rapport-client.secur3d.do Open in urlscan Pro
185.220.113.204 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rapport-client.secur3d.do/
Effective URL:
https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775
Submission: On September 09 via automatic, source certstream-suspicious (September 9th 2023, 10:54:53 pm UTC) — Scanned from DE

Summary HTTP 4 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 185.220.113.204, located in Erbil, Iraq and belongs to ZANA-COMPANY, IQ. The main domain is rapport-client.secur3d.do.
TLS certificate: Issued by R3 on September 9th 2023. Valid for: 3 months.

This is the only time rapport-client.secur3d.do was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Postale (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 5	185.220.113.204 185.220.113.204		205371 (ZANA-COMPANY) (ZANA-COMPANY)
4	2

5 185.220.113.204 (Erbil, Iraq) 1 redirects

ASN205371 (ZANA-COMPANY, IQ)

rapport-client.secur3d.do	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	secur3d.do 1 redirects rapport-client.secur3d.do	757 KB
4	1

	Domain	Requested by
5	rapport-client.secur3d.do	1 redirects rapport-client.secur3d.do
4	1

This site contains links to these domains. Also see Links.

Domain
verif-lbp.fr

Subject Issuer	Validity	Valid
rapport-client.secur3d.do R3	`2023-09-09` - `2023-12-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775
Frame ID: 48785A8F8C19D62E624D54EF34DEAB09
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Connexion à l'espace client - La Banque Postale

Page URL History Show full URLs

https://rapport-client.secur3d.do/ HTTP 302
https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1447 kB
Transfer

2232 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://verif-lbp.fr/pstl-log.php

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rapport-client.secur3d.do/ HTTP 302
https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.php Show response rapport-client.secur3d.do/app/ Redirect Chain https://rapport-client.secur3d.do/ https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775	1 MB 684 KB	2113ms 2112ms	Document text/html	185.220.113.204 ZANA-COMPANY
General Check archive.org Show headers Download Go to Full URL https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.220.113.204 Erbil, Iraq, ASN205371 (ZANA-COMPANY, IQ), Reverse DNS Software nginx / PHP/8.0.30 PleskLin Resource Hash `6a00f9dd5cd00530f5be9673ee32aef3f252d2ad0a4d2adc5e9f3206433aafc2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-type text/html; charset=UTF-8 date Sat, 09 Sep 2023 22:54:47 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding x-powered-by PHP/8.0.30 PleskLin Redirect headers cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Sat, 09 Sep 2023 22:54:45 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775 pragma no-cache server nginx x-powered-by PHP/8.0.30 PleskLin
GET H2	200	logo-lbp.png rapport-client.secur3d.do/app/assets/	8 KB 9 KB	95ms 95ms	Image image/png	185.220.113.204 ZANA-COMPANY
General Check archive.org Show headers Download Go to Show image Full URL https://rapport-client.secur3d.do/app/assets/logo-lbp.png Requested by Host: rapport-client.secur3d.do URL: https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.220.113.204 Erbil, Iraq, ASN205371 (ZANA-COMPANY, IQ), Reverse DNS Software nginx / PleskLin Resource Hash `c6573f8959e56e6a621715af791a527f3da7dc0c1abd9377b83f991ccc85a91c` Request headers accept-language de-DE,de;q=0.9 Referer https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Sat, 09 Sep 2023 22:54:48 GMT last-modified Wed, 05 Apr 2023 12:34:00 GMT server nginx etag "642d6ab8-21d8" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 8664
GET DATA	200 OK	truncated /	302 KB 302 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e` Request headers Referer Origin https://rapport-client.secur3d.do accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	302 KB 302 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e` Request headers Referer Origin https://rapport-client.secur3d.do accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type application/x-font-woff
GET H2	200	banksecu.jpg rapport-client.secur3d.do/app/assets/	31 KB 31 KB	102ms 101ms	Image image/jpeg	185.220.113.204 ZANA-COMPANY
General Check archive.org Show headers Download Go to Show image Full URL https://rapport-client.secur3d.do/app/assets/banksecu.jpg Requested by Host: rapport-client.secur3d.do URL: https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.220.113.204 Erbil, Iraq, ASN205371 (ZANA-COMPANY, IQ), Reverse DNS Software nginx / PleskLin Resource Hash `0252c354eb169386cf7fd06b7a98d7a70dca6eb698a7efb68daa5e435ba6d5e0` Request headers accept-language de-DE,de;q=0.9 Referer https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Sat, 09 Sep 2023 22:54:48 GMT last-modified Tue, 04 Jul 2023 12:20:38 GMT server nginx etag "64a40e96-7c4d" x-powered-by PleskLin content-type image/jpeg accept-ranges bytes content-length 31821
GET H2	200	jquery.min.js Show response rapport-client.secur3d.do/app/assets/	127 KB 33 KB	100ms 100ms	Script application/javascript	185.220.113.204 ZANA-COMPANY
General Check archive.org Show headers Download Go to Full URL https://rapport-client.secur3d.do/app/assets/jquery.min.js Requested by Host: rapport-client.secur3d.do URL: https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.220.113.204 Erbil, Iraq, ASN205371 (ZANA-COMPANY, IQ), Reverse DNS Software nginx / PleskLin Resource Hash `cd87a5b22efec1853e85f17119beb43ee5f805b1b64feabf2e13f85058d263a1` Request headers accept-language de-DE,de;q=0.9 Referer https://rapport-client.secur3d.do/app/index.php?&userid=65cbf85add54c2036663df087ff516f7&ue=eab38126d6b1819e54461676cd7e6775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Sat, 09 Sep 2023 22:54:48 GMT content-encoding br last-modified Wed, 05 Apr 2023 16:10:14 GMT server nginx etag W/"642d9d66-1fa12" x-powered-by PleskLin content-type application/javascript
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	75 KB 75 KB		Font application/x-font-ttf
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8f186e57fe440c5c010120c754944a9d5b33e612c3a311dd642435119aafcf70` Request headers Referer Origin https://rapport-client.secur3d.do accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type application/x-font-ttf
GET DATA	200 OK	truncated /	10 KB 10 KB		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a079710e67a906296308d3f4e23f6e8a1bfb326e926af1cf4feeec723c8d4674` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Postale (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			rapport-client.secur3d.do/	1969-12-31 23:59:59	Name: PHPSESSID Value: krfhdcmm2td30f0o2r015lvp7o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

rapport-client.secur3d.do
185.220.113.204
0252c354eb169386cf7fd06b7a98d7a70dca6eb698a7efb68daa5e435ba6d5e0
0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e
5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e
6a00f9dd5cd00530f5be9673ee32aef3f252d2ad0a4d2adc5e9f3206433aafc2
6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a
8f186e57fe440c5c010120c754944a9d5b33e612c3a311dd642435119aafcf70
a079710e67a906296308d3f4e23f6e8a1bfb326e926af1cf4feeec723c8d4674
c6573f8959e56e6a621715af791a527f3da7dc0c1abd9377b83f991ccc85a91c
cd87a5b22efec1853e85f17119beb43ee5f805b1b64feabf2e13f85058d263a1

rapport-client.secur3d.do Open in urlscan Pro 185.220.113.204 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

1447 kBTransfer

2232 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

rapport-client.secur3d.do Open in urlscan Pro
185.220.113.204 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1447 kB
Transfer

2232 kB
Size

1
Cookies

4 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!