![](/screenshots/f07a4b65-c0d0-43b8-80cd-b19a16763298.png)
bnppf-net.firebaseapp.com
Open in
urlscan Pro
151.101.1.195
Malicious Activity!
Public Scan
Effective URL: https://bnppf-net.firebaseapp.com/
Submission: On December 04 via api from BE
Summary
TLS certificate: Issued by GTS CA 1O1 on October 21st 2020. Valid for: a year.
This is the only time bnppf-net.firebaseapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNP Paribas (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 64.34.65.25 64.34.65.25 | 13768 (COGECO-PEER1) (COGECO-PEER1) | |
2 | 2a00:1450:400... 2a00:1450:4001:803::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:9000:219... 2600:9000:2190:d800:1e:ddec:f100:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
21 | 151.101.1.195 151.101.1.195 | 54113 (FASTLY) (FASTLY) | |
1 | 193.58.4.82 193.58.4.82 | 25215 (BNP-PARIB...) (BNP-PARIBAS France) | |
1 | 2606:4700:10:... 2606:4700:10::6814:3d7a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
30 | 6 |
ASN25215 (BNP-PARIBAS France, FR)
PTR: bnpparisbasfortis.com
www.bnpparibasfortis.be |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
firebaseapp.com
bnppf-net.firebaseapp.com |
610 KB |
4 |
sivepro.com
www.sivepro.com |
2 KB |
2 |
googleapis.com
ajax.googleapis.com |
61 KB |
1 |
ipgeolocation.io
api.ipgeolocation.io |
881 B |
1 |
bnpparibasfortis.be
www.bnpparibasfortis.be |
84 KB |
1 |
unique.be
www.unique.be |
27 KB |
30 | 6 |
Domain | Requested by | |
---|---|---|
21 | bnppf-net.firebaseapp.com |
bnppf-net.firebaseapp.com
|
4 | www.sivepro.com |
www.sivepro.com
|
2 | ajax.googleapis.com |
www.sivepro.com
bnppf-net.firebaseapp.com |
1 | api.ipgeolocation.io |
ajax.googleapis.com
|
1 | www.bnpparibasfortis.be |
bnppf-net.firebaseapp.com
|
1 | www.unique.be |
www.sivepro.com
|
30 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
softnya.us Let's Encrypt Authority X3 |
2020-11-11 - 2021-02-09 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
www2.startpeople.be Amazon |
2020-11-26 - 2021-12-25 |
a year | crt.sh |
firebaseapp.com GTS CA 1O1 |
2020-10-21 - 2021-10-20 |
a year | crt.sh |
www.bnpparibasfortis.be Entrust Certification Authority - L1M |
2020-01-14 - 2022-01-22 |
2 years | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-29 - 2021-07-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://bnppf-net.firebaseapp.com/
Frame ID: D4BB32B43B390A0E00F60CEBA7C2E300
Requests: 30 HTTP requests in this frame
Screenshot
![](/screenshots/f07a4b65-c0d0-43b8-80cd-b19a16763298.png)
Page URL History Show full URLs
- https://www.sivepro.com/bebnp/bcbnp011/ Page URL
- https://bnppf-net.firebaseapp.com/ Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://www.sivepro.com/bebnp/bcbnp011/ Page URL
- https://bnppf-net.firebaseapp.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
www.sivepro.com/bebnp/bcbnp011/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Web-Banking-Unauthenticated.css
www.sivepro.com/iwov-resources/fixed-layout/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
brand.css
www.sivepro.com/static/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mediaelementplayer.min.css
www.sivepro.com/static/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.4.0/ |
86 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fortis.png
www.unique.be/thumbnail/inline/78/ |
27 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
bnppf-net.firebaseapp.com/ |
88 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Web-Banking-Unauthenticated.css
bnppf-net.firebaseapp.com/iwov-resources/fixed-layout/ |
88 KB 11 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
brand.css
bnppf-net.firebaseapp.com/static/css/ |
268 B 250 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mediaelementplayer.min.css
bnppf-net.firebaseapp.com/static/css/ |
12 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.4.0/ |
86 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.cdede159570c3a64ab5edb0b7d3ff55b.css
bnppf-net.firebaseapp.com/static/css/ |
92 B 216 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stopcard.png
