ca-regionale-fr.line.pm Open in urlscan Pro
45.67.231.70 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ca-regionale-fr.line.pm/agrc/OK/
Submission Tags: tweet @atomspam #phishing #créditagricole #bank #infosec #cybersecurity #atomspam Search All
Submission: On December 27 via api (December 27th 2022, 6:25:53 pm UTC) from FI — Scanned from FR

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 21 HTTP transactions. The main IP is 45.67.231.70, located in Meppel, Netherlands and belongs to STARK-INDUSTRIES, GB. The main domain is ca-regionale-fr.line.pm.
TLS certificate: Issued by R3 on December 19th 2022. Valid for: 3 months.

This is the only time ca-regionale-fr.line.pm was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Credit Agricole (Banking)

Domain & IP information

	IP Address	AS Autonomous System
18	45.67.231.70 45.67.231.70	44477 (STARK-IND...) (STARK-INDUSTRIES)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
21	3

18 45.67.231.70 (Meppel, Netherlands)

ASN44477 (STARK-INDUSTRIES, GB)
PTR: vm846475.stark-industries.solutions

ca-regionale-fr.line.pm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	line.pm ca-regionale-fr.line.pm	728 KB
2	gstatic.com fonts.gstatic.com	91 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 111	2 KB
21	3

	Domain	Requested by
18	ca-regionale-fr.line.pm	ca-regionale-fr.line.pm
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	ca-regionale-fr.line.pm
21	3

This site contains no links.

Subject Issuer	Validity	Valid
ca-regionale-fr.line.pm R3	`2022-12-19` - `2023-03-19`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ca-regionale-fr.line.pm/agrc/OK/
Frame ID: EEB2B9E6672AFC6553A0FC9B0D58A1BE
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Accès CR - Crédit Agricole

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

821 kB
Transfer

1971 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ca-regionale-fr.line.pm/agrc/OK/ 23 KB
3 KB 250ms
67ms Document
text/html 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PHP/7.4.33 PleskLin
Resource Hash: ead9427570ea45aae5d8e852d6b3cf7ca078ff7941cfe438be47632aa8c50aeb

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 27 Dec 2022 18:25:47 GMT
server: nginx
x-powered-by: PHP/7.4.33 PleskLin

GET
H2 200 angular.min.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 163 KB
55 KB 134ms
125ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/angular.min.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 587adbf421a41b09b8845325fc581b7edf6802094886a8f9f95dda9c0aa0314c

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:43:59 GMT
server: nginx
etag: W/"63a9cf4f-28d2a"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 jquery.min.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 86 KB
29 KB 176ms
165ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/jquery.min.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:44:04 GMT
server: nginx
etag: W/"63a9cf54-15850"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 jquery.CardValidator.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 6 KB
2 KB 166ms
157ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/jquery.CardValidator.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 2e31f31633d04598c60731878851d821eaa4403af63b930d58bb10bc9c0428a2

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:44:03 GMT
server: nginx
etag: W/"63a9cf53-18df"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 jquery.validate.min.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 23 KB
7 KB 171ms
161ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/jquery.validate.min.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: e2ff0053845c416f4516a3af75f751b4a5cd5ee922751921287e52dfcb7ab4ae

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:44:04 GMT
server: nginx
etag: W/"63a9cf54-5a07"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 jquery.mask.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 18 KB
5 KB 166ms
158ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/jquery.mask.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:44:03 GMT
server: nginx
etag: W/"63a9cf53-47fe"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 style.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 2 KB
859 B 172ms
164ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/style.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 86c051eb57fe97e4dc99fd4cba7334c3faef8e6d3655da6f2b04176f523d96f5

