bnp.fod-mijnoverheid.live
Open in
urlscan Pro
198.54.120.226
Malicious Activity!
Public Scan
Submission: On June 12 via manual from NL
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 12th 2020. Valid for: a year.
This is the only time bnp.fod-mijnoverheid.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNP Paribas (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 19 | 198.54.120.226 198.54.120.226 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 171.18.26.21 171.18.26.21 | 43722 (ATNEDC-AS) (ATNEDC-AS) | |
20 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium59-3.web-hosting.com
bnp.fod-mijnoverheid.live |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
fod-mijnoverheid.live
2 redirects
bnp.fod-mijnoverheid.live |
233 KB |
2 |
axa.be
www.axa.be |
11 KB |
1 |
jquery.com
code.jquery.com |
81 KB |
20 | 3 |
Domain | Requested by | |
---|---|---|
19 | bnp.fod-mijnoverheid.live |
2 redirects
bnp.fod-mijnoverheid.live
code.jquery.com |
2 | www.axa.be |
bnp.fod-mijnoverheid.live
|
1 | code.jquery.com |
bnp.fod-mijnoverheid.live
|
20 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
vimeo.com |
www.itsme.be |
easybankingbusiness.bnpparibasfortis.be |
Subject Issuer | Validity | Valid | |
---|---|---|---|
bnp.fod-mijnoverheid.live Sectigo RSA Domain Validation Secure Server CA |
2020-06-12 - 2021-06-12 |
a year | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
www.axa.be DigiCert SHA2 High Assurance Server CA |
2020-02-03 - 2021-02-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://bnp.fod-mijnoverheid.live/login
Frame ID: 1C72B530F587FD5FA133F3426B4CE224
Requests: 20 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
Title: instructies om een eerste keer aan te melden
Search URL Search Domain Scan URL
Title: dit filmpje
Search URL Search Domain Scan URL
Title: via hun website
Search URL Search Domain Scan URL
Title: Easy Banking Business
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://bnp.fod-mijnoverheid.live/public/bnp/css/images/print_logo.png HTTP 302
- https://www.axa.be/404
- https://bnp.fod-mijnoverheid.live/public/bnp/css/images/hello_icon.png HTTP 302
- https://www.axa.be/404
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
bnp.fod-mijnoverheid.live/ |
224 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp-fortis.css
bnp.fod-mijnoverheid.live/public/bnp/css/ |
474 KB 81 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp-fortis-pws.css
bnp.fod-mijnoverheid.live/public/bnp/css/ |
127 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp-fortis-patch.css
bnp.fod-mijnoverheid.live/public/bnp/css/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.4.1.js
code.jquery.com/ |
274 KB 81 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sprite.svg
bnp.fod-mijnoverheid.live/public/bnp/img/ |
83 KB 26 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpiconfont.ttf
bnp.fod-mijnoverheid.live/public/bnp/font/ |
53 KB 32 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp_sans-webfont.ttf
bnp.fod-mijnoverheid.live/public/bnp/font/ |
55 KB 28 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnpp_sans_light-webfont.ttf
bnp.fod-mijnoverheid.live/public/bnp/font/ |
56 KB 27 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
404
www.axa.be/ Redirect Chain
|
4 KB 4 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
404
www.axa.be/ Redirect Chain
|
7 KB 7 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
bnp.fod-mijnoverheid.live/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
bnp.fod-mijnoverheid.live/ |
0 259 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
bnp.fod-mijnoverheid.live/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
bnp.fod-mijnoverheid.live/ |
0 259 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
bnp.fod-mijnoverheid.live/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
bnp.fod-mijnoverheid.live/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
bnp.fod-mijnoverheid.live/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
bnp.fod-mijnoverheid.live/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
bnp.fod-mijnoverheid.live/ |
0 259 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNP Paribas (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery number| interval function| doAjax1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bnp.fod-mijnoverheid.live/ | Name: PHPSESSID Value: b19e524be99ddeb4f4e3bca410e8d646 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bnp.fod-mijnoverheid.live
code.jquery.com
www.axa.be
171.18.26.21
198.54.120.226
2001:4de0:ac19::1:b:1a
2c2855c04a6b53685b712a704efa7a68bb08abf428c0a2e81d991df5de27e31c
43eaedd3523a071f0de1d520ed7b18d5eee105d9b03578fbcec8c597b6376b23
52be8749a3b6c06541697acee214d359b908dc00fa34334fb4c93fd36b017a93
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
60a1ce266a5ccb14551a31408b149f1c5dbb156a445985c563513ee5b7269457
763702202ca55d8a9b0b76b86e539531fe5e17c21fe4034fc9781dc56162f800
89082fff0bb9043bac439d0415d31859e1aaffade37922b8e9b0cd3a0ff8107e
9322088a1e52f1e178ebca61e4495e15cd94adef3e7d627d1d311ab56a5b9143
ce3e0edd3629a02c4e3865f7ff0051bb1d48b37451dedf587f2fa151ca2f855f
cf988862821f843674b29a4947f93ec10e1778a790469e16222af7fc8728828e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e99439c1fbaa3e387647321a64bdb626a9732931c5ce7bfad2a544b7555640