tudip.fr
Open in
urlscan Pro
193.252.114.10
Malicious Activity!
Public Scan
URL:
http://tudip.fr/passthru/fe1d6e4b116c8427144660c22b403664/index.php?63a5048556c2d45b4403e0e8ea8b4245%3Fdispatch=...
Submission Tags: @ipnigh
Submission: On June 23 via api from GB
Submission Tags: @ipnigh
Submission: On June 23 via api from GB
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 5 HTTP transactions.
The main IP is 193.252.114.10, located in
France and
belongs to AS3215, FR.
The main domain is tudip.fr.
This is the only time tudip.fr was scanned on urlscan.io!
This is the only time tudip.fr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Apple (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 193.252.114.10 193.252.114.10 | 3215 (AS3215) (AS3215) | |
| 5 | 1 |
| Domain | Requested by | |
|---|---|---|
| 5 | tudip.fr |
tudip.fr
|
| 5 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| 1970-01-01 - 1970-01-01 |
a few seconds | crt.sh |
This page contains 1 frames:
Primary Page:
http://tudip.fr/passthru/fe1d6e4b116c8427144660c22b403664/index.php?63a5048556c2d45b4403e0e8ea8b4245%3Fdispatch=Z6riQGwYFyDPLkeCoD8JBBp8RGjfLaxKhZ27Fz6k7K9T5owt2E
Frame ID: 574F8D1C281CB064B14325DA439ABA41
Requests: 5 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
index.php
tudip.fr/passthru/fe1d6e4b116c8427144660c22b403664/ |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.css
tudip.fr/passthru/fe1d6e4b116c8427144660c22b403664/css/ |
3 KB 907 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
blank.gif
tudip.fr/passthru/fe1d6e4b116c8427144660c22b403664/images/ |
43 B 293 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.PNG
tudip.fr/passthru/fe1d6e4b116c8427144660c22b403664/images/ |
30 KB 31 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
next.png
tudip.fr/passthru/fe1d6e4b116c8427144660c22b403664/images/ |
549 B 801 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Apple (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| tudip.fr/ | Name: BIGipServerOBS_www3-oh-http Value: 2550245568.20480.0000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
tudip.fr
193.252.114.10
0d5a2c6816286bdb36d122fe544f1aeca41fa1e3c28a967637f9a8ddf6b274fc
61ed133dc0d8df6b1cec77cf9e7616b0394d7e6237efb1c20dd781cd9d486e23
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
cc96a9c119a733faf489fffdbed49cd8843fb52f15f07e73df5fb53dc4dcce3c
dda29232b625aebe3272c83993a1b7dfe0571534b74aefa5c4b4fa195e135852