![](/screenshots/f3f747e2-8fbc-443c-8ca8-361d8ab0d0ab.png)
u335071fsr.ha002.t.justns.ru
Open in
urlscan Pro
2a00:b700::6:b
Malicious Activity!
Public Scan
Submission: On February 20 via automatic, source openphish
Summary
This is the only time u335071fsr.ha002.t.justns.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Credit Agricole (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2a00:b700::6:b 2a00:b700::6:b | 51659 (ASBAXET) (ASBAXET) | |
3 | 184.31.89.102 184.31.89.102 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2.23.79.126 2.23.79.126 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 158.191.172.70 158.191.172.70 | 9159 () () | |
21 | 158.191.152.213 158.191.152.213 | 9159 () () | |
1 | 158.191.153.74 158.191.153.74 | 9159 () () | |
38 | 7 |
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-89-102.deploy.static.akamaitechnologies.com
libs.de.coremetrics.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-23-79-126.deploy.static.akamaitechnologies.com
tmscdn.de.coremetrics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
credit-agricole.fr
www.alpesprovence-g3-enligne.credit-agricole.fr www.norddefrance-g3-enligne.credit-agricole.fr |
301 KB |
5 |
coremetrics.com
libs.de.coremetrics.com tmscdn.de.coremetrics.com |
22 KB |
4 |
justns.ru
u335071fsr.ha002.t.justns.ru |
31 KB |
1 |
ca-alpesprovence.fr
www.ca-alpesprovence.fr |
2 KB |
38 | 4 |
Domain | Requested by | |
---|---|---|
21 | www.alpesprovence-g3-enligne.credit-agricole.fr |
u335071fsr.ha002.t.justns.ru
|
4 | u335071fsr.ha002.t.justns.ru |
u335071fsr.ha002.t.justns.ru
|
3 | libs.de.coremetrics.com |
u335071fsr.ha002.t.justns.ru
|
2 | tmscdn.de.coremetrics.com |
u335071fsr.ha002.t.justns.ru
|
1 | www.norddefrance-g3-enligne.credit-agricole.fr |
u335071fsr.ha002.t.justns.ru
|
1 | www.ca-alpesprovence.fr |
u335071fsr.ha002.t.justns.ru
|
38 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.de.coremetrics.com DigiCert SHA2 Secure Server CA |
2019-01-28 - 2020-04-28 |
a year | crt.sh |
www.ca-alpesprovence.fr COMODO RSA Organization Validation Secure Server CA |
2018-11-28 - 2019-11-28 |
a year | crt.sh |
www.alpesprovence-g3-enligne.credit-agricole.fr COMODO RSA Extended Validation Secure Server CA |
2018-12-24 - 2019-12-24 |
a year | crt.sh |
www.norddefrance-g3-enligne.credit-agricole.fr COMODO RSA Extended Validation Secure Server CA |
2018-12-24 - 2019-12-24 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://u335071fsr.ha002.t.justns.ru/secure/vrf.php
Frame ID: 6597CBA9BA81B7D1757AD743D3AC8071
Requests: 38 HTTP requests in this frame
Screenshot
![](/screenshots/f3f747e2-8fbc-443c-8ca8-361d8ab0d0ab.png)
Detected technologies
Detected patterns
- url /\.php(?:$|\?)/i
Detected patterns
- headers server /^LiteSpeed$/i
![](/vendor/wappa/icons/YUI.png)
Detected patterns
- env /^YAHOO$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
38 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
vrf.php
u335071fsr.ha002.t.justns.ru/secure/ |
27 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
50580000.js
libs.de.coremetrics.com/configs/ |
125 B 443 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dispatcher-v3.js
tmscdn.de.coremetrics.com/tms/ |
3 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoo-min.js
libs.de.coremetrics.com/ddxlibs/ |
7 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cp-v3.js
tmscdn.de.coremetrics.com/tms/50580000/ |
74 KB 15 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
json-min.js
libs.de.coremetrics.com/ddxlibs/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ddx-tag.jsp
www.ca-alpesprovence.fr/Vitrine/ObjCommun/BAMG2/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cssstyles.css
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/styles/ |
0 408 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
antiquus.css
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/styles/ |
28 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
antiquus.css
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/styles/ |
28 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/styles/ |
93 KB 94 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/styles/ |
94 KB 94 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-mod.css
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/styles/ |
17 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-mod.css
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/styles/ |
17 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
stb.css
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/styles/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.PNG
u335071fsr.ha002.t.justns.ru/secure/entreeBam_fichiers/ |
24 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
picto_home.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
breadcrumbs.js
u335071fsr.ha002.t.justns.ru/web/bam/appli/web/commun/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
picto_nouveau.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
491 B 834 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banniere_tcm_984_465675.jpg
www.norddefrance-g3-enligne.credit-agricole.fr/images/867/pack_159/ |
0 499 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
breadcrumbs.js
u335071fsr.ha002.t.justns.ru/web/bam/appli/web/commun/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ariane.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
318 B 662 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lettre-off.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rubriques_gauche.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main_haut.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
143 B 485 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
picto_aide.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
267 B 611 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
caption.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
150 B 493 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bloc_arrond_bas.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
