ad-avenue.fr Open in urlscan Pro
2001:41d0:1:1b00:213:186:33:87 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://hbibolocakizeo.co.uk/
Effective URL:
https://ad-avenue.fr/.css/ff7117b/Login.php
Submission: On January 13 via manual (January 13th 2022, 3:02:41 pm UTC) from PT — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2001:41d0:1:1b00:213:186:33:87, located in France and belongs to OVH, FR. The main domain is ad-avenue.fr.
TLS certificate: Issued by R3 on November 11th 2021. Valid for: 3 months.

This is the only time ad-avenue.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Novobanco (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	192.64.119.56 192.64.119.56	22612 (NAMECHEAP...) (NAMECHEAP-NET)
4 15	2001:41d0:1:1... 2001:41d0:1:1b00:213:186:33:87	16276 (OVH) (OVH)
11	1

1 192.64.119.56 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)

hbibolocakizeo.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2001:41d0:1:1b00:213:186:33:87 (France) 4 redirects

ASN16276 (OVH, FR)

ad-avenue.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	ad-avenue.fr 4 redirects ad-avenue.fr	681 KB
1	hbibolocakizeo.co.uk 1 redirects hbibolocakizeo.co.uk	231 B
11	2

	Domain	Requested by
15	ad-avenue.fr	4 redirects ad-avenue.fr
1	hbibolocakizeo.co.uk	1 redirects
11	2

This site contains no links.

Subject Issuer	Validity	Valid
ad-avenue.fr R3	`2021-11-11` - `2022-02-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ad-avenue.fr/.css/ff7117b/Login.php
Frame ID: 4AC0000419DB0E77D9076F45C73D0E7D
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login novobanco Online | novobanco

Page URL History Show full URLs

http://hbibolocakizeo.co.uk/ HTTP 302
https://ad-avenue.fr/.css HTTP 301
https://ad-avenue.fr/.css/ HTTP 302
https://ad-avenue.fr/.css/ff7117b HTTP 301
https://ad-avenue.fr/.css/ff7117b/ HTTP 302
https://ad-avenue.fr/.css/ff7117b/Login.php Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

