leboncoininfo.serveirc.com Open in urlscan Pro
185.216.25.90  Malicious Activity! Public Scan

URL: https://leboncoininfo.serveirc.com/
Submission: On January 17 via automatic, source certstream-suspicious

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 185.216.25.90, located in Vélizy-Villacoublay, France and belongs to NETRIX-AS Netrix, FR. The main domain is leboncoininfo.serveirc.com.
TLS certificate: Issued by R3 on January 17th 2021. Valid for: 3 months.
This is the only time leboncoininfo.serveirc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Leboncoin (E-commerce)

Domain & IP information

IP Address AS Autonomous System
4 185.216.25.90 62000 (NETRIX-AS...)
8 15.237.136.102 16509 (AMAZON-02)
12 2
Apex Domain
Subdomains
Transfer
8 leboncoin.fr
auth.leboncoin.fr
129 KB
4 serveirc.com
leboncoininfo.serveirc.com
13 KB
12 2
Domain Requested by
8 auth.leboncoin.fr leboncoininfo.serveirc.com
4 leboncoininfo.serveirc.com leboncoininfo.serveirc.com
12 2

This site contains links to these domains. Also see Links.

Domain
leboncoin.fr
auth.leboncoin.fr
Subject Issuer Validity Valid
leboncoininfo.serveirc.com
R3
2021-01-17 -
2021-04-17
3 months crt.sh
*.leboncoin.fr
Gandi Standard SSL CA 2
2019-03-28 -
2021-04-18
2 years crt.sh

This page contains 1 frames:

Primary Page: https://leboncoininfo.serveirc.com/
Frame ID: 1BB5DF41B9A033E0AC8157B98BCF4CCC
Requests: 12 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • html /<[^>]+data-react/i

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

142 kB
Transfer

149 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
leboncoininfo.serveirc.com/
12 KB
4 KB
Document
General
Full URL
https://leboncoininfo.serveirc.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.216.25.90 Vélizy-Villacoublay, France, ASN62000 (NETRIX-AS Netrix, FR),
Reverse DNS
Software
nginx / PHP/7.4.14 PleskLin
Resource Hash
377d8a7facea817f6f80514a568bbeafbf2130a9f50cc0747c62fe37de93fda1

Request headers

:method
GET
:authority
leboncoininfo.serveirc.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx
date
Sun, 17 Jan 2021 10:49:06 GMT
content-type
text/html; charset=UTF-8
content-length
3473
x-powered-by
PHP/7.4.14 PleskLin
vary
Accept-Encoding
content-encoding
gzip
login.js
auth.leboncoin.fr/lbcconnect/_next/static/A8DghhIahe3PJ1v88nNF5/pages/
0
0
Script
General
Full URL
https://auth.leboncoin.fr/lbcconnect/_next/static/A8DghhIahe3PJ1v88nNF5/pages/login.js
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
15.237.136.102 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-136-102.eu-west-3.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

webpack-59d8ca890865083962d3.js
auth.leboncoin.fr/lbcconnect/_next/static/runtime/
0
0
Script
General
Full URL
https://auth.leboncoin.fr/lbcconnect/_next/static/runtime/webpack-59d8ca890865083962d3.js
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
15.237.136.102 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-136-102.eu-west-3.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

commons.4914f0cae572c563e476.js
auth.leboncoin.fr/lbcconnect/_next/static/chunks/
0
0
Script
General
Full URL
https://auth.leboncoin.fr/lbcconnect/_next/static/chunks/commons.4914f0cae572c563e476.js
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
15.237.136.102 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-136-102.eu-west-3.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

main-ac8636ac49790171fdee.js
auth.leboncoin.fr/lbcconnect/_next/static/runtime/
0
0
Script
General
Full URL
https://auth.leboncoin.fr/lbcconnect/_next/static/runtime/main-ac8636ac49790171fdee.js
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
15.237.136.102 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-136-102.eu-west-3.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