244 B 587 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bloc_arrond_haut.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
244 B 587 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_form.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
85 B 427 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
thead.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
122 B 465 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bloc_droit_bas.png
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/img/ |
158 B 501 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
montserrat-regular-webfont.woff2
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/polices/Montserrat-Regular/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
montserrat-regular-webfont.woff
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/polices/Montserrat-Regular/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
montserrat-regular-webfont.ttf
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/polices/Montserrat-Regular/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
montserrat-regular-webfont.woff2
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/polices/Montserrat-Regular/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
montserrat-regular-webfont.woff
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/polices/Montserrat-Regular/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
montserrat-regular-webfont.ttf
www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/polices/Montserrat-Regular/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.alpesprovence-g3-enligne.credit-agricole.fr
- URL
- https://www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/polices/Montserrat-Regular/montserrat-regular-webfont.woff2
- Domain
- www.alpesprovence-g3-enligne.credit-agricole.fr
- URL
- https://www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/polices/Montserrat-Regular/montserrat-regular-webfont.woff
- Domain
- www.alpesprovence-g3-enligne.credit-agricole.fr
- URL
- https://www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/appli/web/commun/polices/Montserrat-Regular/montserrat-regular-webfont.ttf
- Domain
- www.alpesprovence-g3-enligne.credit-agricole.fr
- URL
- https://www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/polices/Montserrat-Regular/montserrat-regular-webfont.woff2
- Domain
- www.alpesprovence-g3-enligne.credit-agricole.fr
- URL
- https://www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/polices/Montserrat-Regular/montserrat-regular-webfont.woff
- Domain
- www.alpesprovence-g3-enligne.credit-agricole.fr
- URL
- https://www.alpesprovence-g3-enligne.credit-agricole.fr/web/bam/tech/allmedia/stb/commun/polices/Montserrat-Regular/montserrat-regular-webfont.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Credit Agricole (Banking)48 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| __$dispatcher object| YAHOO object| hmNameToIds object| __$codeSnippets undefined| $f167 undefined| $f171 undefined| $f166 function| $f165 function| $f172 function| $f173 undefined| __$partner undefined| __$helper undefined| $f168 string| ca_cmCookieMigrationQuery function| ca_cmSetupCookieMigration undefined| blackList undefined| dropParams undefined| attr undefined| crID undefined| partID undefined| rxReg undefined| match undefined| now undefined| doRegMig undefined| timeStamp undefined| regId undefined| scripts undefined| src undefined| idx0 undefined| idx1 undefined| pageid string| PU_PREM_ECRAN string| aide_message string| aide_bnt1_0 string| aide_bnt1_1 string| aide_bnt1_2 string| aide_bnt1_3 string| aide_bnt1_4 string| aide_bnt1_5 string| aide_bnt1_6 string| aide_bnt1_7 string| aide_bnt1_8 object| champsEnErreur string| marqueurXiti string| marqueurXiti4080720 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
libs.de.coremetrics.com
tmscdn.de.coremetrics.com
u335071fsr.ha002.t.justns.ru
www.alpesprovence-g3-enligne.credit-agricole.fr
www.ca-alpesprovence.fr
www.norddefrance-g3-enligne.credit-agricole.fr
www.alpesprovence-g3-enligne.credit-agricole.fr
158.191.152.213
158.191.153.74
158.191.172.70
184.31.89.102
2.23.79.126
2a00:b700::6:b
0016e357414e409946100672339e5c7eb6b368c86f66eb7879171d77fc6caa33
023ace0c8bc753ee1c25c36ec0cdb2d5c78716c58d5e23229f6749993108afd6
0263f68cf4717e0ce2612fcb5e626a95675cc6074786d090f51dd49492c2f492
0509403f3036007c22bec206e971fadf32fdc00c65cb49a9c9fe8992647c3dbd
069448820234b3d4a8a6546db608c74011eb8ba8823e7276594aab7440c099f0
093964315f8622bb949ef027fbe25405ff42a63e1f2aae3819fb4317f2a0cf47
1b5eb3337690c692227e3cc27fb9b7ae57745541d3001b01a5b13a9e412d1848
2bf7a25d62ec87f9eafb933a42f7eeaaca1f75822511bbb351f8c26bc767f08f
566bf0487af35791b36e6b7ee0c1ed5155b8e3464f1462664b4d5c4bd2e88e4c
5f2ceee004f24e5de284239060a4e9acd6049fc4b91fa23d07ee0b83a115ea4e
6e6e87e23113a40c297167e0360fe02e0b62697b436cc96dbff3e3bad120cf7b
84e84a90308803eb9f40935b354b87a47bc8b0ade113a26fb49985a6afda3897
85eadff8f23f3c65ad724a1d6f45354b92017285cde3596b6e9a8567bbb64861
87a40f7b7f67e37370fc89d27b54da33503379d1c0deed99e0eda52e7bc36b95
96942c82e3cce063d94a0a54873c7b347dac364339a2807fae49034eeb1d13e9
9b9c78ada6c93b6352af4de3a120f1abb72f6a08936821f56909598097e9ac03
a1e817d5342e1e788c9aebff368f425cba201930d642666cf046bb3e5ef570a7
a5e92ccb7c63076faad143554091d605c4b6722ec8e2d1e3026343a0f9784aa7
aa3e4cf2ef855c99db111eb3f12cb3263056d8da9a5d939e9a7c65528e68c005
c2eb575af2dd8cbf678afc27903c39d00e4083a82f2f340e6e7eaebb2c6b7131
c642c7ca52f6c1109ae4f95cc996868b27c2aa5d230bb2fae8b73969093eac17
c86b8f85f4424eab01fa9d72ca34d029480d384d7f4750cb11d367de5f1bdb7e
d2f65b5b23c8346bf2a6a561789dd547803405f7291e517798c2f048dd0e7318
d70b277e06a77c04b685bc27b998470623c24a6c01f899a79ba656d109c31c86
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e738b530e9dbcc1b78938c58fa15fffadb47d5dc677338d21b4b92957902b303
f1e61393cfaee8ca11e6b4359b028bf1db14dad7e1508c5b1801ab7f1a3e1561
f9c6a26ce3e203ceae1433c8c1618f7c93d695131a53262ff72f8154421fde40