<div class="[^"]*aem-Grid

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

681 kB
Transfer

1504 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://hbibolocakizeo.co.uk/ HTTP 302
https://ad-avenue.fr/.css HTTP 301
https://ad-avenue.fr/.css/ HTTP 302
https://ad-avenue.fr/.css/ff7117b HTTP 301
https://ad-avenue.fr/.css/ff7117b/ HTTP 302
https://ad-avenue.fr/.css/ff7117b/Login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request Login.php Show response ad-avenue.fr/.css/ff7117b/ Redirect Chain http://hbibolocakizeo.co.uk/ https://ad-avenue.fr/.css https://ad-avenue.fr/.css/ https://ad-avenue.fr/.css/ff7117b https://ad-avenue.fr/.css/ff7117b/ https://ad-avenue.fr/.css/ff7117b/Login.php	7 KB 3 KB	51ms 51ms	Document text/html	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Full URL https://ad-avenue.fr/.css/ff7117b/Login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / PHP/5.6 Resource Hash `b79d80c9261e6cdbf1cd84a6330902f4b3c80c0c3f4702288f682bee0916e4d1` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Thu, 13 Jan 2022 15:02:36 GMT content-type text/html; charset=UTF-8 content-length 2505 server Apache x-powered-by PHP/5.6 vary Accept-Encoding content-encoding gzip Redirect headers date Thu, 13 Jan 2022 15:02:36 GMT content-type text/html; charset=UTF-8 server Apache x-powered-by PHP/5.6 location ./Login.php
GET H2	200	clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css ad-avenue.fr/.css/ff7117b/style/	905 KB 83 KB	37ms 36ms	Stylesheet text/css	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Full URL https://ad-avenue.fr/.css/ff7117b/style/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/Login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / Resource Hash `f8c13cef307dd7fc6acec0872148f961668d80cf27683f12b55f057fcd7667cd` Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad-avenue.fr/.css/ff7117b/Login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 13 Jan 2022 15:02:36 GMT content-encoding gzip last-modified Thu, 13 Jan 2022 15:02:35 GMT server Apache vary Accept-Encoding content-type text/css cache-control max-age=900 accept-ranges bytes expires Thu, 13 Jan 2022 15:17:36 GMT
GET H2	200	novobanco-icons.svg ad-avenue.fr/.css/ff7117b/style/	61 KB 62 KB	27ms 27ms	Other image/svg+xml	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Full URL https://ad-avenue.fr/.css/ff7117b/style/novobanco-icons.svg Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/Login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / Resource Hash `7a7c300249d7ebe0d8419609fdae3953325a9b51548c88be622665a1bdd6ce6d` Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad-avenue.fr/.css/ff7117b/Login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 13 Jan 2022 15:02:36 GMT last-modified Thu, 13 Jan 2022 15:02:35 GMT server Apache content-type image/svg+xml cache-control max-age=900 accept-ranges bytes content-length 62853 expires Thu, 13 Jan 2022 15:17:36 GMT
GET H2	200	cq5dam.web.1280.1280.jpeg ad-avenue.fr/.css/ff7117b/style/	463 KB 464 KB	29ms 28ms	Image image/jpeg	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://ad-avenue.fr/.css/ff7117b/style/cq5dam.web.1280.1280.jpeg Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/Login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / Resource Hash `50b1758f17eca066d3c2e147a55c41368d67697adaee7c97f3c3d7706ac00393` Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad-avenue.fr/.css/ff7117b/Login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 13 Jan 2022 15:02:36 GMT last-modified Thu, 13 Jan 2022 15:02:35 GMT server Apache content-type image/jpeg cache-control max-age=900 accept-ranges bytes content-length 474087 expires Thu, 13 Jan 2022 15:17:36 GMT
GET H2	200	NovobancoText-Book.woff ad-avenue.fr/.css/ff7117b/style/	32 KB 32 KB	100ms 100ms	Font application/x-font-woff	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Full URL https://ad-avenue.fr/.css/ff7117b/style/NovobancoText-Book.woff Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/style/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / Resource Hash `ceaa2f8cc66bf5aa5e36a7cf28e9618c073db4896d60dfaf82f3b58e0a04b672` Request headers Referer https://ad-avenue.fr/.css/ff7117b/style/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css Origin https://ad-avenue.fr Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 13 Jan 2022 15:02:36 GMT last-modified Thu, 13 Jan 2022 15:02:35 GMT server Apache accept-ranges bytes content-length 32744 content-type application/x-font-woff
GET H2	200	NovobancoText-Medium.woff ad-avenue.fr/.css/ff7117b/style/	32 KB 33 KB	99ms 99ms	Font application/x-font-woff	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Full URL https://ad-avenue.fr/.css/ff7117b/style/NovobancoText-Medium.woff Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/style/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / Resource Hash `63ec9237cef48b2cfd492b33ea283f8c80059761fa5cc1564e4c664f995e9223` Request headers Referer https://ad-avenue.fr/.css/ff7117b/style/clientlib-base.lc-c9c10b983da937abe13d91a655b2032d-lc.min.css Origin https://ad-avenue.fr Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 13 Jan 2022 15:02:36 GMT last-modified Thu, 13 Jan 2022 15:02:35 GMT server Apache accept-ranges bytes content-length 33160 content-type application/x-font-woff
GET H2	200	novobanco_negativo.svg ad-avenue.fr/.css/ff7117b/style/	4 KB 4 KB	74ms 73ms	Image image/svg+xml	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://ad-avenue.fr/.css/ff7117b/style/novobanco_negativo.svg Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/Login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / Resource Hash `e6c646ee2dd1deee0befd3a421422abd8cb605fd7c69c4b0efc646472a1ed737` Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad-avenue.fr/.css/ff7117b/Login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 13 Jan 2022 15:02:36 GMT last-modified Thu, 13 Jan 2022 15:02:35 GMT server Apache content-type image/svg+xml cache-control max-age=900 accept-ranges bytes content-length 3896 expires Thu, 13 Jan 2022 15:17:36 GMT
GET H2	200	Where_Page.php Show response ad-avenue.fr/.css/ff7117b/Select/auto_system/	6 B 261 B	55ms 54ms	XHR text/html	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Full URL https://ad-avenue.fr/.css/ff7117b/Select/auto_system/Where_Page.php?Online=login Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/Login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / PHP/5.6 Resource Hash `0d21bd52022ca7f7e97109d28d327da1e68cc0bedd9713b2dc2b49d3aa104392` Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad-avenue.fr/.css/ff7117b/Login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jan 2022 15:02:37 GMT server Apache x-powered-by PHP/5.6 content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-length 6 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	Where_Page.php Show response ad-avenue.fr/.css/ff7117b/Select/auto_system/	6 B 213 B	52ms 51ms	XHR text/html	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Full URL https://ad-avenue.fr/.css/ff7117b/Select/auto_system/Where_Page.php?Online=login Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/Login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / PHP/5.6 Resource Hash `0d21bd52022ca7f7e97109d28d327da1e68cc0bedd9713b2dc2b49d3aa104392` Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad-avenue.fr/.css/ff7117b/Login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jan 2022 15:02:38 GMT server Apache x-powered-by PHP/5.6 content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-length 6 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	Where_Page.php Show response ad-avenue.fr/.css/ff7117b/Select/auto_system/	6 B 213 B	74ms 74ms	XHR text/html	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Full URL https://ad-avenue.fr/.css/ff7117b/Select/auto_system/Where_Page.php?Online=login Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/Login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / PHP/5.6 Resource Hash `0d21bd52022ca7f7e97109d28d327da1e68cc0bedd9713b2dc2b49d3aa104392` Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad-avenue.fr/.css/ff7117b/Login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jan 2022 15:02:39 GMT server Apache x-powered-by PHP/5.6 content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-length 6 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	Where_Page.php Show response ad-avenue.fr/.css/ff7117b/Select/auto_system/	6 B 213 B	80ms 79ms	XHR text/html	2001:41d0:1:1b00:213:186:33:87 OVH
General Check archive.org Show headers Download Go to Full URL https://ad-avenue.fr/.css/ff7117b/Select/auto_system/Where_Page.php?Online=login Requested by Host: ad-avenue.fr URL: https://ad-avenue.fr/.css/ff7117b/Login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:41d0:1:1b00:213:186:33:87 , France, ASN16276 (OVH, FR), Reverse DNS Software Apache / PHP/5.6 Resource Hash `0d21bd52022ca7f7e97109d28d327da1e68cc0bedd9713b2dc2b49d3aa104392` Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad-avenue.fr/.css/ff7117b/Login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jan 2022 15:02:40 GMT server Apache x-powered-by PHP/5.6 content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-length 6 expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Novobanco (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onsecuritypolicyviolation object| onslotchange function| noBack

