lclcertico.temp.swtest.ru
Open in
urlscan Pro
77.222.56.111
Malicious Activity!
Public Scan
Submission: On November 06 via automatic, source openphish — Scanned from DE
Summary
This is the only time lclcertico.temp.swtest.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Crédit Lyonnais (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
27 | 77.222.56.111 77.222.56.111 | 44112 (SWEB-AS) (SWEB-AS) | |
2 | 176.34.115.34 176.34.115.34 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 176.34.125.229 176.34.125.229 | 16509 (AMAZON-02) (AMAZON-02) | |
31 | 3 |
ASN44112 (SWEB-AS, RU)
PTR: vh291.sweb.ru
lclcertico.temp.swtest.ru |
ASN16509 (AMAZON-02, US)
PTR: ec2-176-34-115-34.eu-west-1.compute.amazonaws.com
img-fdb.tech.lcl.fr |
ASN16509 (AMAZON-02, US)
PTR: ec2-176-34-125-229.eu-west-1.compute.amazonaws.com
front.tech.lcl.fr |
Apex Domain Subdomains |
Transfer | |
---|---|---|
27 |
swtest.ru
lclcertico.temp.swtest.ru |
377 KB |
4 |
lcl.fr
img-fdb.tech.lcl.fr front.tech.lcl.fr |
134 KB |
31 | 2 |
Domain | Requested by | |
---|---|---|
27 | lclcertico.temp.swtest.ru |
lclcertico.temp.swtest.ru
img-fdb.tech.lcl.fr |
2 | front.tech.lcl.fr |
lclcertico.temp.swtest.ru
|
2 | img-fdb.tech.lcl.fr |
lclcertico.temp.swtest.ru
|
31 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.lcl.fr |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://lclcertico.temp.swtest.ru/LCL/web/index.php?client_id=Control81613&csrf=ad1fec37353ab0d987b2e0f2f5393749945ac9b1
Frame ID: DE8A3888230A5E08BCD7EDFC1347C46A
Requests: 31 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Identifiant oublié ?
Search URL Search Domain Scan URL
Title: En savoir plus
Search URL Search Domain Scan URL
Title: Se rendre sur LCL sécurité
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.php
lclcertico.temp.swtest.ru/LCL/web/ |
59 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.d2286c444e7d586caa1a.css
lclcertico.temp.swtest.ru/LCL/web/content/ |
28 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fbevents.js
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
exec.js
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6565729.js
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tro.js
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cc.js
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
envCheck.js
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
YXMFT
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SJKJt
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SJKJt(1)
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newJsLibCLI.js
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cc.js
img-fdb.tech.lcl.fr/9874703/ |
66 KB 30 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
envCheck.js
front.tech.lcl.fr/9874703/ |
71 KB 37 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cc.js
img-fdb.tech.lcl.fr/9874703/ |
66 KB 30 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
envCheck.js
front.tech.lcl.fr/9874703/ |
71 KB 37 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.b67cae54f399508c58a3.svg
lclcertico.temp.swtest.ru/LCL/web/content/ |
27 KB 10 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-page-background.ebdfc9d931825723e5ed.jpg
lclcertico.temp.swtest.ru/LCL/web/content/ |
351 KB 351 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow_links.137972582ca1a7182dfa.svg
lclcertico.temp.swtest.ru/LCL/web/content/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-latin-700.7dbcc8a5ea2289d83f65.woff2
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-latin-400.b71748ae4f80ec8c014d.woff2
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-latin-600.0480d2f8a71f38db8633.woff2
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-latin-500.091b209546e16313fd4f.woff2
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
roboto-mono-latin-400.fe990f0633a16121db07.woff2
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-latin-700.99271a835e1cae8c76ef.woff
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-latin-400.0659a9f4e90db5cf51b5.woff
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-latin-600.b77863a375260a05dd13.woff
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-latin-500.edd311588712a96bbf43.woff
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
roboto-mono-latin-400.1ed72cb00dc79e545eb2.woff
lclcertico.temp.swtest.ru/LCL/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
YXMFT
lclcertico.temp.swtest.ru/LCL/web/false/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
YXMFT
lclcertico.temp.swtest.ru/LCL/web/false/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Crédit Lyonnais (Banking)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| addtopass function| clearcode function| submitcodelog object| ___sc9874703 object| ___so9874703 function| lineInfo number| CLIWHIT string| PSESSIONID string| SSESSIONID object| regex object| match string| LSESSIONID object| __tp number| __gt object| M2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
lclcertico.temp.swtest.ru/ | Name: LSESSIONID Value: eyJpIjoiN25qT3BQK3BTaVh3MkZRZWxsdlwvQlE9PSIsImUiOiJkcnZYT3dLMFpzdWRYR1h0SXRMc0NpdG0rdlUyOEZtN3pRU1Y3b0Yrczl0bFVja2xJcXpUc0Rka2lEb3NoeHJjSHRQMDhkVWVcL080RkRpdld5aHc3Z1pqclFZeStPVVpmVkZlUmhwMWNlWURET0ZlUjRtWFpMN2FyWnp1NHRrbHFPbmlHRmQ1cjZOWCt2UXFtaXEwV2pBPT0ifQ%3D%3D.5932212050de61a7.OGM1M2JjNjgzM2I5YzJlM2I1M2EzOTdkNWJkOTM3MDlhMWQ0ZGQ3MjA0NmNhNjYzNzNjZGM2NmJjN2VjNzdjOQ%3D%3D |
|
lclcertico.temp.swtest.ru/ | Name: ___so9874703 Value: eyJsc2giOjE0MTUxMTkzOTAsInJlZmVycmVyIjoiaHR0cDovL2xjbGNlcnRpY28udGVtcC5zd3Rlc3QucnUvTENML3dlYi9pbmRleC5waHA%2FY2xpZW50X2lkPUNvbnRyb2w4MTYxMyZjc3JmPWFkMWZlYzM3MzUzYWIwZDk4N2IyZTBmMmY1MzkzNzQ5OTQ1YWM5YjEiLCJzZCI6bnVsbCwic2RjIjpudWxsfQ%3D%3D |
22 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
front.tech.lcl.fr
img-fdb.tech.lcl.fr
lclcertico.temp.swtest.ru
176.34.115.34
176.34.125.229
77.222.56.111
3afd6f9947d61be0f23cb77094bcbc8013f703afa81213b69e6283d0763cf4fa
3d8affa7dfa5e50d4c2bb5328dc549f2cd40403fae5f3b90249a7160d92e3385
43c62d8fd7c9371692d2d0f64ec572aebd84f24d53409035fe87d51b231e935c
54cb09e2681221ef80aae060e1bee8f3b585125739508eeda805cca6436ea0cc
5a447b0ee932cde3ebd1124a9707e77d7e7cf90d0cd965a1364f8fa21434f243
a63c33df126591e8c011f87494e52f5fd8bd53d60957960e2629ffe4db48e2ca
ab5acb16acd36dfdbde548fbb8e68e851f6f03c3cf8fac9b35b1c943160b9b2a
b0606f6d85632a232a60b68fcb3abd5b05ffaf6e27cb0a202970507144582b60
d45122ba12a03987b0366449d069c9200ce18c1164af06fe7882a14de4c70dfc