job-apply-ameli.bubbleapps.io
Open in
urlscan Pro
104.18.245.24
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On October 20 via api from US — Scanned from DE
Summary
TLS certificate: Issued by WE1 on September 28th 2024. Valid for: 3 months.
This is the only time job-apply-ameli.bubbleapps.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Assurance Maladie (Healthcare)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 104.18.245.24 104.18.245.24 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 104.17.124.183 104.17.124.183 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:803::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.185.67 142.250.185.67 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2600:9000:211... 2600:9000:211e:4800:1c:37e5:3f40:21 | 16509 (AMAZON-02) (AMAZON-02) | |
22 | 6 |
ASN13335 (CLOUDFLARENET, US)
97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io |
ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f3.1e100.net
fonts.gstatic.com |
ASN16509 (AMAZON-02, US)
d1muf25xaso8hp.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
bubbleapps.io
job-apply-ameli.bubbleapps.io |
902 KB |
4 |
cloudfront.net
d1muf25xaso8hp.cloudfront.net |
10 KB |
4 |
bubble.io
97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io |
36 KB |
1 |
gstatic.com
fonts.gstatic.com |
47 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
2 KB |
22 | 5 |
Domain | Requested by | |
---|---|---|
12 | job-apply-ameli.bubbleapps.io |
job-apply-ameli.bubbleapps.io
|
4 | d1muf25xaso8hp.cloudfront.net | |
4 | 97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io |
job-apply-ameli.bubbleapps.io
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
job-apply-ameli.bubbleapps.io
|
22 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
bubbleapps.io WE1 |
2024-09-28 - 2024-12-27 |
3 months | crt.sh |
bubble.io WE1 |
2024-10-15 - 2025-01-14 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-09-30 - 2024-12-23 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-09-30 - 2024-12-23 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2024-07-30 - 2025-07-03 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://job-apply-ameli.bubbleapps.io/
Frame ID: 549D62784D159F8B7E22636CF1BAE1B6
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Compte ameli - mon espace personnel - Connexion à mon compteDetected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
job-apply-ameli.bubbleapps.io/ |
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
early.js
job-apply-ameli.bubbleapps.io/package/early_js/05ae9fe83d6b755291132aab9d325d70918aafd336da1bd91a41a31c8b25734b/ |
24 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
run.css
job-apply-ameli.bubbleapps.io/package/run_css/4d03add23afb166de513c5218ac684625da3c621a9df7b04a5bcdb18f3d4b3a7/job-apply-ameli/live/index/xfalse/xfalse/ |
73 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pre_run_jquery.js
job-apply-ameli.bubbleapps.io/package/pre_run_jquery_js/dee903a9e36db713e4c86d0cdd96d921e37be0c1293ed8dee29e2e4d7713b9ff/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
run.js
job-apply-ameli.bubbleapps.io/package/run_js/d2e6685500c68f97369ef99ee53520af2864c2295786bcdf7a9d434de6eb6dbc/xfalse/x29/ |
3 MB 764 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
static.js
job-apply-ameli.bubbleapps.io/package/static_js/8167680746c85cb09b1bdabf4ec1c0c006375775a9e573498fdf40aed21619c8/job-apply-ameli/live/index/xnull/xfalse/xfalse/xfalse/ |
183 KB 54 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dynamic.js
job-apply-ameli.bubbleapps.io/package/dynamic_js/685b87ff18a04215bf0330e52aca81e7c9225dd35dbeb44b562547acb22d07f9/job-apply-ameli/live/index/xnull/xfalse/xfalse/en_us/xfalse/xfalse/ |
82 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hideShowPassword.min.js
97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io/f1531310763221x361809402238577600/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
17 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
data
job-apply-ameli.bubbleapps.io/api/1.1/init/ |
283 B 985 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ |
47 KB 47 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
42 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
hi
job-apply-ameli.bubbleapps.io/user/ |
57 B 833 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_general.svg
97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io/f1728105861586x461264638929299400/ |
42 KB 15 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https%3A%2F%2F97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io%2Ff1728106482543x516962458639689300%2Flogin.png
d1muf25xaso8hp.cloudfront.net/ |
859 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https%3A%2F%2F97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io%2Ff1728107311734x454001632708148860%2Fpassword.png
