toeslag-beveiligd.xyz Open in urlscan Pro
185.117.73.42 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://toeslag-beveiligd.xyz/sns
Effective URL:
http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/
Submission: On August 12 via automatic, source openphish (August 12th 2021, 1:32:56 pm UTC)

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 17 HTTP transactions. The main IP is 185.117.73.42, located in Amsterdam, Netherlands and belongs to HS, AE. The main domain is toeslag-beveiligd.xyz.

This is the only time toeslag-beveiligd.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: SNS Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3 16	185.117.73.42 185.117.73.42	60117 (HS) (HS)
4	194.36.189.184 194.36.189.184	60117 (HS) (HS)
17	3

16 185.117.73.42 (Amsterdam, Netherlands) 3 redirects

ASN60117 (HS, AE)
PTR: easy-loan.club

toeslag-beveiligd.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 194.36.189.184 (Capelle aan den IJssel, Netherlands)

ASN60117 (HS, AE)

thuisbasis.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	toeslag-beveiligd.xyz 3 redirects toeslag-beveiligd.xyz	648 KB
4	thuisbasis.icu thuisbasis.icu	1 KB
17	2

	Domain	Requested by
16	toeslag-beveiligd.xyz	3 redirects toeslag-beveiligd.xyz
4	thuisbasis.icu	toeslag-beveiligd.xyz
17	2

This site contains no links.

Subject Issuer	Validity	Valid
thuisbasis.icu R3	`2021-08-09` - `2021-11-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/
Frame ID: 38B6C6CC22AC6FA5AA71CBA2FE01098E
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://toeslag-beveiligd.xyz/sns HTTP 301
http://toeslag-beveiligd.xyz/sns/ Page URL
http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c HTTP 301
http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/ HTTP 302
http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/ Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

17
Requests

24 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

648 kB
Transfer

897 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://toeslag-beveiligd.xyz/sns HTTP 301
http://toeslag-beveiligd.xyz/sns/ Page URL
http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c HTTP 301
http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/ HTTP 302
http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://toeslag-beveiligd.xyz/sns HTTP 301
http://toeslag-beveiligd.xyz/sns/

