www.prensapro.com.ar
Open in
urlscan Pro
200.58.111.16
Malicious Activity!
Public Scan
URL:
http://www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS.html
Submission: On August 24 via manual from PL — Scanned from PL
Submission: On August 24 via manual from PL — Scanned from PL
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 200.58.111.16, located in
Rosario, Argentina and
belongs to Dattatec.com, AR.
The main domain is www.prensapro.com.ar.
This is the only time www.prensapro.com.ar was scanned on urlscan.io!
This is the only time www.prensapro.com.ar was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNP Paribas (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 200.58.111.16 200.58.111.16 | 27823 (Dattatec.com) (Dattatec.com) | |
| 2 | 104.102.57.15 104.102.57.15 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 14 | 2 |
12
200.58.111.16
(Rosario, Argentina)
ASN27823 (Dattatec.com, AR)
PTR: c245.dattaweb.com
ASN27823 (Dattatec.com, AR)
PTR: c245.dattaweb.com
| www.prensapro.com.ar |
2
104.102.57.15
(Frankfurt am Main, Germany)
ASN16625 (AKAMAI-AS, US)
PTR: a104-102-57-15.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a104-102-57-15.deploy.static.akamaitechnologies.com
| nc.bnpparibas.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
prensapro.com.ar
www.prensapro.com.ar |
870 KB |
| 2 |
bnpparibas.net
nc.bnpparibas.net |
2 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 12 | www.prensapro.com.ar |
www.prensapro.com.ar
|
| 2 | nc.bnpparibas.net |
www.prensapro.com.ar
|
| 14 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| nc.bnpparibas.net |
| www.bnpparibas.nc |
| antilles-guyane.bnpparibas |
| antilles-guyane.bnpparibas.net |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| bnp06s.bnpparibas.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-08-03 - 2024-06-11 |
10 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS.html
Frame ID: D86BE8888C209894F304E2E84B26DBDB
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
BNPPARIBAS NET IDENTIFICATIONDetected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /wp-(?:content|includes)/
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
URL: https://nc.bnpparibas.net/part/fr/idehom.html
Search URL Search Domain Scan URL
URL: https://nc.bnpparibas.net/part/en/idehom.html
Search URL Search Domain Scan URL
URL: https://www.bnpparibas.nc/particuliers/banque-a-distance/#4
Title: Banque distance - NouvelleCaledonie.bnpparibas.nc
Title: Banque distance - NouvelleCaledonie.bnpparibas.nc
Search URL Search Domain Scan URL
URL: http://antilles-guyane.bnpparibas/
Title: Accueil
Title: Accueil
Search URL Search Domain Scan URL
URL: http://antilles-guyane.bnpparibas/aide/aide-connexion-bnpinet/
Title: Aide la connexion ?
Title: Aide la connexion ?
Search URL Search Domain Scan URL
URL: http://antilles-guyane.bnpparibas/convention/
Title: Convention
Title: Convention
Search URL Search Domain Scan URL
URL: https://antilles-guyane.bnpparibas.net/part/fr/cookiesp.html
Title: Politique des Cookies
Title: Politique des Cookies
Search URL Search Domain Scan URL
URL: https://antilles-guyane.bnpparibas/espace-donnees-personnelles/77777777
Title: Espace Donn es Personnelles
Title: Espace Donn es Personnelles
Search URL Search Domain Scan URL
URL: https://antilles-guyane.bnpparibas.net/part/fr/ide1hom.html
Title: Visite guid e
Title: Visite guid e
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
BNPPARIBAS.html
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/ |
16 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dciweb.css
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bnp.css
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tools.js.download
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
42 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
headerBack.jpg
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
10 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
francec.gif
nc.bnpparibas.net/part/fr/ |
208 B 548 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
greatbrc.gif
nc.bnpparibas.net/part/fr/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
etape1.png
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
476 B 772 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
etape2.png
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
567 B 863 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dciweb.png
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
flecheCorriger.png
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
538 B 834 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
btn_valider.png
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
btn_annuler.png
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
covid19-information.png
www.prensapro.com.ar/wp-content/plugins/blockspare/assets/fontawesome/fonts/BNP/BNPPARIBAS_files/ |
831 KB 831 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNP Paribas (Banking)87 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| msgErreur function| setselect function| getselect function| setradio function| getradio function| CheckForbiddenCharMessage function| CheckForbiddenChar function| CheckForbiddenCharOld function| ZeroDevant function| CheckRIBAlert function| CheckRIB function| CheckAFB function| CheckAFBAlert function| ReadAmount function| CheckAmount function| CheckAmountAlert function| CheckAmountAlertForHtml5 function| CheckNumber function| CheckAmountCouple function| Today function| ReadDate function| CheckDate function| checkDateMobile function| CheckDateAlert function| CheckDateCouple function| CheckIBAN function| KeyIBAN function| TranslateAlpha2Num function| CheckInt function| CheckIntAlert function| lvtrim function| rvtrim function| vtrim function| ltrim function| rtrim function| trim function| CheckStr function| CheckStrAlert function| TextFormat function| TextTranslate function| pad_right function| CheckTime function| CheckTimeAlert function| CheckEmail number| posX function| getMousePos function| getScrollX function| getScrollY function| AffBulle function| HideBulle function| random function| gen_clavier function| makepwd function| clearpwd function| valdec_form function| check_nbdec function| FormatMonnaie function| ChargerCookie function| FormatChecked function| createXmlHttpRequest function| supZero function| logout function| openPopup function| CheckEndDateAFB160 function| setBorder function| showHideError function| documentWrite function| closeReveal function| isInputTypeSupported function| isAttributeSupported function| isHtml5 function| transcoCodeForCreateBeneficiary function| CheckAFBMobile number| posY object| theBody function| clearParams function| control function| submitform function| key function| pwd_writeM number| CellX number| CellY number| col number| lig object| tabcar number| posX1 number| posY10 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nc.bnpparibas.net
www.prensapro.com.ar
104.102.57.15
200.58.111.16
0635d965c9c0bc6b7958c2f4a30fecf1e70f67c68cb8caf520dfa8b910d6b4f0
0da01629c4b396bd5d1433cdc5d901f9f32df0ffcdc8c9703153014e7d36e674
3cb44c54269c2c1efb3a6bb1da491ffb522217ef212f6809a6f6b121f15dcba2
4ede7bb44d8cdb4447d0e9589c5ce0980725605bbb6193f96be49d72fd7b4827
7e226712937dc5e54e9575ef0cb6ec124dc77aab6bde0cecaa9face4a583f911
8a56cd2b0b8b3fb49bbd0502d7ad0ad6d01e955a0e270b68ccc83bf03dd9d25b
946a623df9e402169545b33c51f98b9f4dda8000ab1e8361d44f7a9dbbaa27c3
955510e34da1928b4ab68f72385e6281ffdf2e5c4326c70cb73f914579bb9c43
99c5135aa6eed33bf4ad8aa53556a5b3a508e9a0fab486cc25806090831c57cd
9acb35fd1f062dca2710241d1f7ac8cb1b5eb21375f1be5b339172cf17d2e802
b376c09f7173d06a51c22af97d11b083001cbad6feac4dfc8c30a088b95bc464
b67681cb230c4d6e1c7635b95fbdc00ddf56a3dcf4bfeb6e94c08336e6534b5a
f266f7e14644c34b42531dc2022dc3bc0b92c09d9c6613d5ff92a0edbe45d40b
f7ac02953144040664d7bbcbe0ef5af6ad2966a546de3846931557852538d5be