d1muf25xaso8hp.cloudfront.net/ |
802 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https%3A%2F%2F97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io%2Ff1728107352553x859917817195483500%2FOeilBarre.png
d1muf25xaso8hp.cloudfront.net/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https%3A%2F%2F97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io%2Ff1728107672073x427310464828244000%2Ffrance-connect.png
d1muf25xaso8hp.cloudfront.net/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
footer_logo_ameli.svg
97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io/f1728109509037x565751147699721200/ |
37 KB 14 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Favicon.svg
97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io/f1728109372536x387678421130635000/ |
6 KB 3 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
m
job-apply-ameli.bubbleapps.io/user/ |
4 B 653 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
apm
job-apply-ameli.bubbleapps.io/user/ |
4 B 729 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
frg
job-apply-ameli.bubbleapps.io/ |
5 B 729 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Assurance Maladie (Healthcare)56 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| bubble_session_uid object| headers_source_maps function| make_proxy function| appquery function| Lib function| load_error_function object| load_error_log function| disableLoadErrorFunction object| _bubble_page_load_data object| webfont object| WebFont function| FontFaceObserver string| gm_key string| bubble_page_load_id string| bubble_plp_token string| _p string| bubble_page_name function| $ function| jQuery boolean| google_web_fonts_active object| fontface_loaded boolean| all_fontface_loaded function| Lib_post_load string| bubble_bundle_name function| clearImmediate function| setImmediate object| BrowserDetect function| highlight_dom_changes function| local_storage_fallback object| u object| element_performance_counts function| kill_notifier_socket function| restore_notifier_socket number| server_time_offset object| client_db object| safe_require object| __algolia object| testing function| authenticate_as object| document_ready_key function| gapListener function| display_page function| switch_page object| preloaded object| __code__ function| Inputmask number| bubble_version object| plugins object| bubble_run_derived object| translation_data object| language_data string| application_language object| app function| everything_ready function| wait_for_everything number| render_end_timestamp3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
job-apply-ameli.bubbleapps.io/ | Name: job-apply-ameli_live_u2main Value: bus|1729387697979x713183264788336300|1729387697995x496291906643927300 |
|
job-apply-ameli.bubbleapps.io/ | Name: job-apply-ameli_live_u2main.sig Value: bK-mqJ9IxWmSBWatFFwjgpLYVCc |
|
job-apply-ameli.bubbleapps.io/ | Name: job-apply-ameli_u1main Value: 1729387697979x713183264788336300 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'none'; |
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
97d4137c1afed1bf5a36ef9401467fa2.cdn.bubble.io
d1muf25xaso8hp.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
job-apply-ameli.bubbleapps.io
104.17.124.183
104.18.245.24
142.250.185.67
2600:9000:211e:4800:1c:37e5:3f40:21
2a00:1450:4001:803::200a
03d9726e27c9aef574530514081a73891381f3061fc125ede3059df01adad975
08037f485aea17cd5e9c0e9b7de334dc00f03f72196088bbc595df4974715581
2880b3de9f5e2f1b7a8dd190244dfdf767973da2e07c177d075c1711a53e9f2d
3a2bc49e2ba9aa3d94241ccc844a317a9b85879feaf087b453d0b2f791d11231
3b112fac7472fb81fbb55ba8a88f1dec03fa9a656ad44371e7739ac25908d574
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3fff2d67677fd4161f2a993ba4a9912a5ed576e43c1049cdf158d3acf66a118a
450e62180e870526d437f065fa76a5d4e31517905e37a98184ef79b0fc2abd5b
4d06b0561501a7353d695a1294b3633d83e916378ad724e5b91237f681d9b861
68e000b70ccc1a66f953996def3f7f692a40dfd298ad441604a1c6b28c1ec76a
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
824418da7cff39f1eadebb681d306df20d82621e42fa947c87e626fef1092204
963ecfb4bf98969ac8bfec15f0ede5941ce3414b8f1ad3590ffe38fa8053453a
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
a5110db0b5c51345405048f2bc56035edc32bc972e60e4b7a1874fd6175cd7b1
ab1dc4bdcd239cd0d211870064f9481caea7191febf67aa4301671d64ec6e8d4
af8e5a9e59ef6eb702de54010a7333ee668a30a96f296c1fdd3f9871c5b00ac9
cb5452bd461f7600a0d5a4111935ad027eba2dd8978c1e198104a2389aeeaf6f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f98b53a218a59d19768a2ff8ef2c1921ed25ea2f71ca8cf13b8def9559aa0153
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
ff65c1614c77953ea07b3365b2d95db6c9f050675c59eb5168f9c7e95b05a263