wizardly-carson.34-88-132-120.plesk.page
Open in
urlscan Pro
34.88.132.120
Malicious Activity!
Public Scan
Effective URL: https://wizardly-carson.34-88-132-120.plesk.page/id.php
Submission: On May 16 via manual from ES — Scanned from GE
Summary
TLS certificate: Issued by R3 on May 15th 2023. Valid for: 3 months.
This is the only time wizardly-carson.34-88-132-120.plesk.page was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Axa (Insurance)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 14 | 34.88.132.120 34.88.132.120 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 | 142.250.186.138 142.250.186.138 | 15169 (GOOGLE) (GOOGLE) | |
2 | 93.20.47.201 93.20.47.201 | 15557 (LDCOMNET) (LDCOMNET) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 156.154.246.59 156.154.246.59 | 19905 (SECURITYS...) (SECURITYSERVICES) | |
4 | 172.217.23.99 172.217.23.99 | 15169 (GOOGLE) (GOOGLE) | |
1 | 15.236.61.3 15.236.61.3 | 16509 (AMAZON-02) (AMAZON-02) | |
26 | 8 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 120.132.88.34.bc.googleusercontent.com
wizardly-carson.34-88-132-120.plesk.page |
ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f3.1e100.net
fonts.gstatic.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-61-3.eu-west-3.compute.amazonaws.com
privacy.trustcommander.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
plesk.page
1 redirects
wizardly-carson.34-88-132-120.plesk.page |
521 KB |
5 |
axa.fr
banque.axa.fr www.axa.fr |
107 KB |
4 |
gstatic.com
fonts.gstatic.com |
51 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 50 |
2 KB |
1 |
trustcommander.net
privacy.trustcommander.net — Cisco Umbrella Rank: 40710 |
557 B |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 231 |
27 KB |
26 | 6 |
Domain | Requested by | |
---|---|---|
14 | wizardly-carson.34-88-132-120.plesk.page |
1 redirects
wizardly-carson.34-88-132-120.plesk.page
|
4 | fonts.gstatic.com |
fonts.googleapis.com
|
3 | www.axa.fr |
wizardly-carson.34-88-132-120.plesk.page
|
2 | banque.axa.fr |
wizardly-carson.34-88-132-120.plesk.page
|
2 | fonts.googleapis.com |
wizardly-carson.34-88-132-120.plesk.page
|
1 | privacy.trustcommander.net |
wizardly-carson.34-88-132-120.plesk.page
|
1 | cdnjs.cloudflare.com |
wizardly-carson.34-88-132-120.plesk.page
|
26 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
banque.axa.fr |
www.axa.fr |
Subject Issuer | Validity | Valid | |
---|---|---|---|
wizardly-carson.34-88-132-120.plesk.page R3 |
2023-05-15 - 2023-08-13 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
ouvriruncomptebancaire.axa.fr DigiCert TLS RSA SHA256 2020 CA1 |
2022-09-23 - 2023-10-10 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
www.axa.fr DigiCert SHA2 Extended Validation Server CA |
2022-09-23 - 2023-10-13 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
*.trustcommander.net Thawte RSA CA 2018 |
2023-02-09 - 2024-03-11 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wizardly-carson.34-88-132-120.plesk.page/id.php
Frame ID: 18CBA396CA265488AF917A2CB7724C28
Requests: 29 HTTP requests in this frame
Screenshot
Page Title
AuthentificationPage URL History Show full URLs
-
http://wizardly-carson.34-88-132-120.plesk.page/
HTTP 307
https://wizardly-carson.34-88-132-120.plesk.page/ HTTP 302
https://wizardly-carson.34-88-132-120.plesk.page/id.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Title: Définir mon mot de passe
Search URL Search Domain Scan URL
Title: Je ne trouve pas mon nouvel identifiant
Search URL Search Domain Scan URL
Title: Code d'accès oublié ou accès bloqué ?
