bnp.paket24.site Open in urlscan Pro
104.21.8.83 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bnp.paket-24.com/
Effective URL:
https://bnp.paket24.site/l/goonline/bnp
Submission: On November 18 via api (November 18th 2024, 7:45:26 am UTC) from PL — Scanned from PL

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 104.21.8.83, located in and belongs to CLOUDFLARENET, US. The main domain is bnp.paket24.site.
TLS certificate: Issued by WE1 on November 17th 2024. Valid for: 3 months.

This is the only time bnp.paket24.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNP Paribas (Banking) Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	162.255.119.67 162.255.119.67	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1 14	104.21.8.83 104.21.8.83	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	2

1 162.255.119.67 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)

bnp.paket-24.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 104.21.8.83 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

bnp.paket24.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	paket24.site 1 redirects bnp.paket24.site	1 MB
1	paket-24.com 1 redirects bnp.paket-24.com	255 B
0	google.com Failed support.google.com Failed
14	3

	Domain	Requested by
14	bnp.paket24.site	1 redirects bnp.paket24.site
1	bnp.paket-24.com	1 redirects
0	support.google.com Failed
14	3

This site contains no links.

Subject Issuer	Validity	Valid
paket24.site WE1	`2024-11-17` - `2025-02-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bnp.paket24.site/l/goonline/bnp
Frame ID: 5EF276AE9CA5F4BF554E87E861EE6570
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Zaloguj się do GOonline | BNP Paribas Bank Polska S.A.

Page URL History Show full URLs

http://bnp.paket-24.com/ HTTP 307
https://bnp.paket-24.com/ HTTP 307
http://bnp.paket-24.com/ HTTP 302
https://bnp.paket24.site/l/goonline/bnp Page URL
https://bnp.paket24.site/cdn-cgi/phish-bypass?atok=.KpyGsomAretXi0ysoOLoIO.7hUYCguFkkgEpJfZPlE-173191... HTTP 301
https://bnp.paket24.site/l/goonline/bnp Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

93 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

1608 kB
Transfer

4015 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bnp.paket-24.com/ HTTP 307
https://bnp.paket-24.com/ HTTP 307
http://bnp.paket-24.com/ HTTP 302
https://bnp.paket24.site/l/goonline/bnp Page URL
https://bnp.paket24.site/cdn-cgi/phish-bypass?atok=.KpyGsomAretXi0ysoOLoIO.7hUYCguFkkgEpJfZPlE-1731915914-0.0.1.1-%2Fl%2Fgoonline%2Fbnp HTTP 301
https://bnp.paket24.site/l/goonline/bnp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://bnp.paket-24.com/ HTTP 307
https://bnp.paket-24.com/ HTTP 307
http://bnp.paket-24.com/ HTTP 302
https://bnp.paket24.site/l/goonline/bnp

Request Chain 3

https://bnp.paket24.site/favicon.ico HTTP 302
https://support.google.com/

14 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

403

bnp Show response
bnp.paket24.site/l/goonline/
Redirect Chain

http://bnp.paket-24.com/
https://bnp.paket-24.com/
http://bnp.paket-24.com/
https://bnp.paket24.site/l/goonline/bnp

4 KB
2 KB

151ms
38ms

Document
text/html

104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bnp.paket24.site/l/goonline/bnp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e01a813805592b583aafeb0d710d6389d4777cca55dc555e21c69378a009cfa6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8e4657014cfcc3f6-WAW
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 18 Nov 2024 07:45:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=94QMdcsm2H091q6XqyS4C5bbq9I7BaMs3KYxUxVK7WA%2FXDA%2FIJbx7PpXYnICqBji0WUqc4qkAoa8wa8oRHjZizGCLm%2BFek5TyneASRo%2BqbkFeBW7dB3pFXR9iY4rLijegtM9"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

Connection: keep-alive
Content-Length: 62
Content-Type: text/html; charset=utf-8
Date: Mon, 18 Nov 2024 07:45:14 GMT
Location: https://bnp.paket24.site/l/goonline/bnp
Server: namecheap-nginx
X-Served-By: Namecheap URL Forward

