regal-puffpuff-f9007a.netlify.app
Open in
urlscan Pro
2600:1f18:16e:df01::64
Malicious Activity!
Public Scan
Submission: On December 28 via api from US — Scanned from US
Summary
TLS certificate: Issued by DigiCert TLS Hybrid ECC SHA384 2020 CA1 on December 21st 2022. Valid for: a year.
This is the only time regal-puffpuff-f9007a.netlify.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: SFR (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2600:1f18:16e... 2600:1f18:16e:df01::64 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 2a04:4e42:400... 2a04:4e42:400::485 | 54113 (FASTLY) (FASTLY) | |
15 | 2a02:8400:21:... 2a02:8400:21:1::3 | 15557 (LDCOMNET) (LDCOMNET) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:824::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700:303... 2606:4700:3036::6815:f52 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
24 | 6 |
ASN14618 (AMAZON-AES, US)
regal-puffpuff-f9007a.netlify.app |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
s-sfr.fr
static.s-sfr.fr — Cisco Umbrella Rank: 395794 |
158 KB |
4 |
netlify.app
regal-puffpuff-f9007a.netlify.app |
365 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 313 |
60 KB |
1 |
nox.tv
forum.nox.tv |
|
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29 |
1 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 204 |
27 KB |
24 | 6 |
Domain | Requested by | |
---|---|---|
15 | static.s-sfr.fr |
regal-puffpuff-f9007a.netlify.app
static.s-sfr.fr |
4 | regal-puffpuff-f9007a.netlify.app |
regal-puffpuff-f9007a.netlify.app
|
2 | cdn.jsdelivr.net |
regal-puffpuff-f9007a.netlify.app
|
1 | forum.nox.tv |
regal-puffpuff-f9007a.netlify.app
|
1 | fonts.googleapis.com |
regal-puffpuff-f9007a.netlify.app
|
1 | cdnjs.cloudflare.com |
regal-puffpuff-f9007a.netlify.app
|
24 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
assistance.sfr.fr |
espace-client.sfr.fr |
www.sfr.fr |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.netlify.app DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-12-21 - 2024-01-21 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
*.s-sfr.fr Certigna Wild CA |
2023-03-23 - 2024-04-22 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
nox.tv GTS CA 1P5 |
2023-12-03 - 2024-03-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://regal-puffpuff-f9007a.netlify.app/
Frame ID: B62624EDCC153777DBBC057BF77B9CB7
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
SFR LoginEspace Client SFR - Gestion de mon compte SFRDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Netlify (Web Servers) Expand
Detected patterns
- ^https?://[^/]+\.netlify\.(?:com|app)/
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
reCAPTCHA (Captchas) Expand
Detected patterns
- <div[^>]+class="g-recaptcha"
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Info Phishing
Search URL Search Domain Scan URL
Title: Mot de passe oubliƩ
Search URL Search Domain Scan URL
Title: Compte bloquƩ
Search URL Search Domain Scan URL
Title: AccƩdez aux actes d'urgence
Search URL Search Domain Scan URL
Title: En savoir plus sur lāAppli SFR & Moi
Search URL Search Domain Scan URL
Title: cliquez ici
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
regal-puffpuff-f9007a.netlify.app/ |
35 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/css/ |
190 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
push-download-app-mobile.css
static.s-sfr.fr/cas/css/push-download-app/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layer-responsive.css
static.s-sfr.fr/cas/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
buttons.css
static.s-sfr.fr/cas/css/ |
47 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ |
85 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style-responsive.css
static.s-sfr.fr//cas/css/ |
31 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style-responsive-update.css
static.s-sfr.fr/cas/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.10.2.min.js
static.s-sfr.fr/cas/js/ |
91 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mire-v2-script.js
static.s-sfr.fr/cas/js/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mire-jquery.placeholder.js
static.s-sfr.fr/cas/js/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
regal-puffpuff-f9007a.netlify.app/ |
258 KB 258 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.php
forum.nox.tv/core/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-play-app.svg
static.s-sfr.fr/media/ |
25 KB 19 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-store-app.svg
static.s-sfr.fr/media/ |
14 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layer-content-1.jpg
static.s-sfr.fr/media/ |
27 KB 28 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.png
regal-puffpuff-f9007a.netlify.app/ |
99 KB 99 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form.js
regal-puffpuff-f9007a.netlify.app/ |
970 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/css/ |
190 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sprite-mire-2016.png
static.s-sfr.fr/media/ |
29 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eye.svg
static.s-sfr.fr/media/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg-croix.png
static.s-sfr.fr/media/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg-mire-connexion-min.jpeg
static.s-sfr.fr/media/ |
15 KB 16 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: SFR (Telecommunication)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery function| openLayer function| closeLayer function| sendStats function| sendStatsMsg function| sendStatsHelp function| trackLink string| _stats_pagename boolean| isMireLayer object| _cfCas0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
fonts.googleapis.com
forum.nox.tv
regal-puffpuff-f9007a.netlify.app
static.s-sfr.fr
2600:1f18:16e:df01::64
2606:4700:3036::6815:f52
2606:4700::6811:180e
2607:f8b0:4006:824::200a
2a02:8400:21:1::3
2a04:4e42:400::485
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
121aee4c204350cbd43e32fc39946bc81db553a7779c029e40b03faf7d3ff4e2
149aa738b1cd062359330f7705f4a22684fa3f14e647120e28067a0a4fb064f2
17c15674aeb98203ad6e80b4089743fa2f801b4eb06ac0929e5d82b4c8940624
1cc4c0a338c295fbf4578a1c4a6b8a9a49bbf7b8aa0a673da0d9d025c8f921af
1ce3ef4240a960a5532a670a02881d15f1fc24d2f5f30c0ee0b6796f4efce9e1
2c1930fe9617596873f369afb7fe2648ff26ce30a2e0b5fbe844e31c99b36236
43761e225af15b9ecc43ec9381ab35e2f92f877b6427c9a18f0e98c06658c99c
4a5aefbad9090437a9fa23a88a96029d34dc153bc9ca372aa838dc13e5290f87
4adf762670da7e1a8bc8e7a0de36f2b61742fe02fe23234e57f5a206263f40bf
558e35221f50e46594101582239ddd8c56549c7c3cebb3870a548bbb92c68360
7ffdd76bf7d4a89f7e27408c9779ded93fe44672dbb166fa020edd284c3e5750
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8e4f0d5c128a87479806e3a8e04fbc30485ebecdbb11c176a78b10e3b9a03b34
94d5788b5c6023b49bb8f950692e76717c9969ffb4f83f12096d6b0a9b486613
96802a7fe965152684620812d70e80db893633f323325c032c530c11bec9ca7d
99cae9d1a14924d2fe40f1fee8b27a958be2fe896f979dc9c89bd128417ce783
de6961171f1775b5a813651ee816714cf144af2eb10d89f3a0644deb98aa1219
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecbfc6603df8a516ae88bab0a7b85ccd5c77416faf0f40ca3a0beb0be4523763
ed959b654022f7bae48ab9380dc129e065833e45a944c70d684c971ac3578cb8
f04be863299fa592a3546f9c988443c2e365b983f0ab912aeda084bb9b97fc54
fcd07d21f21002d006e7e9a4797896bb12f00ea503ccbfed143527826c61694e