www.help.lidarusa.com Open in urlscan Pro
173.254.30.18 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Effective URL:
https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Submission: On September 13 via api (September 13th 2024, 10:49:01 pm UTC) from BE — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 173.254.30.18, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is www.help.lidarusa.com.
TLS certificate: Issued by R11 on August 17th 2024. Valid for: 3 months.

This is the only time www.help.lidarusa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Postale (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	173.254.30.18 173.254.30.18	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
2	2606:4700::68... 2606:4700::6812:bb1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
12	3

9 173.254.30.18 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: just2081.justhost.com

www.help.lidarusa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bb1f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	lidarusa.com www.help.lidarusa.com	289 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 314	49 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 808	30 KB
12	3

	Domain	Requested by
9	www.help.lidarusa.com	www.help.lidarusa.com
2	cdn.jsdelivr.net	www.help.lidarusa.com
1	code.jquery.com	www.help.lidarusa.com
12	3

This site contains no links.

Subject Issuer	Validity	Valid
www.help.lidarusa.com R11	`2024-08-17` - `2024-11-15`	3 months	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2024-05-04` - `2025-05-04`	a year	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Frame ID: 882500684CE1BC55949C4FD531CCDE00
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Connexion à l'espace client - La Banque Postale

Page URL History Show full URLs

http://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html HTTP 307
https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

12
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

369 kB
Transfer

623 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html HTTP 307
https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login.html Show response
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/
Redirect Chain

http://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html

9 KB
2 KB

832ms
219ms

Document
text/html

173.254.30.18
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.254.30.18 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: just2081.justhost.com
Software: Apache /
Resource Hash: 94198011e12bfd4bc5862118a4c33bf8154587e2f7a2d4ff444b3c249207837d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 2356
content-type: text/html
date: Fri, 13 Sep 2024 22:48:56 GMT
last-modified: Thu, 22 Aug 2024 22:45:31 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

Location: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.1.0/dist/css/ 159 KB
26 KB 41ms
21ms Stylesheet
text/css 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.1.0/dist/css/bootstrap.min.css

Requested by

Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cfc391e34328c09f0680ae8ff3d63e86224ae7e71c973147ccb84540b2fdd9b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.help.lidarusa.com/
Origin: https://www.help.lidarusa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 11288382
x-jsd-version: 5.1.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 26318
x-served-by: cache-fra-etou8220112-FRA, cache-lga21963-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"27ba0-OW9RszP/bwkm9uZ61ubJxpvqezE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H%2FJHbNGqoWASxLHeV8goiqQ99PYAtG0fCtlBnWB0MZg6HAb4RdBKtlkbSY03qx%2FE5FdGBOOSRoOq2PK1EAhRyI5SssMuZfJ700aGqaVn%2FBe69K7y3iZ6nRxdiDNo33koDAaZzGwNYaPA2ngixfI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8c2bb00938f59f57-FRA

GET
H2 200 style.css
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/css/ 4 KB
2 KB 321ms
320ms Stylesheet
text/html 173.254.30.18
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/css/style.css
Requested by: Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.254.30.18 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: just2081.justhost.com
Software: Apache /
Resource Hash: 9e05eb1b8d82eead7f296e737930cc0d17d5c2c47181dd4776dd754100f6ad6a

Request headers

Referer: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
content-encoding: gzip
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
accept-ranges: bytes
content-length: 2177

GET
H2 200 entete1lg.PNG
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/ 21 KB
21 KB 320ms
319ms Image
image/png 173.254.30.18
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/entete1lg.PNG
Requested by: Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.254.30.18 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: just2081.justhost.com
Software: Apache /
Resource Hash: 7a1869e5121a1c30a84fae58230d40d839ede372d0fadc09d0dddf9962a8dbe1

Request headers

Referer: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
last-modified: Thu, 22 Aug 2024 22:45:31 GMT
server: Apache
accept-ranges: bytes
content-length: 21762
content-type: image/png

GET
H2 200 entete1_mobile.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/ 14 KB
14 KB 164ms
163ms Image
image/png 173.254.30.18
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/entete1_mobile.png
Requested by: Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.254.30.18 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: just2081.justhost.com
Software: Apache /
Resource Hash: 8f59ac44ac068ec5daba5d7d138d01b1ae964309fdabbbc3597cb30717728a96

Request headers

Referer: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
last-modified: Thu, 22 Aug 2024 22:45:31 GMT
server: Apache
accept-ranges: bytes
content-length: 14048
content-type: image/png

GET
H2 200 right.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/ 20 KB
20 KB 625ms
624ms Image
image/png 173.254.30.18
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/right.png
Requested by: Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.254.30.18 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: just2081.justhost.com
Software: Apache /
Resource Hash: 1e114c89ff68be36510b55b46a624ae63b8b24fbf3584b7cab06242908bfd09b

Request headers

Referer: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
last-modified: Thu, 22 Aug 2024 22:45:31 GMT
server: Apache
accept-ranges: bytes
content-length: 20656
content-type: image/png

GET
H2 200 pied.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/ 161 KB
161 KB 465ms
464ms Image
image/png 173.254.30.18
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/pied.png
Requested by: Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.254.30.18 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: just2081.justhost.com
Software: Apache /
Resource Hash: ffdb5c265a56f6bb15f88ec2327d9265719a0b632a34387b3b91d669d5291764