GET
H2 200 cf.errors.css
bnp.paket24.site/cdn-cgi/styles/ 23 KB
5 KB 41ms
41ms Stylesheet
text/css 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bnp.paket24.site/cdn-cgi/styles/cf.errors.css

Requested by

Host: bnp.paket24.site
URL: https://bnp.paket24.site/l/goonline/bnp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bnp.paket24.site/l/goonline/bnp

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"673379a7-5df3"
x-content-type-options: nosniff
cf-ray: 8e465701ad7cc3f6-WAW
expires: Mon, 18 Nov 2024 09:45:14 GMT
date: Mon, 18 Nov 2024 07:45:14 GMT
content-type: text/css
last-modified: Tue, 12 Nov 2024 15:52:07 GMT
server: cloudflare
x-frame-options: DENY

GET
H2 200 icon-exclamation.png
bnp.paket24.site/cdn-cgi/images/ 452 B
541 B 30ms
29ms Image
image/png 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bnp.paket24.site/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: bnp.paket24.site
URL: https://bnp.paket24.site/cdn-cgi/styles/cf.errors.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bnp.paket24.site/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "673379a7-1c4"
x-content-type-options: nosniff
cf-ray: 8e4657022e12c3f6-WAW
expires: Mon, 18 Nov 2024 09:45:14 GMT
accept-ranges: bytes
content-length: 452
date: Mon, 18 Nov 2024 07:45:14 GMT
content-type: image/png
last-modified: Tue, 12 Nov 2024 15:52:07 GMT
server: cloudflare
x-frame-options: DENY

GET

/
support.google.com/
Redirect Chain

https://bnp.paket24.site/favicon.ico
https://support.google.com/

0
0

GET
H2

200

Primary Request bnp Show response
bnp.paket24.site/l/goonline/
Redirect Chain

https://bnp.paket24.site/cdn-cgi/phish-bypass?atok=.KpyGsomAretXi0ysoOLoIO.7hUYCguFkkgEpJfZPlE-1731915914-0.0.1.1-%2Fl%2Fgoonline%2Fbnp
https://bnp.paket24.site/l/goonline/bnp

99 KB
68 KB

1961ms
1960ms

Document
text/html

104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/l/goonline/bnp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07b32a18a8f5e702140c8068071a52f4a0a4bb775e5ff29cf6c48a93f791774f

Request headers

Referer: https://bnp.paket24.site/l/goonline/bnp
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8e46571a7c0ec3f6-WAW
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Mon, 18 Nov 2024 07:45:20 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v3BR8WZUDzZSqSK0KWPot1IFaemUOVBBYutDH6KYztAcAW%2Ftj9g7%2FuUpT0%2FCS8hSSMXDvcDDijEvuR1r4DcfmNqzoO5kwTihgHzbKMiPXgbc6IOX0Styzu5fbrA4amVHY4uh"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=3183&sent=29&recv=28&lost=0&retrans=0&sent_bytes=12850&recv_bytes=3117&delivery_rate=11947194&cwnd=257&unsent_bytes=0&cid=c939826fca907b37&ts=5994&x=0"
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache
cf-ray: 8e46571a0b9ac3f6-WAW
content-length: 167
content-type: text/html
date: Mon, 18 Nov 2024 07:45:18 GMT
location: https://bnp.paket24.site/l/goonline/bnp
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 dUfLSBq5lB.css
bnp.paket24.site/x1daq5b5Xy/19h72VB4nD/ 3 MB
1 MB 46ms
45ms Stylesheet
text/css 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/x1daq5b5Xy/19h72VB4nD/dUfLSBq5lB.css
Requested by: Host: bnp.paket24.site
URL: https://bnp.paket24.site/l/goonline/bnp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3bd1792eb695e5c3f13dad6eb0871e6d59a955772779ce12ccaeca7402dc9118

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bnp.paket24.site/l/goonline/bnp

