bnp-espace.fr-covid19.gq
Open in
urlscan Pro
31.220.105.98
Malicious Activity!
Public Scan
Effective URL: http://bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/?&valid=BOSb0RVTPK1jrzecnCCHQuw8L&alert=okVLqSVlJZUPzkK&x.=BOSb0RVTPK1jrzo...
Submission: On May 22 via manual from IN
Summary
This is the only time bnp-espace.fr-covid19.gq was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNP Paribas (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 17 | 31.220.105.98 31.220.105.98 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
16 | 1 |
ASN47583 (AS-HOSTINGER, LT)
PTR: fox.boxsecured.com
bnp-espace.fr-covid19.gq |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
fr-covid19.gq
1 redirects
bnp-espace.fr-covid19.gq |
365 KB |
16 | 1 |
Domain | Requested by | |
---|---|---|
17 | bnp-espace.fr-covid19.gq |
1 redirects
bnp-espace.fr-covid19.gq
|
16 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/?&valid=BOSb0RVTPK1jrzecnCCHQuw8L&alert=okVLqSVlJZUPzkK&x.=BOSb0RVTPK1jrzokVLqSVlJZUPzkK&pop=okVLqSVlJZUPzkK&done=&errory=ecnCCHQuw8L&mnemonic=&jb=ecnCCHQuw8L
Frame ID: 4130B53B9449BC53CB434DA54FD51A09
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://bnp-espace.fr-covid19.gq/ Page URL
-
http://bnp-espace.fr-covid19.gq/connexion/lUGwniJV746?&valid=BOSb0RVTPK1jrzecnCCHQuw8L&alert=okVLqSVlJZUPzkK...
HTTP 301
http://bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/?&valid=BOSb0RVTPK1jrzecnCCHQuw8L&alert=okVLqSVlJZUPzk... Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://bnp-espace.fr-covid19.gq/ Page URL
-
http://bnp-espace.fr-covid19.gq/connexion/lUGwniJV746?&valid=BOSb0RVTPK1jrzecnCCHQuw8L&alert=okVLqSVlJZUPzkK&x.=BOSb0RVTPK1jrzokVLqSVlJZUPzkK&pop=okVLqSVlJZUPzkK&done=&errory=ecnCCHQuw8L&mnemonic=&jb=ecnCCHQuw8L
HTTP 301
http://bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/?&valid=BOSb0RVTPK1jrzecnCCHQuw8L&alert=okVLqSVlJZUPzkK&x.=BOSb0RVTPK1jrzokVLqSVlJZUPzkK&pop=okVLqSVlJZUPzkK&done=&errory=ecnCCHQuw8L&mnemonic=&jb=ecnCCHQuw8L Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
/
bnp-espace.fr-covid19.gq/ |
252 B 699 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ Redirect Chain
|
43 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.10.2.min.js
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/js/ |
91 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.css
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
198 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ajax.googleapis.com/ajax/libs/jquery/1.7.1/ |
92 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ajax.googleapis.com/ajax/libs/jquery/1.4.1/ |
69 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bnp-alone.png
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-print.png
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
686 B 978 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
picto-ident.png
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
23 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite-form.png
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bnpp_type_regular_v2-webfont.woff
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
32 KB 32 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
52021522FTGR5HUEP548IEPA41NJEF.html
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
6 KB 6 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iconbnp.woff
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
81 KB 82 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bnpp_sans-webfont-webfont.woff2
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bnpp_sans_cond_light_v2-webfont.woff
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
22 KB 23 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bnpp_type_bold_v2-webfont.woff
bnp-espace.fr-covid19.gq/connexion/lUGwniJV746/ |
24 KB 24 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNP Paribas (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery string| sfAxes1 string| sfAxes2 string| sfAxes3 string| sfAxes4 string| sfSiteId string| sfCookieErrorPage string| sfCustomerDacLevel function| isNumberKey function| checkhit2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bnp-espace.fr-covid19.gq/ | Name: bp_acess Value: ecnCCHQuw8L |
|
bnp-espace.fr-covid19.gq/ | Name: PHPSESSID Value: 360e619dbc591200599f16f0a32a803a |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bnp-espace.fr-covid19.gq
31.220.105.98
010eddd503a3b3cd606f1b0a09804baf2aae5df1e5d2de85bc9453c868c9207b
0b1b7beabe53bfc029dc6baf6437b11c8944b7f9308548d6ba53bfe46e7abfca
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
13a4288d793f7442b32c5b40162c851a30ba8776b8bd4797c95ca1ee27e4b4d2
2cec78f739fbddfed852cd7934d2530e7cc4c8f14b38673b03ba5fb880ad4cc7
3dfdf449ad6a7f0906d8b51c94ef3cd06a58c641de8969b4e3f8431a65525312
5cfcd47c763f59b765edf88bf251164a95e5e1dbcb5ad4e031a6460a2409d73c
6935aeee017a8da33fa52da1dd852fef33fbd73bc1a07279da5f12a193ed2313
7765b30f55d23c1e9b5da76e6b4bb7129665b9fb7e0ff1f949f51d74a22f93be
81cae87b3b158a1447d6c08c63e25ef54e3efd051bed48345271e3fadb997ce3
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
8a5914aa91aff6db50981ac794d68b868dfecf6909305ab6c568466faa49d366
9be4e951e7efa7691ff602cae10e1ac266533e70cdbb521c5e9effd692ec0be2
d550ddeaf2016388b70c8669310b1bb7e0a1e67be73df38926ad2a61f0bbbe8b
f369aafad7dd64145e15972462e84dbf18ddebf193e594345debcfc8d40c30e8