17 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set / Show response toeslag-beveiligd.xyz/sns/ Redirect Chain http://toeslag-beveiligd.xyz/sns http://toeslag-beveiligd.xyz/sns/	728 B 724 B	42ms 41ms	Document text/html	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/ Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `b52b609ff955a450295792d68b2d914f5f2bc0ff28170727c1ff76140c1932ef` Request headers Host toeslag-beveiligd.xyz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:28 GMT Server Apache/2.4.18 (Ubuntu) Set-Cookie real=OK Vary Accept-Encoding Content-Encoding gzip Content-Length 452 Keep-Alive timeout=5, max=88 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Thu, 12 Aug 2021 13:31:28 GMT Server Apache/2.4.18 (Ubuntu) Location http://toeslag-beveiligd.xyz/sns/ Content-Length 328 Keep-Alive timeout=5, max=89 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	Primary Request / Show response toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/ Redirect Chain http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c? http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/? http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/?	66 KB 18 KB	44ms 44ms	Document text/html	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/ Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `c19eef9313e21f73c8eac2e81d1ad7434c8262f5b36a426f0af91fcbaaffe420` Request headers Host toeslag-beveiligd.xyz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://toeslag-beveiligd.xyz/sns/ Accept-Encoding gzip, deflate Accept-Language en-US Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer http://toeslag-beveiligd.xyz/sns/ Response headers Date Thu, 12 Aug 2021 13:31:29 GMT Server Apache/2.4.18 (Ubuntu) Cache-Control no-cache, no-store, must-revalidate Pragma no-cache Expires 0 Vary Accept-Encoding Content-Encoding gzip Content-Length 17640 Keep-Alive timeout=5, max=85 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Thu, 12 Aug 2021 13:31:29 GMT Server Apache/2.4.18 (Ubuntu) Set-Cookie bid=d13c21864def6ea8cf7290d424a5cd6c; expires=Sat, 11-Sep-2021 13:31:29 GMT; Max-Age=2592000; path=/ location start/? Content-Length 0 Keep-Alive timeout=5, max=86 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	jquery.min.js Show response toeslag-beveiligd.xyz/sns/bower_components/jquery/dist/	85 KB 30 KB	46ms 45ms	Script application/javascript	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/bower_components/jquery/dist/jquery.min.js Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:29 GMT Content-Encoding gzip Last-Modified Tue, 26 Jan 2021 21:28:00 GMT Server Apache/2.4.18 (Ubuntu) ETag "15283-5b9d4542d1800-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=92 Content-Length 30138
GET H/1.1	200 OK	ua-parser.min.js Show response toeslag-beveiligd.xyz/sns/bower_components/ua-parser-js/dist/	17 KB 6 KB	35ms 34ms	Script application/javascript	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/bower_components/ua-parser-js/dist/ua-parser.min.js Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:29 GMT Content-Encoding gzip Last-Modified Tue, 26 Jan 2021 21:28:00 GMT Server Apache/2.4.18 (Ubuntu) ETag "4298-5b9d4542d1800-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=91 Content-Length 6063
GET H/1.1	200 OK	font-awesome.min.css toeslag-beveiligd.xyz/sns/bower_components/font-awesome/css/	30 KB 7 KB	36ms 35ms	Stylesheet text/css	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:29 GMT Content-Encoding gzip Last-Modified Tue, 26 Jan 2021 21:28:00 GMT Server Apache/2.4.18 (Ubuntu) ETag "7918-5b9d4542d1800-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=81 Content-Length 7053
GET H/1.1	200 OK	core_form.js Show response toeslag-beveiligd.xyz/sns/core/form/	43 KB 25 KB	71ms 35ms	Script application/javascript	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/core/form/core_form.js Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `927e8bdd2ac8df5a6202f4eb4b78ba79217a7f4c563049a1d8076c93d7ec86ee` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:30 GMT Content-Encoding gzip Last-Modified Tue, 26 Jan 2021 21:28:00 GMT Server Apache/2.4.18 (Ubuntu) ETag "ac63-5b9d4542d1800-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=90 Content-Length 25092
GET H/1.1	200 OK	core_token.js Show response toeslag-beveiligd.xyz/sns/core/token/	10 KB 2 KB	69ms 34ms	Script application/javascript	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/core/token/core_token.js Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `bf23dd8f6ffaaea1a82d77bb248eeafd31855559ac2bae45dc8c1ef4d13beebc` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:30 GMT Content-Encoding gzip Last-Modified Tue, 26 Jan 2021 21:28:00 GMT Server Apache/2.4.18 (Ubuntu) ETag "2941-5b9d4542d1800-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=92 Content-Length 1471
GET H/1.1	200 OK	core_form.css toeslag-beveiligd.xyz/sns/core/form/	3 KB 1 KB	34ms 34ms	Stylesheet text/css	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/core/form/core_form.css Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `31d3f43bd9f28e1268117e9cc68a7c52b91dd4273a1bd968a7059d179723da54` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:29 GMT Content-Encoding gzip Last-Modified Tue, 26 Jan 2021 21:28:00 GMT Server Apache/2.4.18 (Ubuntu) ETag "b2b-5b9d4542d1800-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=93 Content-Length 719
GET H/1.1	200 OK	css.css toeslag-beveiligd.xyz/sns/start/form/	0 279 B	40ms 40ms	Stylesheet text/css	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/start/form/css.css Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:29 GMT Last-Modified Tue, 26 Jan 2021 21:28:04 GMT Server Apache/2.4.18 (Ubuntu) ETag "0-5b9d4546a2100" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=93 Content-Length 0
GET H/1.1	200 OK	sns.82a68a6184ab25f37a26.css toeslag-beveiligd.xyz/sns/start/	75 KB 12 KB	52ms 42ms	Stylesheet text/css	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/start/sns.82a68a6184ab25f37a26.css Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `d616acbdae00f2e9713a99010448d55119c9a7bbc1441f281ad3a5cb9db71f7a` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:30 GMT Content-Encoding gzip Last-Modified Tue, 26 Jan 2021 21:28:04 GMT Server Apache/2.4.18 (Ubuntu) ETag "12a4d-5b9d4546a2100-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=84 Content-Length 11451
