lnfoweb-usronline-com.162-0-225-83.cprapid.com
Open in
urlscan Pro
162.0.225.83
Malicious Activity!
Public Scan
Submitted URL: https://cfpj.tg/wp-admin/
Effective URL: https://lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/index.php?&sessionid=174ef5a7b4179648c2b2b99c30f0f47b
Submission: On April 27 via api from CA — Scanned from IT
Effective URL: https://lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/index.php?&sessionid=174ef5a7b4179648c2b2b99c30f0f47b
Submission: On April 27 via api from CA — Scanned from IT
Summary
This website contacted 1 IPs
in 2 countries
across 2 domains to perform 12 HTTP transactions.
The main IP is 162.0.225.83, located in
United States and
belongs to NAMECHEAP-NET, US.
The main domain is lnfoweb-usronline-com.162-0-225-83.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 26th 2023. Valid for: 3 months.
This is the only time lnfoweb-usronline-com.162-0-225-83.cprapid.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 26th 2023. Valid for: 3 months.
This is the only time lnfoweb-usronline-com.162-0-225-83.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNP Paribas (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 154.70.82.246 154.70.82.246 | 30982 (CAFENET) (CAFENET) | |
| 2 14 | 162.0.225.83 162.0.225.83 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
| 12 | 1 |
14
162.0.225.83
(United States)
ASN22612 (NAMECHEAP-NET, US)
PTR: oracleon.co
ASN22612 (NAMECHEAP-NET, US)
PTR: oracleon.co
| lnfoweb-usronline-com.162-0-225-83.cprapid.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
cprapid.com
2 redirects
lnfoweb-usronline-com.162-0-225-83.cprapid.com |
545 KB |
| 1 |
cfpj.tg
1 redirects
cfpj.tg |
495 B |
| 12 | 2 |
| Domain | Requested by | |
|---|---|---|
| 14 | lnfoweb-usronline-com.162-0-225-83.cprapid.com |
2 redirects
lnfoweb-usronline-com.162-0-225-83.cprapid.com
|
| 1 | cfpj.tg | 1 redirects |
| 12 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| banking.bnl.it |
| www.facebook.com |
| twitter.com |
| hellobank.it |
| lifebanker.bnl.it |
| bnl.it |
| www.acf.consob.it |
| www.youtube.com |
| socialwall.bnl.it |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| lnfoweb-usronline-com.162-0-225-83.cprapid.com cPanel, Inc. Certification Authority |
2023-04-26 - 2023-07-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/index.php?&sessionid=174ef5a7b4179648c2b2b99c30f0f47b
Frame ID: ADFCE4EEDB921AACF9F09B8433E17C72
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
LoginPage URL History Show full URLs
-
https://cfpj.tg/wp-admin/
HTTP 302
https://lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/ HTTP 302
https://lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/checkclient.php?&sessionid=174ef5a7b4179648c2b2b99c30f0f47b HTTP 302
https://lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/index.php?&sessionid=174ef5a7b4179648c2b2b99c30f0f47b Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Page Statistics
20 Outgoing links
These are links going to different origins than the main page.