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "2be70e-62721ed31f26a-gzip"
age: 1380
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yvuab%2BP0HsObCp0vWW3qYu9rHBAV5x5LgUFrQWaZzW2sZkWjKAymJh8616e9uR0FqQOOvq%2FnLdpWKBXj2NMOGf89QoVcBgmBiTl8aLDs9fn8oECh2HNcsv48elzOPEelLRgS"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=27413&sent=13&recv=12&lost=0&retrans=0&sent_bytes=5319&recv_bytes=5409&delivery_rate=531&cwnd=12000&unsent_bytes=0&cid=e7b44de21576df16&ts=2056&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 18 Nov 2024 07:45:20 GMT
content-type: text/css
last-modified: Sun, 17 Nov 2024 20:48:47 GMT
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e465726ca8ebf60-WAW
server: cloudflare

GET
H3 200 XCstNHd5B1.css
bnp.paket24.site/x1daq5b5Xy/19h72VB4nD/ 799 B
1 KB 43ms
42ms Stylesheet
text/css 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/x1daq5b5Xy/19h72VB4nD/XCstNHd5B1.css
Requested by: Host: bnp.paket24.site
URL: https://bnp.paket24.site/l/goonline/bnp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b539410b059ae2934225ff7a9bcdedbfb8f47df3f2621fa2f2a468c965acc3da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bnp.paket24.site/l/goonline/bnp

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "31f-62721ed312b32-gzip"
age: 1380
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zxxbkpI2ESZ9%2FTUeebPmqWGiYzp5TTwbXvDvZyJqsNFJwRatFCrYgubGlwc1l1a9JZQnFnbbHBSj2knRVRxtBK4HpxGtQdarKZeEDR%2B0Gtsv0whj5jf7e%2FJJvfx9KnwWYIvq"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=27413&sent=12&recv=12&lost=0&retrans=0&sent_bytes=4249&recv_bytes=5409&delivery_rate=531&cwnd=12000&unsent_bytes=0&cid=e7b44de21576df16&ts=2054&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 18 Nov 2024 07:45:20 GMT
content-type: text/css
last-modified: Sun, 17 Nov 2024 20:48:47 GMT
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e465726ca93bf60-WAW
accept-ranges: bytes
content-length: 349
server: cloudflare

GET
H3 200 jquery-3.6.0.js Show response
bnp.paket24.site/x1daq5b5Xy/ 282 KB
84 KB 242ms
241ms Script
text/javascript 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/x1daq5b5Xy/jquery-3.6.0.js
Requested by: Host: bnp.paket24.site
URL: https://bnp.paket24.site/l/goonline/bnp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9856e0749047f019da1a6d5d35c84a33df43ca36528b5aff50163b0c1e12cfb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bnp.paket24.site
Referer: https://bnp.paket24.site/l/goonline/bnp

Response headers

server: cloudflare
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
cf-cache-status: EXPIRED
etag: "46755-62721ed310422-gzip"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ed%2BUXHIAPUGEFQMZhkRvSFb3iPT869fDKDMLe7X9N%2BCE0OuwaeE8qj4LknAK8Ux9VsY8rX62bNvl3PRnpF%2FqSg6jfzPsPhT%2BEfyBtPC5coKb2YKKWSvyuMmpZq4LKRLx7Pfp"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e465726ca96bf60-WAW
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=27364&sent=214&recv=62&lost=0&retrans=0&sent_bytes=244119&recv_bytes=8342&delivery_rate=2003193&cwnd=108000&unsent_bytes=0&cid=e7b44de21576df16&ts=2176&x=1", cfExtPri, cfHdrFlush;dur=6
date: Mon, 18 Nov 2024 07:45:20 GMT
content-type: text/javascript
last-modified: Sun, 17 Nov 2024 20:48:47 GMT
vary: Accept-Encoding
priority: u=1,i=?0

GET
H3 200 main.js Show response
bnp.paket24.site/x1daq5b5Xy/ 4 KB
2 KB 192ms
192ms Script
text/javascript 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/x1daq5b5Xy/main.js
Requested by: Host: bnp.paket24.site
URL: https://bnp.paket24.site/l/goonline/bnp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb2a69b1987cb321d4aca58a2e205c269d6093cdcb51cd77af53bce2357d036e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bnp.paket24.site/l/goonline/bnp