GET H/1.1	200 OK	form.js Show response toeslag-beveiligd.xyz/sns/start/form/	3 KB 1 KB	34ms 33ms	Script application/javascript	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/start/form/form.js?v=611522b1e717a Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:30 GMT Content-Encoding gzip Last-Modified Tue, 26 Jan 2021 21:28:04 GMT Server Apache/2.4.18 (Ubuntu) ETag "bf7-5b9d4546a2100-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=89 Content-Length 709
GET H/1.1	200 OK	token.js Show response toeslag-beveiligd.xyz/sns/start/token/	1 KB 872 B	34ms 34ms	Script application/javascript	185.117.73.42 HS
General Check archive.org Show headers Download Go to Full URL http://toeslag-beveiligd.xyz/sns/start/token/token.js?v=611522b1e71b5 Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `3084f4c3333a14aa6f04988a853fd7cd9c154983163a6dc6eeff047374b74c27` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:30 GMT Content-Encoding gzip Last-Modified Tue, 26 Jan 2021 21:28:04 GMT Server Apache/2.4.18 (Ubuntu) ETag "4fa-5b9d4546a2100-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=91 Content-Length 523
GET H/1.1	200 OK	newloader.gif toeslag-beveiligd.xyz/sns/start/form/	544 KB 544 KB	33ms 33ms	Image image/gif	185.117.73.42 HS
General Check archive.org Show headers Download Go to Show image Full URL http://toeslag-beveiligd.xyz/sns/start/form/newloader.gif Protocol HTTP/1.1 Server 185.117.73.42 Amsterdam, Netherlands, ASN60117 (HS, AE), Reverse DNS easy-loan.club Software Apache/2.4.18 (Ubuntu) / Resource Hash `32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host toeslag-beveiligd.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? Cookie real=OK; bid=d13c21864def6ea8cf7290d424a5cd6c Connection keep-alive Cache-Control no-cache Referer http://toeslag-beveiligd.xyz/sns/a1b2c3/d13c21864def6ea8cf7290d424a5cd6c/start/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 12 Aug 2021 13:31:30 GMT Last-Modified Tue, 26 Jan 2021 21:28:04 GMT Server Apache/2.4.18 (Ubuntu) ETag "88042-5b9d4546a2100" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=90 Content-Length 557122
GET DATA	200 OK	truncated /	20 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `dfe8429b800b56eaf625ac44d48dccf9aed7a108e95360d53f76a458a3c8f93b` Request headers Referer http://toeslag-beveiligd.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	gate.php Show response thuisbasis.icu/uadmin/	58 B 291 B	34ms 34ms	Script application/javascript	194.36.189.184 HS
General Check archive.org Show headers Download Go to Full URL https://thuisbasis.icu/uadmin/gate.php?pl=token&link=sns&bid=d13c21864def6ea8cf7290d424a5cd6c&callback=jQuery321034075774368809064_1628775160528&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1628775160529 Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.36.189.184 Capelle aan den IJssel, Netherlands, ASN60117 (HS, AE), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `2cd6c26b7ad6e796797b89f9c09375355dad0a471604c0d8d5be48a11709415a` Request headers Referer http://toeslag-beveiligd.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Thu, 12 Aug 2021 13:32:40 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 58 Content-Type application/javascript
GET H/1.1	200 OK	gate.php Show response thuisbasis.icu/uadmin/	58 B 291 B	50ms 50ms	Script application/javascript	194.36.189.184 HS
General Check archive.org Show headers Download Go to Full URL https://thuisbasis.icu/uadmin/gate.php?pl=token&link=sns&bid=d13c21864def6ea8cf7290d424a5cd6c&callback=jQuery321034075774368809064_1628775160530&data=%7B%22mes%22%3A%22User%20on%20start%20page%22%7D&_=1628775160531 Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.36.189.184 Capelle aan den IJssel, Netherlands, ASN60117 (HS, AE), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `4f38ef8b497402eba248941a03e28e658c87be0cc2aa7125b0fedcc4e12974c6` Request headers Referer http://toeslag-beveiligd.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Thu, 12 Aug 2021 13:32:40 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 58 Content-Type application/javascript
GET H/1.1	200 OK	gate.php Show response thuisbasis.icu/uadmin/	58 B 291 B	35ms 35ms	Script application/javascript	194.36.189.184 HS
General Check archive.org Show headers Download Go to Full URL https://thuisbasis.icu/uadmin/gate.php?pl=token&link=sns&bid=d13c21864def6ea8cf7290d424a5cd6c&callback=jQuery321034075774368809064_1628775160530&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1628775160532 Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.36.189.184 Capelle aan den IJssel, Netherlands, ASN60117 (HS, AE), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `4f38ef8b497402eba248941a03e28e658c87be0cc2aa7125b0fedcc4e12974c6` Request headers Referer http://toeslag-beveiligd.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Thu, 12 Aug 2021 13:32:45 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 58 Content-Type application/javascript
GET H/1.1	200 OK	gate.php Show response thuisbasis.icu/uadmin/	58 B 291 B	36ms 35ms	Script application/javascript	194.36.189.184 HS
General Check archive.org Show headers Download Go to Full URL https://thuisbasis.icu/uadmin/gate.php?pl=token&link=sns&bid=d13c21864def6ea8cf7290d424a5cd6c&callback=jQuery321034075774368809064_1628775160530&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1628775160533 Requested by Host: toeslag-beveiligd.xyz URL: http://toeslag-beveiligd.xyz/sns/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.36.189.184 Capelle aan den IJssel, Netherlands, ASN60117 (HS, AE), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `4f38ef8b497402eba248941a03e28e658c87be0cc2aa7125b0fedcc4e12974c6` Request headers Referer http://toeslag-beveiligd.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Thu, 12 Aug 2021 13:32:50 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=94 Content-Length 58 Content-Type application/javascript