Request headers

Referer: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
last-modified: Thu, 22 Aug 2024 22:45:31 GMT
server: Apache
accept-ranges: bytes
content-length: 164393
content-type: image/png

GET
H2 200 pied_mobile.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/ 66 KB
66 KB 626ms
625ms Image
image/png 173.254.30.18
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/img/pied_mobile.png
Requested by: Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.254.30.18 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: just2081.justhost.com
Software: Apache /
Resource Hash: 487bf16b7670bc59adc08ebc69239b4c6b614a0a9349a6b25c330ddf69adaca6

Request headers

Referer: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
last-modified: Thu, 22 Aug 2024 22:45:31 GMT
server: Apache
accept-ranges: bytes
content-length: 67447
content-type: image/png

GET
H2 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.1.1/dist/js/ 77 KB
23 KB 32ms
23ms Script
application/javascript 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.1.1/dist/js/bootstrap.bundle.min.js

Requested by

Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5a12b84f9543d5ba3231837c2f2467563405aa66a582b6fc400985f85df49ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.help.lidarusa.com/
Origin: https://www.help.lidarusa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 11442122
x-jsd-version: 5.1.1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 22647
x-served-by: cache-fra-etou8220091-FRA, cache-lga21956-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"13417-CF7M/QNtoe32ATiKaM/lyzFrHiw"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t%2Fik2hqMNH4C6pustCAiGQT%2FOTUBFq%2FtAyfF5aPUY2%2B9QIBcA19r9jd3sPeEUojxFa0xksHPVqE1Mc%2F2a%2BgJ%2F%2FceZvkn4NFMhukRuFHBpafI6g%2BzqV%2BCR8i396tI%2BQCrYOwpvi0%2FgIA2G5Rdm%2B4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8c2bb00938f79f57-FRA

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 32ms
7ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://www.help.lidarusa.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1424467
x-cache: HIT, HIT
content-length: 30879
x-served-by: cache-lga21981-LGA, cache-fra-eddf8230037-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1726267737.533247,VS0,VE0
etag: W/"28feccc0-15d84"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 9, 171398

GET
H2 200 script.js Show response
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/js/ 3 KB
803 B 624ms
624ms Script
application/javascript 173.254.30.18
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/asset/js/script.js
Requested by: Host: www.help.lidarusa.com
URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.254.30.18 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: just2081.justhost.com
Software: Apache /
Resource Hash: 5de2ec70d42d6ae4bc6e1a5805198e78e6ad6e356b759bd59d2fa26d79df16d5

Request headers

Referer: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:56 GMT
content-encoding: gzip
last-modified: Thu, 22 Aug 2024 22:45:31 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 754

GET
H2 200 favicon.png
www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/assets/images/ 2 KB
2 KB 164ms
164ms Other
image/png 173.254.30.18
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/assets/images/favicon.png
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.254.30.18 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: just2081.justhost.com
Software: Apache /
Resource Hash: cb3747dbd4cfbfa4a3e32ad8d8d463a717283dbf3b343c8d2cf86385aeccd573

Request headers

Referer: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 22:48:57 GMT
last-modified: Sat, 17 Aug 2024 12:28:12 GMT
server: Apache
accept-ranges: bytes
content-length: 2142
content-type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Postale (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| uidEvent object| bootstrap function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html Message: [DOM] Found 5 elements with non-unique id #: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation	warning	URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html Message: [DOM] Found 11 elements with non-unique id #btn: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o %o %o %o %o %o %o
recommendation	verbose	URL: https://www.help.lidarusa.com/zaqs/Bpostale2022/Bpostale2022/6e6352415a06418/login.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
www.help.lidarusa.com
173.254.30.18
2606:4700::6812:bb1f
2a04:4e42:200::649
1e114c89ff68be36510b55b46a624ae63b8b24fbf3584b7cab06242908bfd09b
487bf16b7670bc59adc08ebc69239b4c6b614a0a9349a6b25c330ddf69adaca6
5de2ec70d42d6ae4bc6e1a5805198e78e6ad6e356b759bd59d2fa26d79df16d5
7a1869e5121a1c30a84fae58230d40d839ede372d0fadc09d0dddf9962a8dbe1
8f59ac44ac068ec5daba5d7d138d01b1ae964309fdabbbc3597cb30717728a96
94198011e12bfd4bc5862118a4c33bf8154587e2f7a2d4ff444b3c249207837d
9e05eb1b8d82eead7f296e737930cc0d17d5c2c47181dd4776dd754100f6ad6a
cb3747dbd4cfbfa4a3e32ad8d8d463a717283dbf3b343c8d2cf86385aeccd573
cfc391e34328c09f0680ae8ff3d63e86224ae7e71c973147ccb84540b2fdd9b8
e5a12b84f9543d5ba3231837c2f2467563405aa66a582b6fc400985f85df49ad
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
ffdb5c265a56f6bb15f88ec2327d9265719a0b632a34387b3b91d669d5291764

www.help.lidarusa.com Open in urlscan Pro 173.254.30.18 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

369 kBTransfer

623 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

www.help.lidarusa.com Open in urlscan Pro
173.254.30.18 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

369 kB
Transfer

623 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!