urlscan.io logo urlscan.io
SecurityTrails logo

aflossing-nld858218.otzo.com Open in urlscan Pro
94.156.71.63  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://aflossing-nld858218.otzo.com/
Submission: On April 22 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 11 HTTP transactions. The main IP is 94.156.71.63, located in Bulgaria and belongs to LIMENET, US. The main domain is aflossing-nld858218.otzo.com.
TLS certificate: Issued by R3 on April 22nd 2024. Valid for: 3 months.
This is the only time aflossing-nld858218.otzo.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NL Government (Government)

Domain & IP information

IP Address AS Autonomous System
5 94.156.71.63 394711 (LIMENET)
3 2a04:9a00:101... 212157 (LOGIUS-AZ-1)
1 149.154.164.13 62041 (TELEGRAM)
11 4
Apex Domain
Subdomains		 Transfer
5 otzo.com
aflossing-nld858218.otzo.com
162 KB
3 digid.nl
digid.nl — Cisco Umbrella Rank: 108151
33 KB
1 telegra.ph
telegra.ph — Cisco Umbrella Rank: 77993
27 KB
0 werkenvoor.be Failed
werkenvoor.be Failed
11 4
Domain Requested by
5 aflossing-nld858218.otzo.com aflossing-nld858218.otzo.com
3 digid.nl aflossing-nld858218.otzo.com
1 telegra.ph aflossing-nld858218.otzo.com
0 werkenvoor.be Failed aflossing-nld858218.otzo.com
11 4

This site contains links to these domains. Also see Links.

Domain
financien.belgium.be
tikkie.me
Subject Issuer Validity Valid
aflossing-nld858218.otzo.com
R3		 2024-04-22 -
2024-07-21		 3 months crt.sh
digid.nl
QuoVadis Europe SSL CA G2		 2023-08-28 -
2024-08-28		 a year crt.sh
*.telegra.ph
Go Daddy Secure Certificate Authority - G2		 2023-09-05 -
2024-10-06		 a year crt.sh

This page contains 1 frames:

Primary Page: https://aflossing-nld858218.otzo.com/
Frame ID: C72C40B18A4077163AF1A36E9480AB4D
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Controleer het gebruik van uw account.

Page Statistics

11
Requests

82 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

222 kB
Transfer

302 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://client.selor.be/img/federale_overheid_logo.png HTTP 301
  • https://workingfor.be/language_selection_page HTTP 301
  • https://workingfor.be/nl/language_selection_page HTTP 301
  • https://werkenvoor.be/nl/language_selection_page HTTP 302
  • https://werkenvoor.be/nl

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
aflossing-nld858218.otzo.com/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://aflossing-nld858218.otzo.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.71.63 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
nginx / PHP/8.2.18 PleskLin
Resource Hash
20ca43e6cc0848f04b506407d478bc63a961e8041f7e011f107a5a14ca1a839f

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-encoding
gzip
content-length
2349
content-type
text/html; charset=UTF-8
date
Mon, 22 Apr 2024 18:43:53 GMT
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.2.18 PleskLin
style.css
aflossing-nld858218.otzo.com/files/ 		83 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aflossing-nld858218.otzo.com/files/style.css
Requested by
Host: aflossing-nld858218.otzo.com
URL: https://aflossing-nld858218.otzo.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.71.63 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
87fb9c3207fdfcc161f73fe9be582e9ed7860e39fd99cffb416612827db88dbd

