cgauth-banquepopulaire-fr.info Open in urlscan Pro
108.179.192.159  Malicious Activity! Public Scan

Submitted URL: http://www.slibakilansser.com/portailinternet6854186465/
Effective URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Submission: On September 01 via manual from FR

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 108.179.192.159, located in Houston, United States and belongs to CYRUSONE - CyrusOne LLC, US. The main domain is cgauth-banquepopulaire-fr.info.
This is the only time cgauth-banquepopulaire-fr.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Populaire (Banking)

Domain & IP information

IP Address AS Autonomous System
4 108.179.192.159 20013 (CYRUSONE)
6 217.108.95.244 3215 (AS3215)
1 217.108.95.197 3215 (AS3215)
13 4
Domain Requested by
6 www.icgauth.banquepopulaire.fr cgauth-banquepopulaire-fr.info
4 cgauth-banquepopulaire-fr.info cgauth-banquepopulaire-fr.info
1 www.banquepopulaire.fr cgauth-banquepopulaire-fr.info
0 www.ibps.valdefrance.banquepopulaire.fr Failed cgauth-banquepopulaire-fr.info
0 homgcnaoacgigpkkljjjekpignblkeae Failed cgauth-banquepopulaire-fr.info
13 5
Subject Issuer Validity Valid
www.icgauth.banquepopulaire.fr
thawte SHA256 SSL CA
2017-06-07 -
2018-07-29
a year crt.sh

This page contains 2 frames:

Primary Page: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Frame ID: 21957.1
Requests: 12 HTTP requests in this frame

Frame: https://www.ibps.valdefrance.banquepopulaire.fr/s3f-web/getResource?mod=1
Frame ID: 21957.2
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

13
Requests

46 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

13 kB
Transfer

21 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Redirect Chain
  • http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1
  • http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
10 KB
3 KB
Document
General
Full URL
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Server
108.179.192.159 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS
Software
nginx/1.12.1 /
Resource Hash
d18cb649173416b8a7736245ee778c12481166e37b471e17f5caf4d5922cd69a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Sep 2017 15:36:13 GMT
Server
nginx/1.12.1
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html

Redirect headers

Location
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Date
Fri, 01 Sep 2017 15:36:13 GMT
Server
nginx/1.12.1
Connection
keep-alive
Content-Length
360
Content-Type
text/html; charset=iso-8859-1
app.css
www.icgauth.banquepopulaire.fr/WebSSO_BP/css/
7 KB
7 KB
Stylesheet
General
Full URL
https://www.icgauth.banquepopulaire.fr/WebSSO_BP/css/app.css?v=4
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.108.95.244 , France, ASN3215 (AS3215, FR),
Reverse DNS
Software
Apache/2.2.15 (Red Hat) /
Resource Hash
7e472aa45eae91c4ae078f447160896f35d1b8d10423768387c2a5447e8ec2ca

Request headers

Referer
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Last-Modified
Mon, 23 Jan 2017 12:27:58 GMT
Server
Apache/2.2.15 (Red Hat)
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
none
Keep-Alive
timeout=1, max=300
Content-Length
6793
custom.css
cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
583 B
328 B
Stylesheet
General
Full URL
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/custom.css?v=1
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Server
108.179.192.159 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS
Software
nginx/1.12.1 /
Resource Hash
5d0632f2c3c03ea0fa622050ab33121e91fbf410067b753f6a3d958971c6fc92

Request headers

Referer
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Sep 2017 15:36:13 GMT
Server
nginx/1.12.1
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/css
detector.js
homgcnaoacgigpkkljjjekpignblkeae/
0
0

jsAll.min.js
cgauth-banquepopulaire-fr.info/WebSSO_BP/js/
0
0
Script
General
Full URL
http://cgauth-banquepopulaire-fr.info/WebSSO_BP/js/jsAll.min.js?v=4
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Server
108.179.192.159 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS
Software
nginx/1.12.1 /
Resource Hash

Request headers

Referer
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Content-Encoding
gzip
Last-Modified
Mon, 20 Mar 2017 15:17:51 GMT
Server
nginx/1.12.1
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html
Tetiere.png
www.icgauth.banquepopulaire.fr/WebSSO_BP/img/
249 B
249 B
Image
General
Full URL
https://www.icgauth.banquepopulaire.fr/WebSSO_BP/img/Tetiere.png
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.108.95.244 , France, ASN3215 (AS3215, FR),
Reverse DNS
Software
Apache/2.2.15 (Red Hat) /
Resource Hash
36bc18e95f77982cacb5d8e756faa33fd49665e5e7ec2f5269c28ae0a0701fe5

Request headers

Referer
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/custom.css?v=1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Last-Modified
Wed, 21 Dec 2016 10:26:51 GMT
Server
Apache/2.2.15 (Red Hat)
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=299
Content-Length
249
logo_bp_banque_et_assurance_257x82.png;pv667f173a6cf578ad
www.banquepopulaire.fr/portailinternet/Lists/VisualElementsLogo/
640 B
0
Image
General
Full URL
http://www.banquepopulaire.fr/portailinternet/Lists/VisualElementsLogo/logo_bp_banque_et_assurance_257x82.png;pv667f173a6cf578ad
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Server
217.108.95.197 , France, ASN3215 (AS3215, FR),
Reverse DNS
Software
IWS /
Resource Hash
f23221c99f890528a0b3109dbf31897aaa13d3f9a3b9c32609b4ebe8c3e5c274

