ghosthiker.com
Open in
urlscan Pro
204.93.163.87
Malicious Activity!
Public Scan
URL:
http://ghosthiker.com/icgauth.banquepopulaire-frnewsfr-cm-presse-frintid=HH-Presse-id304839BPCE/banquepopulaire-portai...
Submission: On October 06 via automatic, source openphish
Submission: On October 06 via automatic, source openphish
Summary
This website contacted 4 IPs
in 3 countries
across 4 domains to perform 13 HTTP transactions.
The main IP is 204.93.163.87, located in
Chicago, United States and
belongs to SERVERCENTRAL - Server Central Network, US.
The main domain is ghosthiker.com.
This is the only time ghosthiker.com was scanned on urlscan.io!
This is the only time ghosthiker.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banque Populaire (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 204.93.163.87 204.93.163.87 | 23352 (SERVERCEN...) (SERVERCENTRAL - Server Central Network) | |
| 1 | 79.170.44.91 79.170.44.91 | 20773 (HOSTEUROP...) (HOSTEUROPE-AS) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 4 | 2a00:1450:400... 2a00:1450:4001:81d::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 13 | 4 |
7
204.93.163.87
(Chicago, United States)
ASN23352 (SERVERCENTRAL - Server Central Network, US)
PTR: server504.webhostingpad.com
ASN23352 (SERVERCENTRAL - Server Central Network, US)
PTR: server504.webhostingpad.com
| ghosthiker.com |
1
79.170.44.91
(United Kingdom)
ASN20773 (HOSTEUROPE-AS, DE)
PTR: web91.extendcp.co.uk
ASN20773 (HOSTEUROPE-AS, DE)
PTR: web91.extendcp.co.uk
| www.24leaflets.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
ghosthiker.com
ghosthiker.com |
159 KB |
| 4 |
gstatic.com
fonts.gstatic.com |
54 KB |
| 1 |
googleapis.com
fonts.googleapis.com |
1 KB |
| 1 |
24leaflets.com
www.24leaflets.com |
15 KB |
| 13 | 4 |
| Domain | Requested by | |
|---|---|---|
| 7 | ghosthiker.com |
ghosthiker.com
|
| 4 | fonts.gstatic.com |
ghosthiker.com
|
| 1 | fonts.googleapis.com |
ghosthiker.com
|
| 1 | www.24leaflets.com |
ghosthiker.com
|
| 13 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.googleapis.com Google Internet Authority G3 |
2018-09-18 - 2018-12-11 |
3 months | crt.sh |
| *.google.com Google Internet Authority G3 |
2018-09-18 - 2018-12-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://ghosthiker.com/icgauth.banquepopulaire-frnewsfr-cm-presse-frintid=HH-Presse-id304839BPCE/banquepopulaire-portailinternet1/4b1f6/6039fd168b8e1bb5fd2955a74b776d71/index/web/index3.html
Frame ID: 7F5B4E2C2F0102EDE826B443CA1345CE
Requests: 13 HTTP requests in this frame
Screenshot
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index3.html
ghosthiker.com/icgauth.banquepopulaire-frnewsfr-cm-presse-frintid=HH-Presse-id304839BPCE/banquepopulaire-portailinternet1/4b1f6/6039fd168b8e1bb5fd2955a74b776d71/index/web/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
app.css
ghosthiker.com/icgauth.banquepopulaire-frnewsfr-cm-presse-frintid=HH-Presse-id304839BPCE/banquepopulaire-portailinternet1/4b1f6/6039fd168b8e1bb5fd2955a74b776d71/index/web/assets/css/ |
3 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1011px-Banquepopulaire_logo.svg.png
www.24leaflets.com/wp-includes/images/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cp.png
ghosthiker.com/icgauth.banquepopulaire-frnewsfr-cm-presse-frintid=HH-Presse-id304839BPCE/banquepopulaire-portailinternet1/4b1f6/6039fd168b8e1bb5fd2955a74b776d71/index/web/ |
56 KB 56 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
BP_Picto_service-securise.png
ghosthiker.com/icgauth.banquepopulaire-frnewsfr-cm-presse-frintid=HH-Presse-id304839BPCE/banquepopulaire-portailinternet1/4b1f6/6039fd168b8e1bb5fd2955a74b776d71/index/web/assets/img/ |
992 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
banner.png
ghosthiker.com/icgauth.banquepopulaire-frnewsfr-cm-presse-frintid=HH-Presse-id304839BPCE/banquepopulaire-portailinternet1/4b1f6/6039fd168b8e1bb5fd2955a74b776d71/index/web/assets/img/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.2.1.min.js
ghosthiker.com/icgauth.banquepopulaire-frnewsfr-cm-presse-frintid=HH-Presse-id304839BPCE/banquepopulaire-portailinternet1/4b1f6/6039fd168b8e1bb5fd2955a74b776d71/index/web/assets/js/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
app.js
ghosthiker.com/icgauth.banquepopulaire-frnewsfr-cm-presse-frintid=HH-Presse-id304839BPCE/banquepopulaire-portailinternet1/4b1f6/6039fd168b8e1bb5fd2955a74b776d71/index/web/assets/js/ |
912 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
css
fonts.googleapis.com/ |
16 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
4iCv6KVjbNBYlgoC1CzjsGyNPYZvgw.woff2
fonts.gstatic.com/s/ubuntu/v12/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
4iCs6KVjbNBYlgoKfw72nU6AFw.woff2
fonts.gstatic.com/s/ubuntu/v12/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
4iCv6KVjbNBYlgoCjC3jsGyNPYZvgw.woff2
fonts.gstatic.com/s/ubuntu/v12/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
4iCv6KVjbNBYlgoCxCvjsGyNPYZvgw.woff2
fonts.gstatic.com/s/ubuntu/v12/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banque Populaire (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
ghosthiker.com
www.24leaflets.com
204.93.163.87
2a00:1450:4001:81d::2003
2a00:1450:4001:81d::200a
79.170.44.91
12deb5082d9a265422916da8c3f6b1db8636ff8a5a72e0cad6cdf62f1ef5fc93
209babc7d8608733b459218afde4330eddb86e38018c26d6851b13efc48ccb58
22edc0e6778ed62a046d971287468840d96534c62233ccfbd99e6b1783cabe7b
251e8e864140d9a7ceacce3371ff692595dd0a455ad000de4041d8a313618bd7
32cd99b78f0da3e7e28854764c3261410c243bdfb85f235053fbb03c8d92ebf0
39036ed5148c614cdc0cc98ad981591d852dd96827743db932425284b011d162
3f2e7d6e040f322318648bf19ee23907f24a4c60cdf5575c134b9091fa08869c
7028d0bae5ddc07e46330709ea671b475106e30279f04408af41de351a787dc7
83a6c27460f2b25ae32418ffd3225bda099cc9cbf6274bd7fbf9fa50d4e8381b
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
943a150e9577247cc5e8e493065795ca77a35485b4169f33a4d6f570c209b010
adc948c51bf75746584855ba175e7b36dc7d1e3edd835a179c3b1ab0ae3567e3
e25d65f020f2bb10f8aa86568b527bba648a17396d239331e7e45a0139879ecc