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "fad-62721ed32197a-gzip"
age: 1380
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sOKIvhvZStqLDBzxleisxfkjxKdxatbMBEq1jHxBDJxFkz2E5U79WpXKlH9dqNQ2EbfWlfTfus2XHnwNdIAw%2BrrqmGPvNkklww%2BOs%2BcxrAr3ERwGAytUQ%2Bqc6X6BKMvUZb%2Fg"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=34768&sent=44&recv=19&lost=0&retrans=0&sent_bytes=40249&recv_bytes=6458&delivery_rate=296135&cwnd=24000&unsent_bytes=0&cid=e7b44de21576df16&ts=2106&x=1", cfExtPri, cfHdrFlush;dur=4
date: Mon, 18 Nov 2024 07:45:20 GMT
content-type: text/javascript
last-modified: Sun, 17 Nov 2024 20:48:47 GMT
vary: Accept-Encoding
priority: u=1,i=?0
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e4657271b07bf60-WAW
accept-ranges: bytes
content-length: 1184
server: cloudflare

GET
H3 200 zbOpgFZYwm.js Show response
bnp.paket24.site/x1daq5b5Xy/19h72VB4nD/ 7 KB
2 KB 192ms
192ms Script
text/javascript 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/x1daq5b5Xy/19h72VB4nD/zbOpgFZYwm.js
Requested by: Host: bnp.paket24.site
URL: https://bnp.paket24.site/l/goonline/bnp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f195626a24fbd46148de60ff1ad7f752c307a6637749ad7b1f66dae938a64404

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://bnp.paket24.site/l/goonline/bnp

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "1c99-62721ed314e5a-gzip"
age: 1380
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y8yLbmJTgOTf%2B54kcYrbJhk1dXllT0sLj1uoQ%2FCZDQkQYP7einC0VhJafT2FP6P7c6TA3PmJKEiUVlib0A6KolkTjNDxiogjAPFYdkBVmPW8hLzhmIGLH7hNaqwPvK4j0Z%2BW"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=29504&sent=79&recv=28&lost=0&retrans=0&sent_bytes=82119&recv_bytes=6845&delivery_rate=530648&cwnd=44400&unsent_bytes=0&cid=e7b44de21576df16&ts=2111&x=1", cfExtPri, cfHdrFlush;dur=9
date: Mon, 18 Nov 2024 07:45:20 GMT
content-type: text/javascript
last-modified: Sun, 17 Nov 2024 20:48:47 GMT
vary: Accept-Encoding
priority: u=1,i=?0
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e4657271b0abf60-WAW
accept-ranges: bytes
content-length: 1677
server: cloudflare

GET
DATA 200
OK truncated
/ 30 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e7dd3fde94008deeec92db7fc12e691d1710fb869652bb91e8c47977d23f357

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 35 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e49ac7caf7eced0a3b2cf453eaf56d6ccfe1360ebdeee38159e63883360688ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 22 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 88f246e3938e92d4b1a93b93cf636c856a302f4ace772ef42591d877ee5ef5d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 490 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 88f2f32e046ea812a5607ebcc895f0bab1561cd09346e5f1b20f90fd813a6268

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 252 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ce198ebb9d21b8485609a5cb1c46c625e8070f2e1c2404134dc4c16ddc9f4327

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 69d0396ad6ad2716e3cb74ef58891ed26896b9704eadda4d2bb325ba2de4feaa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 54 KB
54 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 80bf8cdea9bc8b01b1b12f18210a7eb3b5f30fefa0d9f9209813d9f9cfe6e39e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bnp.paket24.site
Referer

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 31 KB
31 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0a8b9451b8de67589fa2e8caa96cd7aee975b208815adad986ce256f060b490e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bnp.paket24.site
Referer

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 27 KB
27 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b819ba1ca6fb58d0838c232a9a9f4de58743ed0112f135cffd73b07475ae77d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bnp.paket24.site
Referer

