bml-nazionale.net
Open in
urlscan Pro
69.163.176.107
Malicious Activity!
Public Scan
Submission: On January 10 via api from NL — Scanned from IT
Summary
TLS certificate: Issued by R3 on January 9th 2024. Valid for: 3 months.
This is the only time bml-nazionale.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNP Paribas (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 69.163.176.107 69.163.176.107 | 26347 (DREAMHOST-AS) (DREAMHOST-AS) | |
3 | 2 |
ASN26347 (DREAMHOST-AS, US)
PTR: vps54094.dreamhostps.com
bml-nazionale.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
bml-nazionale.net
bml-nazionale.net |
344 KB |
3 | 1 |
Domain | Requested by | |
---|---|---|
3 | bml-nazionale.net |
bml-nazionale.net
|
3 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
bnl.it |
lifebanker.bnl.it |
banking.bnl.it |
hellobank.it |
www.acf.consob.it |
www.facebook.com |
twitter.com |
www.youtube.com |
socialwall.bnl.it |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.bml-nazionale.net R3 |
2024-01-09 - 2024-04-08 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/1.php
Frame ID: 8674557428D134E47F4EAB90C98C862D
Requests: 10 HTTP requests in this frame
Frame:
data://truncated
Frame ID: A38932E4FE0521E6A4787F6A8FD15BE6
Requests: 2 HTTP requests in this frame
Frame:
data://truncated
Frame ID: CBAF5DD95E0CE6E54D4DC929DD764816
Requests: 2 HTTP requests in this frame
35 Outgoing links
These are links going to different origins than the main page.
Title: Individui e Famiglie
Search URL Search Domain Scan URL
Title: Private Banking
Search URL Search Domain Scan URL
Title: Life Banker
Search URL Search Domain Scan URL
Title: Financial Banking
Search URL Search Domain Scan URL
Title: Professionisti e Imprese
Search URL Search Domain Scan URL
Title: Corporate
Search URL Search Domain Scan URL
Title: Pubblica Amministrazione
Search URL Search Domain Scan URL
Title: Responsabilita Sociale
Search URL Search Domain Scan URL
Title: Scopri BNL
Search URL Search Domain Scan URL
Title: Diventa Cliente
Search URL Search Domain Scan URL
Title: Dove trovi il tuo numero Cliente
Search URL Search Domain Scan URL
Title: Dove trovi il PIN
Search URL Search Domain Scan URL
Title: Recupera Online il Numero Cliente
Search URL Search Domain Scan URL
Title: Proteggiti dai virus e dalle frodi online
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: DATI SOCIETARI
Search URL Search Domain Scan URL
Title: PROSPETTI CONSOB
Search URL Search Domain Scan URL
Title: RECLAMI-RICORSI-CONCILIAZIONE
Search URL Search Domain Scan URL
Title: WHISTLEBLOWING
Search URL Search Domain Scan URL
Title: RICHIESTA DOCUMENTI
Search URL Search Domain Scan URL
Title: ARBITRO CONTROVERSIE FINANZIARIE
Search URL Search Domain Scan URL
Title: PRIVACY
Search URL Search Domain Scan URL
Title: CARTA RESPONSABILITÀ DATI PERSONALI
Search URL Search Domain Scan URL
Title: NOTE LEGALI
Search URL Search Domain Scan URL
Title: CONTATTI ISTITUZIONALI
Search URL Search Domain Scan URL
Title: PSD2
Search URL Search Domain Scan URL
Title: DAC6
Search URL Search Domain Scan URL
Title: ACCESSIBILITÀ
Search URL Search Domain Scan URL
Title: COOKIE
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
1.php
bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/ |
462 KB 313 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JOJ.js
bml-nazionale.net/it-1FP6X/AT.ENTRIES/CONFIGS/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
CLIENT.php
bml-nazionale.net/it-1FP6X/AT.ENTRIES/FIRST.PAGE.AT/ |
0 62 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
54 KB 54 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
11 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
14 KB 14 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
531 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
54 KB 54 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame A389 |
21 KB 21 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame A389 |
20 KB 20 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
53 KB 53 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
19 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame CBAF |
21 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame CBAF |
20 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNP Paribas (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 object| documentPictureInPicture function| $ function| jQuery number| c function| centerElement boolean| isMobile1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bml-nazionale.net/ | Name: PHPSESSID Value: 99354d2eefd23a4fdb3989c5d493465d |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bml-nazionale.net
69.163.176.107
0ebd476699d79db6b7502538a5088b68ada39af6638f104ddbd06d32f30f8014
237429d1bfff9ad5d7927317c9bf3787ca7fa7e1267563eb95a1159c5d42e957
24b7fc7a5247a3ccb0216515023889adce611b2ca852efd2223509caeb81b9a9
3ad317867dbc668f3e6dacfa4c17870a9affaa520346201b394810564e214e7c
3fde2d1823239ab371b369d738dc26cac41e8e70ab34faf3382e1325ee5fad90
4f37e40f466d79806853f3758a33da54b5df0794d81a070973e9d5d1ae4636a3
7e1c671a99130b71844ea0d14338420e2bffa9ddb525425fc2d09d960dc18e2d
80bf8cdea9bc8b01b1b12f18210a7eb3b5f30fefa0d9f9209813d9f9cfe6e39e
d9356a502a3e4c129bfddb49268c0531dc91c92a868f600cbe322cfa11e68cba
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127
fe6549be2f1ef526f333498418cd2ed3520bd9528f8adbd14be4ba8d7ca84db4