www.help.lidarusa.com
Open in
urlscan Pro
173.254.30.18
Malicious Activity!
Public Scan
URL:
https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/login.html
Submission: On October 10 via api from CZ — Scanned from CA
Submission: On October 10 via api from CZ — Scanned from CA
Summary
This website contacted 3 IPs
in 1 countries
across 3 domains to perform 12 HTTP transactions.
The main IP is 173.254.30.18, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is www.help.lidarusa.com.
TLS certificate: Issued by R11 on August 17th 2024. Valid for: 3 months.
This is the only time www.help.lidarusa.com was scanned on urlscan.io!
TLS certificate: Issued by R11 on August 17th 2024. Valid for: 3 months.
This is the only time www.help.lidarusa.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banque Postale (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 173.254.30.18 173.254.30.18 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 2 | 151.101.129.229 151.101.129.229 | 54113 (FASTLY) (FASTLY) | |
| 1 | 151.101.194.137 151.101.194.137 | 54113 (FASTLY) (FASTLY) | |
| 12 | 3 |
9
173.254.30.18
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: just2081.justhost.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: just2081.justhost.com
| www.help.lidarusa.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
lidarusa.com
www.help.lidarusa.com |
289 KB |
| 2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 311 |
50 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 791 |
31 KB |
| 12 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | www.help.lidarusa.com |
www.help.lidarusa.com
|
| 2 | cdn.jsdelivr.net |
www.help.lidarusa.com
|
| 1 | code.jquery.com |
www.help.lidarusa.com
|
| 12 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.help.lidarusa.com R11 |
2024-08-17 - 2024-11-15 |
3 months | crt.sh |
| jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3 |
2024-07-30 - 2025-08-31 |
a year | crt.sh |
| *.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/login.html
Frame ID: 9CC1C923E0A0DB1A6FF426135E9E1868
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Connexion à l'espace client - La Banque PostaleDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
login.html
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/ |
9 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.1.0/dist/css/ |
159 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/asset/css/ |
4 KB 2 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
entete1lg.PNG
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/asset/img/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
entete1_mobile.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/asset/img/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
right.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/asset/img/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pied.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/asset/img/ |
161 KB 161 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pied_mobile.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/asset/img/ |
66 KB 66 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.1.1/dist/js/ |
77 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
script.js
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/be893a92d673b27/asset/js/ |
3 KB 803 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/assets/images/ |
2 KB 2 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banque Postale (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| uidEvent object| bootstrap function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
code.jquery.com
www.help.lidarusa.com
151.101.129.229
151.101.194.137
173.254.30.18
1e114c89ff68be36510b55b46a624ae63b8b24fbf3584b7cab06242908bfd09b
487bf16b7670bc59adc08ebc69239b4c6b614a0a9349a6b25c330ddf69adaca6
5de2ec70d42d6ae4bc6e1a5805198e78e6ad6e356b759bd59d2fa26d79df16d5
5e0e7496d7d3fd56b4520e18fe260ccad50a7cdca61a87778b64a0e1558c3fc5
7a1869e5121a1c30a84fae58230d40d839ede372d0fadc09d0dddf9962a8dbe1
8f59ac44ac068ec5daba5d7d138d01b1ae964309fdabbbc3597cb30717728a96
94198011e12bfd4bc5862118a4c33bf8154587e2f7a2d4ff444b3c249207837d
cb3747dbd4cfbfa4a3e32ad8d8d463a717283dbf3b343c8d2cf86385aeccd573
cfc391e34328c09f0680ae8ff3d63e86224ae7e71c973147ccb84540b2fdd9b8
e5a12b84f9543d5ba3231837c2f2467563405aa66a582b6fc400985f85df49ad
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
ffdb5c265a56f6bb15f88ec2327d9265719a0b632a34387b3b91d669d5291764