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:44:06 GMT
server: nginx
etag: W/"63a9cf56-859"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 bootstrap.min.css
ca-regionale-fr.line.pm/agrc/OK/style/css/ 138 KB
18 KB 174ms
166ms Stylesheet
text/css 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/css/bootstrap.min.css
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:43:43 GMT
server: nginx
etag: W/"63a9cf3f-22688"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 helpers.css
ca-regionale-fr.line.pm/agrc/OK/style/css/ 40 KB
3 KB 169ms
163ms Stylesheet
text/css 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/css/helpers.css
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 2a6536dfb04e99526ca10907b63b77bd89acf583d1e0a5351a64983b65a860ab

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:43:43 GMT
server: nginx
etag: W/"63a9cf3f-9fa9"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 fonts.css
ca-regionale-fr.line.pm/agrc/OK/style/css/ 1 KB
382 B 166ms
160ms Stylesheet
text/css 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/css/fonts.css
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 58ee7e88c3582acc31da9da5ff2f719c37cce006c08d545a2b97443dae395cac

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:43:43 GMT
server: nginx
etag: W/"63a9cf3f-566"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 main.css
ca-regionale-fr.line.pm/agrc/OK/style/css/ 10 KB
2 KB 164ms
159ms Stylesheet
text/css 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/css/main.css
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 6f9d1487c28cd062fb9ef16b1d38cb43f1ffb51dd7358caddb6005f036da4c81

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:47 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:43:44 GMT
server: nginx
etag: W/"63a9cf40-2862"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 heder_pc.png
ca-regionale-fr.line.pm/agrc/OK/style/ 25 KB
25 KB 294ms
294ms Image
image/png 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/heder_pc.png
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 221718bb9f3fa97da92da44d6e93dceeefb9e40dc280756090f48a12388d9bab

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:48 GMT
last-modified: Mon, 26 Dec 2022 16:43:58 GMT
server: nginx
etag: "63a9cf4e-64ce"
x-powered-by: PleskLin
content-type: image/png
accept-ranges: bytes
content-length: 25806

GET
H2 200 heder_mobile.png
ca-regionale-fr.line.pm/agrc/OK/style/ 14 KB
14 KB 295ms
294ms Image
image/png 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/heder_mobile.png
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 3083a74ea27c3ef04821820661865ea325efd1f96a6ef8e3edf0370c0209d1b1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:48 GMT
last-modified: Mon, 26 Dec 2022 16:43:57 GMT
server: nginx
etag: "63a9cf4d-36e9"
x-powered-by: PleskLin
content-type: image/png
accept-ranges: bytes
content-length: 14057

GET
H2 200 popper.min.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 20 KB
7 KB 68ms
68ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/popper.min.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: d2b9f29ea1f42a60a8beb1c04f76868287f2a48d6ec50fb39d6b888584a03c49

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:48 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:44:05 GMT
server: nginx
etag: W/"63a9cf55-4f70"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 bootstrap.min.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 58 KB
14 KB 69ms
69ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/bootstrap.min.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 11587df26bcbaa9d79eb508e3cba63954493215b8ce1333b9f5c4b95901d367a

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:48 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:44:00 GMT
server: nginx
etag: W/"63a9cf50-e6b4"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 fontawesome.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 1 MB
352 KB 243ms
243ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/fontawesome.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 7ccfb362c0953a0770091119f0015cc43b06fd85e00ae97037517a36cf9bcf78

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:48 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:44:02 GMT
server: nginx
etag: W/"63a9cf52-103172"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 main.js Show response
ca-regionale-fr.line.pm/agrc/OK/style/js/ 4 KB
995 B 295ms
295ms Script
application/javascript 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/js/main.js
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 1caad43f11c3e215f3768190bf3e3bae8e7296eb7937b3bff7d3f2f45cd24f2b

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:48 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 16:44:05 GMT
server: nginx
etag: W/"63a9cf55-109b"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 css
fonts.googleapis.com/ 23 KB
2 KB 97ms
36ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800

Requested by

Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/style/css/main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8f5f74a9a18dd60761934ea3d816eb58647636c8d742472bce0275ea254c00f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 27 Dec 2022 18:25:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Dec 2022 18:07:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Dec 2022 18:25:48 GMT