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 54 KB
54 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ad317867dbc668f3e6dacfa4c17870a9affaa520346201b394810564e214e7c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bnp.paket24.site
Referer

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 36 KB
36 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c51282549720e2ef8e9b6d2c2dc535e9cca0e332ceb0fbc21a315dfb3e269224

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://bnp.paket24.site
Referer

Response headers

Content-Type: font/woff

POST
H3 200 get Show response
bnp.paket24.site/page/ 614 B
1 KB 284ms
283ms XHR
text/html 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/page/get
Requested by: Host: bnp.paket24.site
URL: https://bnp.paket24.site/x1daq5b5Xy/jquery-3.6.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 376b8be674eef120a474b732af74f921a8692419fa75c7534f29a2a5e7d389d1

Request headers

Referer: https://bnp.paket24.site/l/goonline/bnp
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

cache-control: no-store, no-cache, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SDYXyL7YwQbhnZhukETiNrgNRNao2UK1dYWhNEZV4hk0kC%2Bd4d58zRdKbO5CHVTmUOhOdXKgyt%2F98rL%2FpIgtqlHk29EjWu8Aua8n4kr2Cd0S944uzPSlN8Uhuo0DxkcSdp5f"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e465729cecebf60-WAW
expires: Thu, 19 Nov 1981 08:52:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28397&sent=1180&recv=173&lost=0&retrans=0&sent_bytes=1395075&recv_bytes=13848&delivery_rate=22673877&cwnd=648000&unsent_bytes=0&cid=e7b44de21576df16&ts=2773&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 18 Nov 2024 07:45:21 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

POST
H3 200 heartbeat Show response
bnp.paket24.site/ 0
689 B 434ms
432ms XHR
text/html 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/heartbeat
Requested by: Host: bnp.paket24.site
URL: https://bnp.paket24.site/x1daq5b5Xy/jquery-3.6.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bnp.paket24.site/l/goonline/bnp
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

cache-control: no-store, no-cache, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p7zz5P32r83JYiQJojg76eXcKvZUQXqvhvf70uHy5bdv5kTjYQsJWsi7IYyVRtSqpR7WX7plX06ZhLXp0yAiBBf8x%2FK5KDW56dqTm3n390jeLhEi2dvIHu49S2r28UEahZZb"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4657332a19bf60-WAW
expires: Thu, 19 Nov 1981 08:52:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28184&sent=1182&recv=176&lost=0&retrans=0&sent_bytes=1396171&recv_bytes=14460&delivery_rate=3723&cwnd=648000&unsent_bytes=0&cid=e7b44de21576df16&ts=4425&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 18 Nov 2024 07:45:22 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
priority: u=1,i

POST
H3 200 heartbeat Show response
bnp.paket24.site/ 0
689 B 384ms
383ms XHR
text/html 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/heartbeat
Requested by: Host: bnp.paket24.site
URL: https://bnp.paket24.site/x1daq5b5Xy/jquery-3.6.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bnp.paket24.site/l/goonline/bnp
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

cache-control: no-store, no-cache, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fCr0cSQ6Xjzj73Zf0G2LI12ZHJwIkdhtz6YUoS3C5IHV%2FfbmIjclzLjKP6jwbA488vs8RUsiTZEc6sQb6P6dd52FvxULBGBli90qPfFrYdjroWz3dx7TvDEyXfJ4U1nvIBLt"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e46573c8d9dbf60-WAW
expires: Thu, 19 Nov 1981 08:52:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28006&sent=1184&recv=179&lost=0&retrans=0&sent_bytes=1396907&recv_bytes=15072&delivery_rate=1627&cwnd=648000&unsent_bytes=0&cid=e7b44de21576df16&ts=5877&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 18 Nov 2024 07:45:24 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
priority: u=1,i