Request headers

Referer
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/custom.css?v=1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Sep 2017 15:36:13 GMT
X-MS-InvokeApp
1; RequireReadOnly
X-WA-Info
[V2.S10203.A29.P54510.N36860.RN0.U0].[OT/other.OG/other]
Server
IWS
Content-Type
text/plain
Cache-Control
no-cache, no-store
Public-Extension
http://schemas.microsoft.com/repl-2
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=300
Content-Length
640
Expires
Fri, 01 Sep 2017 15:36:14 GMT
getResource
www.ibps.valdefrance.banquepopulaire.fr/s3f-web/ Frame 2195
0
0

jsAll.min.js
cgauth-banquepopulaire-fr.info/WebSSO_BP/js/
0
0
Script
General
Full URL
http://cgauth-banquepopulaire-fr.info/WebSSO_BP/js/jsAll.min.js?v=4
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Server
108.179.192.159 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS
Software
nginx/1.12.1 /
Resource Hash

Request headers

Referer
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Content-Encoding
gzip
Last-Modified
Mon, 20 Mar 2017 15:17:51 GMT
Server
nginx/1.12.1
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html
footer.gif
www.icgauth.banquepopulaire.fr/WebSSO_BP/img/
316 B
316 B
Image
General
Full URL
https://www.icgauth.banquepopulaire.fr/WebSSO_BP/img/footer.gif
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.108.95.244 , France, ASN3215 (AS3215, FR),
Reverse DNS
Software
Apache/2.2.15 (Red Hat) /
Resource Hash
1a5104ca0fc88376aa14d064c711fc2ad539d46f14d231e14ed350f6c21043ca

Request headers

Referer
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/custom.css?v=1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Last-Modified
Wed, 21 Dec 2016 10:26:49 GMT
Server
Apache/2.2.15 (Red Hat)
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=298
Content-Length
316
footer_logo3D_BP.gif
www.icgauth.banquepopulaire.fr/WebSSO_BP/img/
2 KB
2 KB
Image
General
Full URL
https://www.icgauth.banquepopulaire.fr/WebSSO_BP/img/footer_logo3D_BP.gif
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.108.95.244 , France, ASN3215 (AS3215, FR),
Reverse DNS
Software
Apache/2.2.15 (Red Hat) /
Resource Hash
73b09ac586358c84f79bb1676adcdac30b6c381e45eddbbf0ca9788141cc39e7

Request headers

Referer
http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/custom.css?v=1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Last-Modified
Wed, 21 Dec 2016 10:26:49 GMT
Server
Apache/2.2.15 (Red Hat)
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=300
Content-Length
1536
btn_annuler.png
www.icgauth.banquepopulaire.fr/WebSSO_BP/img/
641 B
641 B
Image
General
Full URL
https://www.icgauth.banquepopulaire.fr/WebSSO_BP/img/btn_annuler.png
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.108.95.244 , France, ASN3215 (AS3215, FR),
Reverse DNS
Software
Apache/2.2.15 (Red Hat) /
Resource Hash
b106bcbbfee0709f6e34c719dd7d83f2b271a65aa020c9b3e813bce941926a9a

Request headers

Referer
https://www.icgauth.banquepopulaire.fr/WebSSO_BP/css/app.css?v=4
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Last-Modified
Wed, 21 Dec 2016 10:26:49 GMT
Server
Apache/2.2.15 (Red Hat)
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=300
Content-Length
641
bouton_valider.jpg
www.icgauth.banquepopulaire.fr/WebSSO_BP/img/
692 B
692 B
Image
General
Full URL
https://www.icgauth.banquepopulaire.fr/WebSSO_BP/img/bouton_valider.jpg
Requested by
Host: cgauth-banquepopulaire-fr.info
URL: http://cgauth-banquepopulaire-fr.info/portailinternet/Pages/Login/227d1/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.108.95.244 , France, ASN3215 (AS3215, FR),
Reverse DNS
Software
Apache/2.2.15 (Red Hat) /
Resource Hash
b3b9b847d50a98f2a42fcc3c7b2813cde31d1bcd4e96debe9e8051e0da5f6908

Request headers

Referer
https://www.icgauth.banquepopulaire.fr/WebSSO_BP/css/app.css?v=4
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 15:36:14 GMT
Last-Modified
Wed, 21 Dec 2016 10:26:49 GMT
Server
Apache/2.2.15 (Red Hat)
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=300
Content-Length
692

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
homgcnaoacgigpkkljjjekpignblkeae
URL
chrome-extension://homgcnaoacgigpkkljjjekpignblkeae/detector.js
Domain
www.ibps.valdefrance.banquepopulaire.fr
URL
https://www.ibps.valdefrance.banquepopulaire.fr/s3f-web/getResource?mod=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Populaire (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
ws.facil-iti.com/ Name: srvnode
Value: srv02