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: SNS Bank (Banking)

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			toeslag-beveiligd.xyz/	1970-01-19 21:09:27	Name: bid Value: d13c21864def6ea8cf7290d424a5cd6c
			toeslag-beveiligd.xyz/sns	1969-12-31 23:59:59	Name: real Value: OK

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

thuisbasis.icu
toeslag-beveiligd.xyz
185.117.73.42
194.36.189.184
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
2cd6c26b7ad6e796797b89f9c09375355dad0a471604c0d8d5be48a11709415a
3084f4c3333a14aa6f04988a853fd7cd9c154983163a6dc6eeff047374b74c27
31d3f43bd9f28e1268117e9cc68a7c52b91dd4273a1bd968a7059d179723da54
32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630
4f38ef8b497402eba248941a03e28e658c87be0cc2aa7125b0fedcc4e12974c6
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
927e8bdd2ac8df5a6202f4eb4b78ba79217a7f4c563049a1d8076c93d7ec86ee
b52b609ff955a450295792d68b2d914f5f2bc0ff28170727c1ff76140c1932ef
bf23dd8f6ffaaea1a82d77bb248eeafd31855559ac2bae45dc8c1ef4d13beebc
c19eef9313e21f73c8eac2e81d1ad7434c8262f5b36a426f0af91fcbaaffe420
d616acbdae00f2e9713a99010448d55119c9a7bbc1441f281ad3a5cb9db71f7a
dfe8429b800b56eaf625ac44d48dccf9aed7a108e95360d53f76a458a3c8f93b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

toeslag-beveiligd.xyz Open in urlscan Pro 185.117.73.42 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

24 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

648 kBTransfer

897 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

47 JavaScript Global Variables

2 Cookies

Indicators

toeslag-beveiligd.xyz Open in urlscan Pro
185.117.73.42 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

24 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

648 kB
Transfer

897 kB
Size

2
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!