041d0432200a4d97cecff72eba9bbb646fa605e908d205
bd651f2b766ee10d2cea457a61879a3bafccc4e5fc709f45cd69872694d88f25
f024c952b8edd6f74c92263e038cf8bc56413dfa3ca40b6e7a6d9f896acce2f0
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765