bnppf-net.firebaseapp.com/rsc/contrib/image/footer/ |
64 KB 64 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
be_commerce.png
bnppf-net.firebaseapp.com/rsc/contrib/image/footer/ |
64 KB 64 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
manifest.2ae2e69a05c33dfc65f8.js
bnppf-net.firebaseapp.com/static/js/ |
857 B 579 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.e2907021bf281451670c.js
bnppf-net.firebaseapp.com/static/js/ |
1 MB 264 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.1dc36344c0bd9b4b0464.js
bnppf-net.firebaseapp.com/static/js/ |
30 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp-fortis.css
bnppf-net.firebaseapp.com/static/css/ |
456 KB 60 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp-fortis-pws.css
bnppf-net.firebaseapp.com/static/css/ |
125 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp-fortis-patch.css
bnppf-net.firebaseapp.com/static/css/ |
12 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite.svg
www.bnpparibasfortis.be/rsc/contrib/graphicaltheme/bnpp-fortis/images/ |
83 KB 84 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpiconfont.ttf
bnppf-net.firebaseapp.com/static/css/ |
156 B 219 B |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp_sans-webfont.ttf
bnppf-net.firebaseapp.com/static/css/ |
156 B 208 B |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp_sans_light-webfont.ttf
bnppf-net.firebaseapp.com/static/css/ |
156 B 208 B |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp_sans-webfont.woff
bnppf-net.firebaseapp.com/static/css/ |
27 KB 27 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp_sans_light-webfont.woff
bnppf-net.firebaseapp.com/static/css/ |
27 KB 27 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpiconfont.woff
bnppf-net.firebaseapp.com/static/css/ |
53 KB 30 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ipgeo
api.ipgeolocation.io/ |
752 B 881 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp_sans_cond_regular-webfont.ttf
bnppf-net.firebaseapp.com/static/css/ |
156 B 236 B |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp_sans_cond_regular-webfont.woff
bnppf-net.firebaseapp.com/static/css/ |
24 KB 24 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNP Paribas (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipgeolocation.io
bnppf-net.firebaseapp.com
www.bnpparibasfortis.be
www.sivepro.com
www.unique.be
151.101.1.195
193.58.4.82
2600:9000:2190:d800:1e:ddec:f100:93a1
2606:4700:10::6814:3d7a
2a00:1450:4001:803::200a
64.34.65.25
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
0bd8bac7550e699b6cf2e371b566cd52a285a49e58142c1ee3aa81c17efed8f5
118834664625506c47a61ce9e6745ca5da358d02140758d6050c30de6653c7c2
301fb78556c0e004e1e35efb8c9ecbb261d2b0be44727b2e8b73da9f840a976d
328a9702c2daeeb22d4379f7dbe4c02fa4f90e45e4b19f3baf509a2c78ab2012
45bb7e057cad35c12895482c819a6437dc51011ae59da47e9faffefc6812593d
5acd07b6ba34bba4f5d0141462e5a61292bb9a3afbcf9afe0038080a163113c6
6235a42cae9d690efb305354447cef8ffd724b8cb7b80b6d5b8b253d3dacf9be
67e1089820ea2c0d78a1387c0397d9a06f00b19569ca3a348b39d7931a1f15eb
77d8b27fb385e5ea2bb4a42503a85e3d5087fb535fd6e31a02d2c0824486d47e
7e6b30e73ff23860ed442056d0bd2e6798cfdecf896fc1eaa6370f62f74037db
8a8423ddff2e702ffcfe8e83482051fa437cb9f5f67d43ef655fba3adca9a365
a2c6afbffb37d2589273072cee49d74068d1ca48dd9c6c46502f13690591c8f5
acad8c233b9c9c3aa515312f2d8e5bf52119899c084940abc96b9dabfa92d7db
ad52aaa6ba342b2cf382e7cd5ec9f4d50c4e5fda60817c9e92f357619c9e7a15
b3da6a69d865280145fab80f0a540da70fbcaffb09e131ab4494b71d16d4d1d9
b5b5895c9d4f12ab4cc1c9ca588a0d451e5b1d053d7487bc15f3d3e3d974893e
bcee240785160d2d972bd3f075c0dcb88f47d89b3610b829914b96f7786d0e1d
c48cb154d913fed893b4920867fd6a57b96e495b13e9765a8b1c1365d833e36a
d414b80e539a45c4c5b318d37543f524d2cfcc69c92256879afb2f1dd980fdd1
d95b878493805d149981d0c691179da137af93bf60782afe5da9f26e4fe5a4d8
e0486eb718675e3b7f58c3f90c09ef9bcf15f13e77d80c1a3734d89f8f2f216e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fa1f201faca683b3520f0413ea029b33b6fef801ee55aab0216b12839a7da735