bdf-acceuil.info Open in urlscan Pro
45.131.187.252  Malicious Activity! Public Scan

URL: https://bdf-acceuil.info/
Submission: On August 01 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 45.131.187.252, located in Zug, Switzerland and belongs to UP-NETWORK UP-NETWORK SWITZERLAND, FR. The main domain is bdf-acceuil.info.
TLS certificate: Issued by R3 on July 29th 2022. Valid for: 3 months.
This is the only time bdf-acceuil.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Postale (Banking)

Domain & IP information

IP Address AS Autonomous System
3 45.131.187.252 211851 (UP-NETWOR...)
3 2
Apex Domain
Subdomains
Transfer
3 bdf-acceuil.info
bdf-acceuil.info
3 MB
3 1
Domain Requested by
3 bdf-acceuil.info bdf-acceuil.info
3 1
Subject Issuer Validity Valid
bdf-acceuil.info
R3
2022-07-29 -
2022-10-27
3 months crt.sh

This page contains 2 frames:

Primary Page: https://bdf-acceuil.info/
Frame ID: C0873CA5555E94EEA6D4398F6599F082
Requests: 13 HTTP requests in this frame

Frame: https://bdf-acceuil.info/Identification.html
Frame ID: 05DEC984E82BBD2F5B05243E438F7FB6
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Connexion à l'espace client - La Banque Postale

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

4769 kB
Transfer

8817 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
bdf-acceuil.info/
6 MB
3 MB
Document
General
Full URL
https://bdf-acceuil.info/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.131.187.252 Zug, Switzerland, ASN211851 (UP-NETWORK UP-NETWORK SWITZERLAND, FR),
Reverse DNS
myrdp.gg
Software
nginx / PHP/8.0.21 PleskLin
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 01 Aug 2022 01:23:21 GMT
server
nginx
strict-transport-security
max-age=15768000; includeSubDomains
vary
Accept-Encoding
x-powered-by
PHP/8.0.21 PleskLin
truncated
/
43 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
739104b5349ad414323b0f821b747b55af29af684d47f6c6a189edb08b76b4e3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
593 KB
593 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
089ab6d4a57e0e6c4dd3b681b6fd50a5184f1b902429d35e1227e52d6ccad1bd

Request headers

Referer
Origin
https://bdf-acceuil.info
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
application/x-font-ttf
truncated
/
587 KB
587 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f71f833c099f450606f8107b83ef208ae918c0ea00779466d45e9be96b0bc7cc

Request headers

Referer
Origin
https://bdf-acceuil.info
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
application/x-font-ttf
Identification.html
bdf-acceuil.info/ Frame 05DE
29 KB
9 KB
Document
General
Full URL
https://bdf-acceuil.info/Identification.html
Requested by
Host: bdf-acceuil.info
URL: https://bdf-acceuil.info/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.131.187.252 Zug, Switzerland, ASN211851 (UP-NETWORK UP-NETWORK SWITZERLAND, FR),
Reverse DNS
myrdp.gg
Software
nginx / PleskLin
Resource Hash
6d5b623650c163f1608355646ce3bfeed669604a4991c72af2e76c7437b4a938
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://bdf-acceuil.info/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html
date
Mon, 01 Aug 2022 01:23:22 GMT
etag
W/"62a9935e-736a"
last-modified
Wed, 15 Jun 2022 08:07:58 GMT
server
nginx
strict-transport-security
max-age=15768000; includeSubDomains
x-powered-by
PleskLin
truncated
/
71 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d8ada3cd602a8cb2c105012001493e85ca6ef2ac968083814fafee5efa146c76

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
44 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
787995d03deb056afa4255fa5f4705351f02d3935e6cbc03e2bc6960879a13ec

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
371 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3496ccf15eceeaa733a2746d6037b4f474a27c7724032a365acf9a41961640be

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
89 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
27f6701cab5ab820afabf56c615d573c516aab5cf1f6753aa29cc32f83a37450

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
603 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
92caa4a61b0c770781916b06d4911577b73038409e5b041ca269abaf7ea5462a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e0a4ab4859b5035345fb3b53608a603464851a10273af55f9f126cc888efd013

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8f4b49755057b59ce072a59784c7d93526dbf07c1846a0cdffed3bf706a11dac

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
75 KB
75 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8f186e57fe440c5c010120c754944a9d5b33e612c3a311dd642435119aafcf70

Request headers

Referer
Origin
https://bdf-acceuil.info
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
application/x-font-ttf
Identification.html
bdf-acceuil.info/ Frame 05DE
29 KB
29 KB
Image
General
Full URL
https://bdf-acceuil.info/Identification.html
Requested by
Host: bdf-acceuil.info
URL: https://bdf-acceuil.info/Identification.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.131.187.252 Zug, Switzerland, ASN211851 (UP-NETWORK UP-NETWORK SWITZERLAND, FR),
Reverse DNS
myrdp.gg
Software
nginx / PleskLin
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bdf-acceuil.info/Identification.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Mon, 01 Aug 2022 01:23:22 GMT
content-encoding
br
last-modified
Wed, 15 Jun 2022 08:07:58 GMT
server
nginx
x-powered-by
PleskLin
etag
W/"62a9935e-736a"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Postale (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| savepage_ShadowLoader

0 Cookies

1 Console Messages

Source Level URL
Text
other warning URL: https://bdf-acceuil.info/(Line 62)
Message:
<link rel=preload> has an invalid `href` value

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15768000; includeSubDomains