Search URL Search Domain Scan URL
Title: Codes d'accès oubliés / Accès bloqué
Search URL Search Domain Scan URL
Title: Aide à la connexion
Search URL Search Domain Scan URL
Title: Services et assistance
Search URL Search Domain Scan URL
Title: Configuration et sécurité
Search URL Search Domain Scan URL
Title: Mentions légales
Search URL Search Domain Scan URL
Title: Politique Cookies
Search URL Search Domain Scan URL
Title: Données personnelles
Search URL Search Domain Scan URL
Title: Conditions générales et tarifaires
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://wizardly-carson.34-88-132-120.plesk.page/
HTTP 307
https://wizardly-carson.34-88-132-120.plesk.page/ HTTP 302
https://wizardly-carson.34-88-132-120.plesk.page/id.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
id.php
wizardly-carson.34-88-132-120.plesk.page/ Redirect Chain
|
150 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
wizardly-carson.34-88-132-120.plesk.page/login_files/ |
125 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
10 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles-novatio.css
wizardly-carson.34-88-132-120.plesk.page/login_files/ |
18 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axb_app.css
wizardly-carson.34-88-132-120.plesk.page/login_files/ |
198 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
wizardly-carson.34-88-132-120.plesk.page/login_files/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axb_app(1).css
wizardly-carson.34-88-132-120.plesk.page/login_files/ |
41 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
track
wizardly-carson.34-88-132-120.plesk.page/login_files/ |
23 B 181 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
banque.axa.fr/novatio-modules/ux-library/08db3cd93982b157ad1cb0a8dea537eb/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/ |
85 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
privacy_v2_53.js
wizardly-carson.34-88-132-120.plesk.page/pass_files/ |
76 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
teads-fellow.js
wizardly-carson.34-88-132-120.plesk.page/pass_files/ |
19 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bundle.js
wizardly-carson.34-88-132-120.plesk.page/login_files/ |
985 KB 166 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
7 KB 814 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
padlock.svg
www.axa.fr/content/dam/axa/desktop/banque-credits/banque-espace-client/ |
957 B 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons.svg
wizardly-carson.34-88-132-120.plesk.page/login_files/assets/images/ |
125 KB 125 KB |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons.svg
wizardly-carson.34-88-132-120.plesk.page/login_files/assets/images/ |
125 KB 125 KB |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
wizardly-carson.34-88-132-120.plesk.page/login_files/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
authent.jpg
banque.axa.fr/novatio-modules/ux-library/08db3cd93982b157ad1cb0a8dea537eb/assets/images/ |
100 KB 100 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow_chevron_blue.svg
www.axa.fr/content/dam/axa/desktop/banque-credits/banque-global-assets/ |
989 B 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dropdown_chevron_blue.svg
www.axa.fr/content/dam/axa/desktop/banque-credits/banque-global-assets/ |
190 B 866 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
privacy.trustcommander.net/privacy-consent/ |
43 B 557 B |
Ping
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
307 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ |
12 KB 12 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Axa (Insurance)35 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery function| appendBlockHelp function| appendBlockActivation1 function| appendBlockActivation2 object| activation object| activationChannel number| tcImplicit number| tcImplicitClick number| tcImplicitScroll number| tcReloadContainer number| tcScrollPercentage number| tcTrustTrigger string| tcTrustTriggerName string| tcImplicitType function| tcGetScrollPercent function| reloadAllContainers function| optinAndReload function| removeBanner undefined| optinOnScroll string| tCPrivacyTagManager function| tc_closePrivacyCenter function| tc_closePrivacyButton number| tc_privacy_used function| tC object| caReady function| cact function| appendBlockFraudWarning object| uxLib string| uxEfs object| @libui/lib-axb string| tcVendorsConsent string| tcCategoriesConsent object| overlay2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
wizardly-carson.34-88-132-120.plesk.page/ | Name: PHPSESSID Value: 01747ca1qpn1ofqh9400d3klpn |
|
.34-88-132-120.plesk.page/ | Name: TCPID Value: 12352927309448611605 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
banque.axa.fr
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
privacy.trustcommander.net
wizardly-carson.34-88-132-120.plesk.page
www.axa.fr
104.17.24.14
142.250.186.138
15.236.61.3
156.154.246.59
172.217.23.99
34.88.132.120
93.20.47.201
0487fa40cd5707199ab3a21508043b2314512e0945622d564b572630a17579e2
080e18a8c761c3d30b7ec08aa65f87109a0228367eafd0a12fcefda58d10e8ad
1247331bd8117d30b38ba6dec1de11e895730958888b746ab1477e5faae81cff
256471969aad42f69a5e652875425ca13038c844b673287cbad71a909307a8ba
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
4043288121a80631ae3f30ad21031a77e8937e729efbaedf0342efcba2ddd699
4bf9d7ace53968c23b2f2a5583b11ad42e1c4c71ff4390b11fb8614b9375561c
5120f95785bddf91c1883edf1d5fe575da7a169c6fe306cbede325a079832a7a
5e40921fa478e83424bac9937cee543857ea86075400962df7f09361478023a5
654e7e4599e04f24267341de3d4260d0c332c10bc66b3c99d8f242fdeb258c1c
68daabc11bffe79130a582d70ca406f4c5684f60c7ee780c8f82b4cb30ef8f5f
6ef0ccc56ac30a6bbe27c65bb079f3e2bc091a32603e28d2fec65cb443fb668d
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
795b6982cfd9c9a5110896858f6c118fcdb8127c21cd1791f5e52cc3815c1090
88cab827e057fb6324adcd3c2ed3eb208ac434a440f2cb6f32ef0c6f8af6156d
9faccdd160fa49af6f357b799e75bfb49be8ccdc1c087cca908e1df53b9f2e74
a35a025624ad8566b0a2e918355e1f7c9ff6b8267519013cee9bf23d382795d1
b0cc9a2cf38a0cc4dca290f198ff87deeaa70dbb397165d15b5e7a69efc018c2
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b5d7cbb1d53ba2d2c87e7230c92693c4a251fd306852e423ca9d0276ab8dc322
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
bf62c48b09e55011139dbe497ef1fae26d65da75807a98314a6600a0b4746a2a
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c1d0d79145b13ebec9345d855c9b585ccef30616b5d351b249f659b58eddb5e0
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
e118c0623d37daccbcb18489f1cd5301a83da3824fb09e1eb0fa2b179caceb85
edfea819415ff38872bae9e171c3e1bc2b9d9e1907b1b61d5e576c281dcf3f77