lbc-logo.svg
auth.leboncoin.fr/lbcconnect/static/
3 KB
2 KB
Image
General
Full URL
https://auth.leboncoin.fr/lbcconnect/static/lbc-logo.svg
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
15.237.136.102 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-136-102.eu-west-3.compute.amazonaws.com
Software
/
Resource Hash
755edc5b26465da4ea363e856963e39ce975702797eb1d16e1aa7cbee5110861
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'self'; img-src 'self' *.ati-host.net; font-src 'self'; form-action 'self'; object-src 'none'; base-uri 'none'; child-src 'none'; frame-src 'none'; media-src 'none'; worker-src 'none'; frame-ancestors 'none'; default-src 'self' *.bon-coin.net api.leboncoin.fr *.leboncoin.lan *.leboncoin.ci; style-src 'unsafe-inline' 'self';
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 17 Jan 2021 10:49:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 13 Jan 2021 13:55:08 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
image/svg+xml
Vary
Accept-Encoding
Cache-control
no-store
Transfer-Encoding
chunked
Content-Security-Policy
script-src 'unsafe-inline' 'self'; img-src 'self' *.ati-host.net; font-src 'self'; form-action 'self'; object-src 'none'; base-uri 'none'; child-src 'none'; frame-src 'none'; media-src 'none'; worker-src 'none'; frame-ancestors 'none'; default-src 'self' *.bon-coin.net api.leboncoin.fr *.leboncoin.lan *.leboncoin.ci; style-src 'unsafe-inline' 'self';
Strict-Transport-Security
max-age=15768000
Content-Security-Policy-Report-Only
object-src *.leboncoin.fr; frame-ancestors *.leboncoin.fr; report-uri https://api.leboncoin.fr/api/csp-report/v1/report/;
X-XSS-Protection
1; mode=block
Referrer-Policy
no-referrer-when-downgrade
verified.svg
auth.leboncoin.fr/lbcconnect/static/
519 B
1 KB
Image
General
Full URL
https://auth.leboncoin.fr/lbcconnect/static/verified.svg
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
15.237.136.102 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-136-102.eu-west-3.compute.amazonaws.com
Software
/
Resource Hash
96aaf64f668c921ed72694e8dac9128ec6b43da1fa1da32e95b61911f946aada
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'self'; img-src 'self' *.ati-host.net; font-src 'self'; form-action 'self'; object-src 'none'; base-uri 'none'; child-src 'none'; frame-src 'none'; media-src 'none'; worker-src 'none'; frame-ancestors 'none'; default-src 'self' *.bon-coin.net api.leboncoin.fr *.leboncoin.lan *.leboncoin.ci; style-src 'unsafe-inline' 'self';
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 17 Jan 2021 10:49:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 13 Jan 2021 13:55:08 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
image/svg+xml
Vary
Accept-Encoding
Cache-control
no-store
Transfer-Encoding
chunked
Content-Security-Policy
script-src 'unsafe-inline' 'self'; img-src 'self' *.ati-host.net; font-src 'self'; form-action 'self'; object-src 'none'; base-uri 'none'; child-src 'none'; frame-src 'none'; media-src 'none'; worker-src 'none'; frame-ancestors 'none'; default-src 'self' *.bon-coin.net api.leboncoin.fr *.leboncoin.lan *.leboncoin.ci; style-src 'unsafe-inline' 'self';
Strict-Transport-Security
max-age=15768000
Content-Security-Policy-Report-Only
object-src *.leboncoin.fr; frame-ancestors *.leboncoin.fr; report-uri https://api.leboncoin.fr/api/csp-report/v1/report/;
X-XSS-Protection
1; mode=block
Referrer-Policy
no-referrer-when-downgrade
_app.js
auth.leboncoin.fr/lbcconnect/_next/static/A8DghhIahe3PJ1v88nNF5/pages/
0
0
Script
General
Full URL
https://auth.leboncoin.fr/lbcconnect/_next/static/A8DghhIahe3PJ1v88nNF5/pages/_app.js
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
15.237.136.102 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-136-102.eu-west-3.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