POST
H3 200 heartbeat Show response
bnp.paket24.site/ 0
693 B 412ms
411ms XHR
text/html 104.21.8.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bnp.paket24.site/heartbeat
Requested by: Host: bnp.paket24.site
URL: https://bnp.paket24.site/x1daq5b5Xy/jquery-3.6.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.8.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bnp.paket24.site/l/goonline/bnp
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

cache-control: no-store, no-cache, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZiMQhj4ls%2FuyijTTM84iviF3WfjpHxJKjybOWMY1DQkkx5Iku3JKsrFO1hrNHBcyg53oNLsEUfcgozvy6Q%2FcGNUq3wPsy8xnDVK9%2BTJOz2KHwaUiZK6queIZNAdEXB5HiEzt"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e465745e8fabf60-WAW
expires: Thu, 19 Nov 1981 08:52:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=27841&sent=1187&recv=182&lost=0&retrans=0&sent_bytes=1397668&recv_bytes=15684&delivery_rate=1836&cwnd=648000&unsent_bytes=0&cid=e7b44de21576df16&ts=7404&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 18 Nov 2024 07:45:25 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
priority: u=1,i

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: support.google.com
URL: https://support.google.com/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNP Paribas (Banking) Generic Cloudflare (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			bnp.paket24.site/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3j27n0ajjpggofjs22mjmbfftl
			.bnp.paket24.site/	1970-01-21 01:06:42	Name: __cf_mw_byp Value: .KpyGsomAretXi0ysoOLoIO.7hUYCguFkkgEpJfZPlE-1731915914-0.0.1.1-/l/goonline/bnp

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bnp.paket24.site/l/goonline/bnp Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bnp.paket-24.com
bnp.paket24.site
support.google.com
support.google.com
104.21.8.83
162.255.119.67
07b32a18a8f5e702140c8068071a52f4a0a4bb775e5ff29cf6c48a93f791774f
0a8b9451b8de67589fa2e8caa96cd7aee975b208815adad986ce256f060b490e
376b8be674eef120a474b732af74f921a8692419fa75c7534f29a2a5e7d389d1
3ad317867dbc668f3e6dacfa4c17870a9affaa520346201b394810564e214e7c
3bd1792eb695e5c3f13dad6eb0871e6d59a955772779ce12ccaeca7402dc9118
69d0396ad6ad2716e3cb74ef58891ed26896b9704eadda4d2bb325ba2de4feaa
6b819ba1ca6fb58d0838c232a9a9f4de58743ed0112f135cffd73b07475ae77d
80bf8cdea9bc8b01b1b12f18210a7eb3b5f30fefa0d9f9209813d9f9cfe6e39e
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
88f246e3938e92d4b1a93b93cf636c856a302f4ace772ef42591d877ee5ef5d5
88f2f32e046ea812a5607ebcc895f0bab1561cd09346e5f1b20f90fd813a6268
9e7dd3fde94008deeec92db7fc12e691d1710fb869652bb91e8c47977d23f357
b539410b059ae2934225ff7a9bcdedbfb8f47df3f2621fa2f2a468c965acc3da
b9856e0749047f019da1a6d5d35c84a33df43ca36528b5aff50163b0c1e12cfb
bb2a69b1987cb321d4aca58a2e205c269d6093cdcb51cd77af53bce2357d036e
c51282549720e2ef8e9b6d2c2dc535e9cca0e332ceb0fbc21a315dfb3e269224
ce198ebb9d21b8485609a5cb1c46c625e8070f2e1c2404134dc4c16ddc9f4327
e01a813805592b583aafeb0d710d6389d4777cca55dc555e21c69378a009cfa6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e49ac7caf7eced0a3b2cf453eaf56d6ccfe1360ebdeee38159e63883360688ea
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f195626a24fbd46148de60ff1ad7f752c307a6637749ad7b1f66dae938a64404

bnp.paket24.site Open in urlscan Pro 104.21.8.83 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

93 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

1608 kBTransfer

4015 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

2 Cookies

1 Console Messages

bnp.paket24.site Open in urlscan Pro
104.21.8.83 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

93 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

1608 kB
Transfer

4015 kB
Size

2
Cookies

14 HTTP transactions
11 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!