URL: https://banking.bnl.it/rsc/SupportingFiles/numero-cliente.gif
Title: Dove trovi il tuo numero Cliente
Title: Dove trovi il tuo numero Cliente
Search URL Search Domain Scan URL
URL: https://banking.bnl.it/rsc/SupportingFiles/pin.gif
Title: Dove trovi il PIN
Title: Dove trovi il PIN
Search URL Search Domain Scan URL
URL: https://banking.bnl.it/pubblica/RecuperoNumeroCliente
Title: Recupera Online il Numero Cliente
Title: Recupera Online il Numero Cliente
Search URL Search Domain Scan URL
URL: https://www.facebook.com/BNLBNPParibas/
Search URL Search Domain Scan URL
URL: https://twitter.com/bnpparibas
Search URL Search Domain Scan URL
URL: https://hellobank.it/it/home
Search URL Search Domain Scan URL
URL: http://lifebanker.bnl.it/
Search URL Search Domain Scan URL
URL: https://bnl.it/it/Footer/Trasparenza
Search URL Search Domain Scan URL
URL: https://bnl.it/it/Footer/Dati-Societari
Title: DATI SOCIETARI
Title: DATI SOCIETARI
Search URL Search Domain Scan URL
URL: https://bnl.it/it/Footer/Prospetti-Consob
Title: PROSPETTI CONSOB
Title: PROSPETTI CONSOB
Search URL Search Domain Scan URL
URL: https://bnl.it/it/Footer/Reclami-Ricorsi-Conciliazione
Title: RECLAMI-RICORSI-CONCILIAZIONE
Title: RECLAMI-RICORSI-CONCILIAZIONE
Search URL Search Domain Scan URL
URL: https://bnl.it/it/Footer/Richiesta-documenti
Title: RICHIESTA DOCUMENTI
Title: RICHIESTA DOCUMENTI
Search URL Search Domain Scan URL
URL: https://www.acf.consob.it/
Title: ARBITRO CONTROVERSIE FINANZIARIE
Title: ARBITRO CONTROVERSIE FINANZIARIE
Search URL Search Domain Scan URL
URL: https://bnl.it/it/Footer/Privacy
Title: PRIVACY
Title: PRIVACY
Search URL Search Domain Scan URL
URL: https://banking.bnl.it/rsc/SupportingFiles/carta-responsabilita-dati-personali-BNL.pdf
Title: CARTA RESPONSABILITÀ DATI PERSONALI
Title: CARTA RESPONSABILITÀ DATI PERSONALI
Search URL Search Domain Scan URL
URL: https://bnl.it/it/Footer/Note-Legali
Title: NOTE LEGALI
Title: NOTE LEGALI
Search URL Search Domain Scan URL
URL: https://bnl.it/it/Footer/Cookie
Title: COOKIE
Title: COOKIE
Search URL Search Domain Scan URL
URL: https://bnl.it/it/Footer/DAC6
Title: DAC6
Title: DAC6
Search URL Search Domain Scan URL
URL: https://www.youtube.com/user/BNLCHANNEL
Search URL Search Domain Scan URL
URL: http://socialwall.bnl.it/
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cfpj.tg/wp-admin/
HTTP 302
https://lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/ HTTP 302
https://lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/checkclient.php?&sessionid=174ef5a7b4179648c2b2b99c30f0f47b HTTP 302
https://lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/index.php?&sessionid=174ef5a7b4179648c2b2b99c30f0f47b Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.php
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/ Redirect Chain
|
58 KB 58 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
hb-login.css
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/Login_files/ |
7 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clientlib-redational-page-login.min.css
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/Login_files/ |
431 KB 431 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/Login_files/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
alert.png
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/Login_files/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
trasparenza_BNL-1.jpg
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/it/Login_files/ |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bnpp-sans.woff
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/bnl/clientlibs/clientlib-all/resources/fonts/bnpp-sans/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bnpp-sans-bold.woff
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/bnl/clientlibs/clientlib-all/resources/fonts/bnpp-sans/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bnpp-sans-light.woff
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/bnl/clientlibs/clientlib-all/resources/fonts/bnpp-sans/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bnpp-sans-light.ttf
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/bnl/clientlibs/clientlib-all/resources/fonts/bnpp-sans/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bnpp-sans-bold.ttf
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/bnl/clientlibs/clientlib-all/resources/fonts/bnpp-sans/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bnpp-sans.ttf
lnfoweb-usronline-com.162-0-225-83.cprapid.com/nha-uis/bnl/clientlibs/clientlib-all/resources/fonts/bnpp-sans/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNP Paribas (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| cfpj.tg/ | Name: PHPSESSID Value: e9791656c6854d057034632ecb8aa9b4 |
|
| lnfoweb-usronline-com.162-0-225-83.cprapid.com/ | Name: PHPSESSID Value: kuojrdgchlt5ki1hqbmmhtb1s4 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cfpj.tg
lnfoweb-usronline-com.162-0-225-83.cprapid.com
154.70.82.246
162.0.225.83
24b7fc7a5247a3ccb0216515023889adce611b2ca852efd2223509caeb81b9a9
31e77ecae8b2766fbe277dd3dcf6be2c5872d6a5f1836e123b73a6b02c204874
715aa3efe054a88bca7c4e60ca19624d25467ae940ac0f6e460d5e5b1d5ea7ae
99543d933ae6c6b53aa79a42deb665f785cba48b798e0420ae34e835a588f018
c80340631e196bec4044f28694a04250f3184330be4a27ac256b555f8327de66
e4d615de09a41c8c2d8d395a3ab156ce9520a9fc96c23b1780bb2adab4292b67