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://aflossing-nld858218.otzo.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 22 Apr 2024 18:43:53 GMT
content-encoding
br
last-modified
Tue, 22 Nov 2022 10:21:38 GMT
server
nginx
etag
W/"637ca2b2-14c55"
x-powered-by
PleskLin
content-type
text/css
RO_DigiD_Logo_Homepage-98037d2a69f1bbe535478420a93e0ed9d1888c4f956e6994fbb1f58b2a258910.svg
digid.nl/assets/ 		21 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://digid.nl/assets/RO_DigiD_Logo_Homepage-98037d2a69f1bbe535478420a93e0ed9d1888c4f956e6994fbb1f58b2a258910.svg
Requested by
Host: aflossing-nld858218.otzo.com
URL: https://aflossing-nld858218.otzo.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a04:9a00:1010:1900::a , Netherlands, ASN212157 (LOGIUS-AZ-1, NL),
Reverse DNS
Software
/
Resource Hash
345fece8164e7c89abdcac29f20c438ca6b74414af1373642da630abd862da97
Security Headers
Name Value
Content-Security-Policy default-src 'self'; base-uri 'self'; font-src 'self' data:; img-src 'self' data: https://statistiek.digid.nl; object-src 'none'; script-src 'self'; style-src 'self'; frame-src 'self'; frame-ancestors 'none'; form-action 'self' https:
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://aflossing-nld858218.otzo.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
default-src 'self'; base-uri 'self'; font-src 'self' data:; img-src 'self' data: https://statistiek.digid.nl; object-src 'none'; script-src 'self'; style-src 'self'; frame-src 'self'; frame-ancestors 'none'; form-action 'self' https:
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
Last-Modified
Mon, 15 Jan 2024 13:02:27 GMT
Date
Mon, 22 Apr 2024 18:43:53 GMT
Age
22647
X-Frame-Options
sameorigin
Content-Type
image/svg+xml
Cache-Control
max-age=315360000, public
Permissions-Policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=()
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
21493
Expires
Thu, 20 Apr 2034 12:26:27 GMT
nl
werkenvoor.be/
Redirect Chain
  • https://client.selor.be/img/federale_overheid_logo.png
  • https://workingfor.be/language_selection_page
  • https://workingfor.be/nl/language_selection_page
  • https://werkenvoor.be/nl/language_selection_page
  • https://werkenvoor.be/nl
0
0
5ee431033ca7d0f3ccc1f.jpg
telegra.ph/file/ 		28 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://telegra.ph/file/5ee431033ca7d0f3ccc1f.jpg
Requested by
Host: aflossing-nld858218.otzo.com
URL: https://aflossing-nld858218.otzo.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.154.164.13 London, United Kingdom, ASN62041 (TELEGRAM, VG),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
9a17a5d2ddd5291493400933a23ce7b69b3a1f83ae2791ad672424e4d482a94c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://aflossing-nld858218.otzo.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 22 Apr 2024 18:43:53 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
nginx/1.20.1
etag
"764dfbdff30798e071be05f1d5bde772f4338d26"
content-type
image/jpeg
cache-control
max-age=10800, must-revalidate
content-length
27718
expires
Mon, 22 Apr 2024 21:43:53 GMT
ROsanswebtextregular-54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a.woff
aflossing-nld858218.otzo.com/files/ 		75 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://aflossing-nld858218.otzo.com/files/ROsanswebtextregular-54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a.woff
Requested by
Host: aflossing-nld858218.otzo.com
URL: https://aflossing-nld858218.otzo.com/files/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.71.63 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://aflossing-nld858218.otzo.com/files/style.css
Origin
https://aflossing-nld858218.otzo.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 22 Apr 2024 18:43:53 GMT
last-modified
Tue, 22 Nov 2022 10:21:38 GMT
server
nginx
etag
"637ca2b2-12ac9"
x-powered-by
PleskLin
content-type
font/woff
accept-ranges
bytes
content-length
76489
ROsanswebtextbold-27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591.woff
aflossing-nld858218.otzo.com/files/ 		68 KB
68 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://aflossing-nld858218.otzo.com/files/ROsanswebtextbold-27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591.woff
Requested by
Host: aflossing-nld858218.otzo.com
URL: https://aflossing-nld858218.otzo.com/files/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.71.63 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://aflossing-nld858218.otzo.com/files/style.css
Origin
https://aflossing-nld858218.otzo.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 22 Apr 2024 18:43:53 GMT
last-modified
Tue, 22 Nov 2022 10:21:38 GMT
server
nginx
etag
"637ca2b2-10f5b"
x-powered-by
PleskLin
content-type
font/woff
accept-ranges
bytes
content-length
69467
icons-650b3ba27798de4eaf8cfc95c3ef953beff6658da3a4cfc5762c77eeb050a630.woff2
aflossing-nld858218.otzo.com/files/ 		3 KB
3 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://aflossing-nld858218.otzo.com/files/icons-650b3ba27798de4eaf8cfc95c3ef953beff6658da3a4cfc5762c77eeb050a630.woff2
Requested by
Host: aflossing-nld858218.otzo.com
URL: https://aflossing-nld858218.otzo.com/files/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.71.63 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
650b3ba27798de4eaf8cfc95c3ef953beff6658da3a4cfc5762c77eeb050a630