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ad-avenue.fr/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4a78ced9305313d5a3bd02719f02d35e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad-avenue.fr
hbibolocakizeo.co.uk
192.64.119.56
2001:41d0:1:1b00:213:186:33:87
0d21bd52022ca7f7e97109d28d327da1e68cc0bedd9713b2dc2b49d3aa104392
50b1758f17eca066d3c2e147a55c41368d67697adaee7c97f3c3d7706ac00393
63ec9237cef48b2cfd492b33ea283f8c80059761fa5cc1564e4c664f995e9223
7a7c300249d7ebe0d8419609fdae3953325a9b51548c88be622665a1bdd6ce6d
b79d80c9261e6cdbf1cd84a6330902f4b3c80c0c3f4702288f682bee0916e4d1
ceaa2f8cc66bf5aa5e36a7cf28e9618c073db4896d60dfaf82f3b58e0a04b672
e6c646ee2dd1deee0befd3a421422abd8cb605fd7c69c4b0efc646472a1ed737
f8c13cef307dd7fc6acec0872148f961668d80cf27683f12b55f057fcd7667cd

ad-avenue.fr Open in urlscan Pro 2001:41d0:1:1b00:213:186:33:87 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

681 kBTransfer

1504 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

ad-avenue.fr Open in urlscan Pro
2001:41d0:1:1b00:213:186:33:87 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

681 kB
Transfer

1504 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!