login-illustration.png
auth.leboncoin.fr/lbcconnect/static/
125 KB
126 KB
Image
General
Full URL
https://auth.leboncoin.fr/lbcconnect/static/login-illustration.png
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
15.237.136.102 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-136-102.eu-west-3.compute.amazonaws.com
Software
/
Resource Hash
b4bd7ddb3091012d6e263aea4479027125254cf1fdc98aed6a99807bb79a08ef
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'self'; img-src 'self' *.ati-host.net; font-src 'self'; form-action 'self'; object-src 'none'; base-uri 'none'; child-src 'none'; frame-src 'none'; media-src 'none'; worker-src 'none'; frame-ancestors 'none'; default-src 'self' *.bon-coin.net api.leboncoin.fr *.leboncoin.lan *.leboncoin.ci; style-src 'unsafe-inline' 'self';
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 17 Jan 2021 10:49:06 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 13 Jan 2021 13:55:08 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-control
no-store
Content-Security-Policy
script-src 'unsafe-inline' 'self'; img-src 'self' *.ati-host.net; font-src 'self'; form-action 'self'; object-src 'none'; base-uri 'none'; child-src 'none'; frame-src 'none'; media-src 'none'; worker-src 'none'; frame-ancestors 'none'; default-src 'self' *.bon-coin.net api.leboncoin.fr *.leboncoin.lan *.leboncoin.ci; style-src 'unsafe-inline' 'self';
Strict-Transport-Security
max-age=15768000
Accept-Ranges
bytes
Content-Security-Policy-Report-Only
object-src *.leboncoin.fr; frame-ancestors *.leboncoin.fr; report-uri https://api.leboncoin.fr/api/csp-report/v1/report/;
Content-Length
127924
X-XSS-Protection
1; mode=block
Referrer-Policy
no-referrer-when-downgrade
opensans.woff2
leboncoininfo.serveirc.com/lbcconnect/static/fonts/
9 KB
9 KB
Font
General
Full URL
https://leboncoininfo.serveirc.com/lbcconnect/static/fonts/opensans.woff2
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.216.25.90 Vélizy-Villacoublay, France, ASN62000 (NETRIX-AS Netrix, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Request headers

Origin
https://leboncoininfo.serveirc.com
Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 17 Jan 2021 10:49:06 GMT
last-modified
Tue, 28 Apr 2020 14:28:14 GMT
server
nginx
x-powered-by
PleskLin
etag
"5ea83d7e-23ac"
content-type
font/woff2
accept-ranges
bytes
content-length
9132
opensans-semibold.woff2
leboncoininfo.serveirc.com/lbcconnect/static/fonts/
0
0
Font
General
Full URL
https://leboncoininfo.serveirc.com/lbcconnect/static/fonts/opensans-semibold.woff2
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.216.25.90 Vélizy-Villacoublay, France, ASN62000 (NETRIX-AS Netrix, FR),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Origin
https://leboncoininfo.serveirc.com
Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 17 Jan 2021 10:49:06 GMT
last-modified
Wed, 28 Oct 2020 14:37:23 GMT
server
nginx
accept-ranges
bytes
etag
"328-5b2bc19fcf2ee"
content-length
808
content-type
text/html
opensans-semibold.woff
leboncoininfo.serveirc.com/lbcconnect/static/fonts/
0
0
Font
General
Full URL
https://leboncoininfo.serveirc.com/lbcconnect/static/fonts/opensans-semibold.woff
Requested by
Host: leboncoininfo.serveirc.com
URL: https://leboncoininfo.serveirc.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.216.25.90 Vélizy-Villacoublay, France, ASN62000 (NETRIX-AS Netrix, FR),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Origin
https://leboncoininfo.serveirc.com
Referer
https://leboncoininfo.serveirc.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 17 Jan 2021 10:49:06 GMT
last-modified
Wed, 28 Oct 2020 14:37:23 GMT
server
nginx
accept-ranges
bytes
etag
"328-5b2bc19fcf2ee"
content-length
808
content-type
text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Leboncoin (E-commerce)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

0 Cookies