bml-nazionale.net Open in urlscan Pro
69.163.176.107  Malicious Activity! Public Scan

URL: https://bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SIS...
Submission: On January 10 via api from NL — Scanned from IT

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 69.163.176.107, located in Brea, United States and belongs to DREAMHOST-AS, US. The main domain is bml-nazionale.net.
TLS certificate: Issued by R3 on January 9th 2024. Valid for: 3 months.
This is the only time bml-nazionale.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNP Paribas (Banking)

Domain & IP information

IP Address AS Autonomous System
3 69.163.176.107 26347 (DREAMHOST-AS)
3 2
Apex Domain
Subdomains
Transfer
3 bml-nazionale.net
bml-nazionale.net
344 KB
3 1
Domain Requested by
3 bml-nazionale.net bml-nazionale.net
3 1
Subject Issuer Validity Valid
www.bml-nazionale.net
R3
2024-01-09 -
2024-04-08
3 months crt.sh

This page contains 3 frames:

Primary Page: https://bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/1.php
Frame ID: 8674557428D134E47F4EAB90C98C862D
Requests: 10 HTTP requests in this frame

Frame: data://truncated
Frame ID: A38932E4FE0521E6A4787F6A8FD15BE6
Requests: 2 HTTP requests in this frame

Frame: data://truncated
Frame ID: CBAF5DD95E0CE6E54D4DC929DD764816
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

560 kB
Transfer

837 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 1.php
bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/
462 KB
313 KB
Document
General
Full URL
https://bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/1.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.176.107 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
vps54094.dreamhostps.com
Software
Apache /
Resource Hash
fe6549be2f1ef526f333498418cd2ed3520bd9528f8adbd14be4ba8d7ca84db4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
it-IT,it;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 10 Jan 2024 10:37:35 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding,User-Agent
JOJ.js
bml-nazionale.net/it-1FP6X/AT.ENTRIES/CONFIGS/
87 KB
31 KB
Script
General
Full URL
https://bml-nazionale.net/it-1FP6X/AT.ENTRIES/CONFIGS/JOJ.js
Requested by
Host: bml-nazionale.net
URL: https://bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/1.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.176.107 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
vps54094.dreamhostps.com
Software
Apache /
Resource Hash
ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/1.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 10 Jan 2024 10:37:35 GMT
content-encoding
gzip
last-modified
Tue, 15 Mar 2022 22:56:24 GMT
server
Apache
etag
"15d9d-5da49b4c79600-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/javascript
cache-control
max-age=2592000
accept-ranges
bytes
expires
Fri, 09 Feb 2024 10:37:35 GMT
CLIENT.php
bml-nazionale.net/it-1FP6X/AT.ENTRIES/FIRST.PAGE.AT/
0
62 B
XHR
General
Full URL
https://bml-nazionale.net/it-1FP6X/AT.ENTRIES/FIRST.PAGE.AT/CLIENT.php
Requested by
Host: bml-nazionale.net
URL: https://bml-nazionale.net/it-1FP6X/AT.ENTRIES/CONFIGS/JOJ.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.163.176.107 Brea, United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS
vps54094.dreamhostps.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/1.php
X-Requested-With
XMLHttpRequest
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 10 Jan 2024 10:37:36 GMT
server
Apache
vary
User-Agent
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT
truncated
/
54 KB
54 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3ad317867dbc668f3e6dacfa4c17870a9affaa520346201b394810564e214e7c

Request headers

Referer
Origin
https://bml-nazionale.net
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
application/x-font-woff
truncated
/
11 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4f37e40f466d79806853f3758a33da54b5df0794d81a070973e9d5d1ae4636a3

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/png
truncated
/
14 KB
14 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0ebd476699d79db6b7502538a5088b68ada39af6638f104ddbd06d32f30f8014

Request headers

Referer
Origin
https://bml-nazionale.net
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
application/x-font-woff
truncated
/
531 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
237429d1bfff9ad5d7927317c9bf3787ca7fa7e1267563eb95a1159c5d42e957

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/gif
truncated
/
54 KB
54 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
80bf8cdea9bc8b01b1b12f18210a7eb3b5f30fefa0d9f9209813d9f9cfe6e39e

Request headers

Referer
Origin
https://bml-nazionale.net
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
application/x-font-woff
truncated
/ Frame A389
21 KB
21 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7e1c671a99130b71844ea0d14338420e2bffa9ddb525425fc2d09d960dc18e2d

Request headers

Referer
Origin
null
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
text/plain
truncated
/ Frame A389
20 KB
20 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3fde2d1823239ab371b369d738dc26cac41e8e70ab34faf3382e1325ee5fad90

Request headers

Referer
Origin
null
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
text/plain
truncated
/
53 KB
53 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9356a502a3e4c129bfddb49268c0531dc91c92a868f600cbe322cfa11e68cba

Request headers

Referer
Origin
https://bml-nazionale.net
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
application/x-font-woff
truncated
/
19 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24b7fc7a5247a3ccb0216515023889adce611b2ca852efd2223509caeb81b9a9

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/jpeg
truncated
/ Frame CBAF
21 KB
0
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
null
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
text/plain
truncated
/ Frame CBAF
20 KB
0
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
null
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
text/plain

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNP Paribas (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| documentPictureInPicture function| $ function| jQuery number| c function| centerElement boolean| isMobile

1 Cookies

Domain/Path Name / Value
bml-nazionale.net/ Name: PHPSESSID
Value: 99354d2eefd23a4fdb3989c5d493465d

2 Console Messages

Source Level URL
Text
other error URL: https://bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/1.php(Line 535)
Message:
Error while parsing the 'sandbox' attribute: '"allow-popups' is an invalid sandbox flag.
other error URL: https://bml-nazionale.net/it-1FP6X/APP1.149.102.237.130-aSeEI6AMFhOo4VZWXTstfqw7NKpQv3rug2yd0kHRDBJnCz9Pm1LlbGcYxij5U8/SISTEMA.DI.SICUREZZA/1.php(Line 536)
Message:
Error while parsing the 'sandbox' attribute: '"allow-popups' is an invalid sandbox flag.