normaljuandediosrh.com
Open in
urlscan Pro
66.97.36.38
Malicious Activity!
Public Scan
URL:
https://normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/index_.html
Submission: On November 07 via api from US — Scanned from CA
Submission: On November 07 via api from US — Scanned from CA
Summary
This website contacted 4 IPs
in 4 countries
across 4 domains to perform 22 HTTP transactions.
The main IP is 66.97.36.38, located in
Rosario, Argentina and
belongs to Dattatec.com, AR.
The main domain is normaljuandediosrh.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 15th 2024. Valid for: a year.
This is the only time normaljuandediosrh.com was scanned on urlscan.io!
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 15th 2024. Valid for: a year.
This is the only time normaljuandediosrh.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Credit Agricole (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 18 | 66.97.36.38 66.97.36.38 | 27823 (Dattatec.com) (Dattatec.com) | |
| 2 | 158.191.172.47 158.191.172.47 | 9159 (Credit Ag...) (Credit Agricole) | |
| 1 | 104.26.13.205 104.26.13.205 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 2607:f8b0:400... 2607:f8b0:4004:c09::5f | 15169 (GOOGLE) (GOOGLE) | |
| 22 | 4 |
18
66.97.36.38
(Rosario, Argentina)
ASN27823 (Dattatec.com, AR)
PTR: vps-1753186-x.dattaweb.com
ASN27823 (Dattatec.com, AR)
PTR: vps-1753186-x.dattaweb.com
| normaljuandediosrh.com |
2
158.191.172.47
(France)
ASN9159 (Credit Agricole, FR)
PTR: www.credit-agricole.fr
ASN9159 (Credit Agricole, FR)
PTR: www.credit-agricole.fr
| www.credit-agricole.fr |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 18 |
normaljuandediosrh.com
normaljuandediosrh.com |
552 KB |
| 2 |
credit-agricole.fr
www.credit-agricole.fr — Cisco Umbrella Rank: 341557 |
246 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
3 KB |
| 1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2041 |
306 B |
| 22 | 4 |
| Domain | Requested by | |
|---|---|---|
| 18 | normaljuandediosrh.com |
normaljuandediosrh.com
|
| 2 | www.credit-agricole.fr |
normaljuandediosrh.com
|
| 1 | fonts.googleapis.com |
normaljuandediosrh.com
|
| 1 | api.ipify.org |
normaljuandediosrh.com
|
| 22 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| normaljuandediosrh.com Sectigo RSA Domain Validation Secure Server CA |
2024-10-15 - 2025-10-09 |
a year | crt.sh |
| www.credit-agricole.fr Sectigo RSA Organization Validation Secure Server CA |
2024-07-01 - 2025-07-01 |
a year | crt.sh |
| ipify.org WE1 |
2024-09-15 - 2024-12-14 |
3 months | crt.sh |
| upload.video.google.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/index_.html
Frame ID: ABAD1586027A0C0F9B4E507E83822451
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
Accès CR - Crédit AgricoleDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
AngularJS
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \bangular.{0,32}\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index_.html
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/ |
24 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
angular.min.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
163 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.CardValidator.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.validate.min.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
22 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.mask.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
2 KB 873 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/css/ |
138 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
helpers.css
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/css/ |
40 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fonts.css
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/css/ |
1 KB 361 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.css
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
NPC-logo_Agir_chaque_jour_CA_H_Desktop-1.svg
www.credit-agricole.fr/content/dam/assetsca/master/public/commun/images/autre/images/ |
22 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
popper.min.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
58 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fontawesome.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
1 MB 381 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cmd.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/system/ |
9 KB 1019 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
api.ipify.org/ |
30 B 306 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
51 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/js/ |
86 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
acces_cr_part_carre.jpg
www.credit-agricole.fr/content/dam/assetsca/master/public/commun/images/zone-de-gauche/connect%C3%A9/ |
238 KB 239 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.png
normaljuandediosrh.com/moodle/blocks/globalsearch/infos-CA7/news2/style/ |
11 KB 11 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Credit Agricole (Banking)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| angular function| $ function| jQuery function| preventBack function| Popper object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome string| seperator string| dash function| cc_date function| date_of_birth function| getIP0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipify.org
fonts.googleapis.com
normaljuandediosrh.com
www.credit-agricole.fr
104.26.13.205
158.191.172.47
2607:f8b0:4004:c09::5f
66.97.36.38
16e8f08eb363930ccc9f0e91f33ded7905fed943045a040078196294db8a9b17
1ffae704c3dfbd1c88031131e48bdbfe16ca17297d6ff7f06eea10d95fa8a321
2a6536dfb04e99526ca10907b63b77bd89acf583d1e0a5351a64983b65a860ab
2e31f31633d04598c60731878851d821eaa4403af63b930d58bb10bc9c0428a2
306ab8dd287ef041231a510b7e4c027a11e28b20c3408a9185d895c091dc72a4
3358b6f2d9351fd1fec303210400a4514cc55a851ad97d202cfc0f840e3f54a7
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
5c44321c0ba44a1fa665ba4c928fbebd869a3082c458bd2d20a0d07a4e5fcc24
5d2350032234ad0508325e9c6c3de06675cf78bf2e5e3394efce4993f2489191
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
86c051eb57fe97e4dc99fd4cba7334c3faef8e6d3655da6f2b04176f523d96f5
8965eaf1598037b1a608ede6ff9633e6944b70039d631f80f635e25c79030da8
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
a566ef918683bd0b79e2a03d617aef7207ad5c34abc1dbb2cf33c6f6c3efa9aa
b42448a036b91ed30d92676a0fd63408012ef9c8af2ed34c2e66d285eecf005b
c4966ab5e78e2270952b89576c4a0a386e8a7ea673c56f0f396d620abf4f81b8
cd8873d8c03fd90eacd976f57b300327972964a89c7ac37d27e369d0324b9999
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d2b9f29ea1f42a60a8beb1c04f76868287f2a48d6ec50fb39d6b888584a03c49
e13d6a03d88c0ee199a9a6dbfe88f2684ebda8fbde5ead6b82eb93024fddf535
f14377c85a5a7110ab682c8de4f6e46f03bec27e9e3c3cefb7cbafe91a6b4290