GET
H2 200 img.jpg
ca-regionale-fr.line.pm/agrc/OK/style/ 189 KB
190 KB 187ms
187ms Image
image/jpeg 45.67.231.70
STARK-INDUSTRIES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ca-regionale-fr.line.pm/agrc/OK/style/img.jpg
Requested by: Host: ca-regionale-fr.line.pm
URL: https://ca-regionale-fr.line.pm/agrc/OK/style/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.67.231.70 Meppel, Netherlands, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS: vm846475.stark-industries.solutions
Software: nginx / PleskLin
Resource Hash: 69b99b31b30dc817bdfb1a4dfeb5a5c0cfe3f9be26c519ddf4bc99388c8f3b0b

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://ca-regionale-fr.line.pm/agrc/OK/style/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:25:48 GMT
last-modified: Mon, 26 Dec 2022 16:43:58 GMT
server: nginx
etag: "63a9cf4e-2f5bb"
x-powered-by: PleskLin
content-type: image/jpeg
accept-ranges: bytes
content-length: 193979

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 107ms
27ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ca-regionale-fr.line.pm
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 26 Dec 2022 18:50:24 GMT
x-content-type-options: nosniff
age: 84924
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Dec 2023 18:50:24 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v34/ 47 KB
47 KB 134ms
55ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ca-regionale-fr.line.pm
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 26 Dec 2022 17:36:16 GMT
x-content-type-options: nosniff
age: 89372
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47952
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:22:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Dec 2023 17:36:16 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Credit Agricole (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ca-regionale-fr.line.pm
fonts.googleapis.com
fonts.gstatic.com
2a00:1450:4001:812::200a
2a00:1450:4001:82b::2003
45.67.231.70
11587df26bcbaa9d79eb508e3cba63954493215b8ce1333b9f5c4b95901d367a
1caad43f11c3e215f3768190bf3e3bae8e7296eb7937b3bff7d3f2f45cd24f2b
221718bb9f3fa97da92da44d6e93dceeefb9e40dc280756090f48a12388d9bab
2a6536dfb04e99526ca10907b63b77bd89acf583d1e0a5351a64983b65a860ab
2e31f31633d04598c60731878851d821eaa4403af63b930d58bb10bc9c0428a2
3083a74ea27c3ef04821820661865ea325efd1f96a6ef8e3edf0370c0209d1b1
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
587adbf421a41b09b8845325fc581b7edf6802094886a8f9f95dda9c0aa0314c
58ee7e88c3582acc31da9da5ff2f719c37cce006c08d545a2b97443dae395cac
69b99b31b30dc817bdfb1a4dfeb5a5c0cfe3f9be26c519ddf4bc99388c8f3b0b
6f9d1487c28cd062fb9ef16b1d38cb43f1ffb51dd7358caddb6005f036da4c81
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
7ccfb362c0953a0770091119f0015cc43b06fd85e00ae97037517a36cf9bcf78
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
86c051eb57fe97e4dc99fd4cba7334c3faef8e6d3655da6f2b04176f523d96f5
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
8f5f74a9a18dd60761934ea3d816eb58647636c8d742472bce0275ea254c00f9
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d2b9f29ea1f42a60a8beb1c04f76868287f2a48d6ec50fb39d6b888584a03c49
e2ff0053845c416f4516a3af75f751b4a5cd5ee922751921287e52dfcb7ab4ae
ead9427570ea45aae5d8e852d6b3cf7ca078ff7941cfe438be47632aa8c50aeb

ca-regionale-fr.line.pm Open in urlscan Pro 45.67.231.70 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

821 kBTransfer

1971 kBSize

0 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

Indicators

ca-regionale-fr.line.pm Open in urlscan Pro
45.67.231.70 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

821 kB
Transfer

1971 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!