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://aflossing-nld858218.otzo.com/files/style.css
Origin
https://aflossing-nld858218.otzo.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 22 Apr 2024 18:43:53 GMT
last-modified
Tue, 22 Nov 2022 10:21:38 GMT
server
nginx
etag
"637ca2b2-a98"
x-powered-by
PleskLin
content-type
font/woff2
accept-ranges
bytes
content-length
2712
ro-favicon-wit-0xffffff-2e5a36a1132248f4104f3d5cab9c0632fa25d18a9a7054ac3ee23aaf3d9d037e.png
digid.nl/assets/ 		0
0
digid_eo_rgb_152x152-bd3fb46ddf93b5f703bfddd728de5db021901419413eca931d7c13b40a4497a1.png
digid.nl/assets/ 		10 KB
11 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://digid.nl/assets/digid_eo_rgb_152x152-bd3fb46ddf93b5f703bfddd728de5db021901419413eca931d7c13b40a4497a1.png
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a04:9a00:1010:1900::a , Netherlands, ASN212157 (LOGIUS-AZ-1, NL),
Reverse DNS
Software
/
Resource Hash
abf5d94a8865f19fb00e915e719b58d7484003bb2bb4f5a3eddbf431eca04b34
Security Headers
Name Value
Content-Security-Policy default-src 'self'; base-uri 'self'; font-src 'self' data:; img-src 'self' data: https://statistiek.digid.nl; object-src 'none'; script-src 'self'; style-src 'self'; frame-src 'self'; frame-ancestors 'none'; form-action 'self' https:
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://aflossing-nld858218.otzo.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
default-src 'self'; base-uri 'self'; font-src 'self' data:; img-src 'self' data: https://statistiek.digid.nl; object-src 'none'; script-src 'self'; style-src 'self'; frame-src 'self'; frame-ancestors 'none'; form-action 'self' https:
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
Last-Modified
Mon, 15 Jan 2024 13:02:27 GMT
Date
Mon, 22 Apr 2024 18:43:54 GMT
Age
58017
X-Frame-Options
sameorigin
Content-Type
image/png
Cache-Control
max-age=315360000, public
Permissions-Policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=()
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
9849
Expires
Mon, 22 Apr 2024 19:43:54 GMT
digid_eo_rgb_152x152-bd3fb46ddf93b5f703bfddd728de5db021901419413eca931d7c13b40a4497a1.png
digid.nl/assets/ 		10 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
https://digid.nl/assets/digid_eo_rgb_152x152-bd3fb46ddf93b5f703bfddd728de5db021901419413eca931d7c13b40a4497a1.png
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a04:9a00:1010:1900::a , Netherlands, ASN212157 (LOGIUS-AZ-1, NL),
Reverse DNS
Software
/
Resource Hash
abf5d94a8865f19fb00e915e719b58d7484003bb2bb4f5a3eddbf431eca04b34
Security Headers
Name Value
Content-Security-Policy default-src 'self'; base-uri 'self'; font-src 'self' data:; img-src 'self' data: https://statistiek.digid.nl; object-src 'none'; script-src 'self'; style-src 'self'; frame-src 'self'; frame-ancestors 'none'; form-action 'self' https:
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://aflossing-nld858218.otzo.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
default-src 'self'; base-uri 'self'; font-src 'self' data:; img-src 'self' data: https://statistiek.digid.nl; object-src 'none'; script-src 'self'; style-src 'self'; frame-src 'self'; frame-ancestors 'none'; form-action 'self' https:
Date
Mon, 22 Apr 2024 18:43:54 GMT
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
Last-Modified
Mon, 15 Jan 2024 13:02:27 GMT
Age
58017
X-Frame-Options
sameorigin
Content-Type
image/png
Cache-Control
max-age=315360000, public
Permissions-Policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=()
Accept-Ranges
bytes
Content-Length
9849
Expires
Mon, 22 Apr 2024 19:43:54 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
werkenvoor.be
URL
https://werkenvoor.be/nl
Domain
digid.nl
URL
https://digid.nl/assets/ro-favicon-wit-0xffffff-2e5a36a1132248f4104f3d5cab9c0632fa25d18a9a7054ac3ee23aaf3d9d037e.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NL Government (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies