![](/screenshots/f3f85e0d-95b4-4439-8ffe-047e28ec623c.png)
brave-nobel-f424be.netlify.com
Open in
urlscan Pro
18.184.5.8
Malicious Activity!
Public Scan
Submission: On May 21 via automatic, source openphish
Summary
This is the only time brave-nobel-f424be.netlify.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Orange (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 18.184.5.8 18.184.5.8 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 54.37.86.44 54.37.86.44 | 16276 (OVH) (OVH) | |
1 1 | 193.251.215.177 193.251.215.177 | 3215 (AS3215) (AS3215) | |
1 | 193.252.122.88 193.252.122.88 | 24600 (WANADOOPO...) (WANADOOPORTAILS-AS Wanadoo Portails/Direction technique) | |
1 | 213.186.33.2 213.186.33.2 | 16276 (OVH) (OVH) | |
3 | 5.135.39.40 5.135.39.40 | 16276 (OVH) (OVH) | |
7 | 5 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-184-5-8.eu-central-1.compute.amazonaws.com
brave-nobel-f424be.netlify.com |
ASN16276 (OVH, FR)
PTR: hosting.rubrash.com
serverpro.stayhost.xyz |
ASN24600 (WANADOOPORTAILS-AS Wanadoo Portails/Direction technique, FR)
PTR: 50008-eui-prod-bgl-pub-auth-proxy-bgl-fusion-pub.swarm.fti.net
login.orange.fr |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
xooimage.com
img6.xooimage.com img105.xooimage.com img102.xooimage.com |
24 KB |
2 |
orange.fr
1 redirects
authweb.orange.fr login.orange.fr |
4 KB |
1 |
fforces.com
fforces.com |
12 KB |
1 |
stayhost.xyz
serverpro.stayhost.xyz |
1 KB |
1 |
netlify.com
brave-nobel-f424be.netlify.com |
5 KB |
7 | 5 |
Domain | Requested by | |
---|---|---|
1 | img102.xooimage.com |
brave-nobel-f424be.netlify.com
|
1 | img105.xooimage.com |
brave-nobel-f424be.netlify.com
|
1 | img6.xooimage.com |
brave-nobel-f424be.netlify.com
|
1 | fforces.com |
brave-nobel-f424be.netlify.com
|
1 | login.orange.fr |
brave-nobel-f424be.netlify.com
|
1 | authweb.orange.fr | 1 redirects |
1 | serverpro.stayhost.xyz |
brave-nobel-f424be.netlify.com
|
1 | brave-nobel-f424be.netlify.com | |
7 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://brave-nobel-f424be.netlify.com/
Frame ID: DF8F46E55260E4E20370B8D9ABE62744
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://authweb.orange.fr/auth_user/bin/auth_user.cgi?return_url=http%3A%2F%2Forangesengage.orange.fr%2F?%61%75%74%68%77%65%62.%6F%72%61%6Eg%65.%66%72/%61%75%74%68_%75%73%65%72/%62%69%6E/%61%75%74%68_%75%73%65%72.%63g%69?%72%65%74%75%72%6E_%75%72l=%68%74%74%70%3%41%2%46%2%46%6F%72%61%6Eg%65%73%65%6Eg%61g%65.%6F%72%61%6Eg%65.%66%72%2%46 HTTP 302
- https://login.orange.fr/?return_url=http%3A%2F%2Forangesengage.orange.fr%2F?%61%75%74%68%77%65%62.%6F%72%61%6Eg%65.%66%72/%61%75%74%68_%75%73%65%72/%62%69%6E/%61%75%74%68_%75%73%65%72.%63g%69?%72%65%74%75%72%6E_%75%72l=%68%74%74%70%3%41%2%46%2%46%6F%72%61%6Eg%65%73%65%6Eg%61g%65.%6F%72%61%6Eg%65.%66%72%2%46
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
brave-nobel-f424be.netlify.com/ |
47 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ori.png
serverpro.stayhost.xyz/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
login.orange.fr/ Redirect Chain
|
0 4 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
oro.png
fforces.com/public/imghost/images/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
1x1pixel-c1520b.gif
img6.xooimage.com/files/8/7/a/ |
35 B 220 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
esprit-445c103.png
img105.xooimage.com/files/0/6/e/ |
24 KB 23 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
formbackground-445c12b.png
img102.xooimage.com/files/f/4/f/ |
958 B 792 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Orange (Telecommunication)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| m string| d0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
authweb.orange.fr
brave-nobel-f424be.netlify.com
fforces.com
img102.xooimage.com
img105.xooimage.com
img6.xooimage.com
login.orange.fr
serverpro.stayhost.xyz
18.184.5.8
193.251.215.177
193.252.122.88
213.186.33.2
5.135.39.40
54.37.86.44
3992b901546ef4e2685680badcd372d0834724caf9b1c95ea0f1e7c4ce6e5bc8
8736afe0af5304877013e49d2331f1385bcb145e75c0728345b740ef194dbb4f
88837a145e733904637f88c988a342ad44e6632153c5c7d5d5ba0872852714b6
cd5bea5b30368a8f06c79be5015c72ef78963152e95ad6ff976884bb38717a11
d1e76abe713b1ee9baa5908741ba83510aabbbae160054a2a5f0e296ea50f629
daaa5c644bf38efac4fcc136e6706ad8d66143c788aabff2006fe3761aeb2ae3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855