abnamro-prive-nl.028180.com

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is abnamro-prive-nl.028180.com.
TLS certificate: Issued by GTS CA 1P5 on December 10th 2023. Valid for: 3 months.

This is the only time abnamro-prive-nl.028180.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	89.46.107.242 89.46.107.242	31034 (ARUBA-ASN) (ARUBA-ASN)
1 5	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	3

1 89.46.107.242 (Arezzo, Italy)

ASN31034 (ARUBA-ASN, IT)
PTR: webx1236.aruba.it

www.topclones.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 188.114.97.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

abnamro-prive-nl.028180.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	028180.com 1 redirects abnamro-prive-nl.028180.com	8 KB
1	topclones.biz www.topclones.biz	239 B
6	2

	Domain	Requested by
5	abnamro-prive-nl.028180.com	1 redirects abnamro-prive-nl.028180.com
1	www.topclones.biz
6	2

This site contains no links.

Subject Issuer	Validity	Valid
*.topclones.biz Actalis Domain Validation Server CA G3	`2023-01-15` - `2024-02-15`	a year	crt.sh
028180.com GTS CA 1P5	`2023-12-10` - `2024-03-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://abnamro-prive-nl.028180.com/zelfregelen
Frame ID: 81D1D84CD392C18C7BC101AE013D99BA
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.topclones.biz/wp-content/plugins/woocommerce/vendor/maxmind-db/reader/src/MaxMind/Db/html.... Page URL
https://abnamro-prive-nl.028180.com/zelfregelen Page URL
https://abnamro-prive-nl.028180.com/cdn-cgi/phish-bypass?atok=wWuoUL1qbj8x3QLcfPZiXRkt4MoTxik7HXVTgJtIHC4-170556... HTTP 301
https://abnamro-prive-nl.028180.com/zelfregelen Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

8 kB
Transfer

35 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.topclones.biz/wp-content/plugins/woocommerce/vendor/maxmind-db/reader/src/MaxMind/Db/html.php?r=bD1odHRwczovL2FibmFtcm8tcHJpdmUtbmwuMDI4MTgwLmNvbS96ZWxmcmVnZWxlbg%3D%3D Page URL
https://abnamro-prive-nl.028180.com/zelfregelen Page URL
https://abnamro-prive-nl.028180.com/cdn-cgi/phish-bypass?atok=wWuoUL1qbj8x3QLcfPZiXRkt4MoTxik7HXVTgJtIHC4-1705566562-0-%2Fzelfregelen HTTP 301
https://abnamro-prive-nl.028180.com/zelfregelen Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 html.php Show response
www.topclones.biz/wp-content/plugins/woocommerce/vendor/maxmind-db/reader/src/MaxMind/Db/ 92 B
239 B 311ms
68ms Document
text/html 89.46.107.242
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.topclones.biz/wp-content/plugins/woocommerce/vendor/maxmind-db/reader/src/MaxMind/Db/html.php?r=bD1odHRwczovL2FibmFtcm8tcHJpdmUtbmwuMDI4MTgwLmNvbS96ZWxmcmVnZWxlbg%3D%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.46.107.242 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx1236.aruba.it
Software: aruba-proxy /
Resource Hash: b62e1a757611dccb08d2b158519ffa910a43db8cccf5dc49c78e9ae4241798ff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 18 Jan 2024 08:29:22 GMT
server: aruba-proxy
vary: Accept-Encoding
x-servername: ipvsproxy119.ad.aruba.it

GET
H2 200 zelfregelen Show response
abnamro-prive-nl.028180.com/ 4 KB
2 KB 596ms
43ms Document
text/html 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://abnamro-prive-nl.028180.com/zelfregelen

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2822fecd7d6a9cfa72110c97ac1ca0a4feaeefc26cfc753fd0eb8c05cd2bb8fb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.topclones.biz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cf-ray: 84757849a88a4c44-MXP
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 18 Jan 2024 08:29:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dw6u4jdEI1obCfY4gei4Qd0%2Fod%2FdXHFPnsMsDdDH51Oo6byIFL%2BFk7kpJYM8BPnd59GS9jUH4C9KRy7xdJpZ4MvqZJ6fo6%2BfKK2It%2FhWnX2rE%2F%2BI0%2F4LuInj5e9NhTmWukTzRAdGQUirB5Jy4Q8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 cf.errors.css
abnamro-prive-nl.028180.com/cdn-cgi/styles/ 24 KB
5 KB 45ms
45ms Stylesheet
text/css 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://abnamro-prive-nl.028180.com/cdn-cgi/styles/cf.errors.css

Requested by

Host: abnamro-prive-nl.028180.com
URL: https://abnamro-prive-nl.028180.com/zelfregelen

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://abnamro-prive-nl.028180.com/zelfregelen
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 08:29:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Jan 2024 17:29:47 GMT
server: cloudflare
etag: W/"65983c8b-5e44"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 84757849f9084c44-MXP
expires: Thu, 18 Jan 2024 10:29:22 GMT

GET
H2 200 icon-exclamation.png
abnamro-prive-nl.028180.com/cdn-cgi/images/ 452 B
542 B 41ms
41ms Image
image/png 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://abnamro-prive-nl.028180.com/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: abnamro-prive-nl.028180.com
URL: https://abnamro-prive-nl.028180.com/cdn-cgi/styles/cf.errors.css

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://abnamro-prive-nl.028180.com/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 08:29:22 GMT
x-content-type-options: nosniff
last-modified: Fri, 05 Jan 2024 17:29:47 GMT
server: cloudflare
etag: "65983c8b-1c4"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 8475784a49a74c44-MXP
content-length: 452
expires: Thu, 18 Jan 2024 10:29:22 GMT

GET
H2

522

Primary Request zelfregelen
abnamro-prive-nl.028180.com/
Redirect Chain

https://abnamro-prive-nl.028180.com/cdn-cgi/phish-bypass?atok=wWuoUL1qbj8x3QLcfPZiXRkt4MoTxik7HXVTgJtIHC4-1705566562-0-%2Fzelfregelen
https://abnamro-prive-nl.028180.com/zelfregelen

7 KB
0

30729ms
30728ms

Document
text/html

188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://abnamro-prive-nl.028180.com/zelfregelen

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://abnamro-prive-nl.028180.com/zelfregelen
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8475785cf8b44c44-MXP
content-length: 7153
content-type: text/html; charset=UTF-8
date: Thu, 18 Jan 2024 08:29:56 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ll8OQz1PNbHDB5Iw%2Fiw8vpmB1zjH%2BU4kiTMZMges6vcMXaiDiTQl3Wmg2NoST7HuMxD8fSRjZ98VxW8VMuaYapVo%2By2v%2B%2BUFYCFQyl0V1Ajx16GuknZYcWGC5N8yqUljkhisbp0Qo1b3y0KEbf4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN

Redirect headers

cache-control: private, no-cache
cf-ray: 8475785cb8684c44-MXP
content-length: 167
content-type: text/html
date: Thu, 18 Jan 2024 08:29:25 GMT
location: https://abnamro-prive-nl.028180.com/zelfregelen
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET main.css
abnamro-prive-nl.028180.com/cdn-cgi/styles/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: abnamro-prive-nl.028180.com
URL: https://abnamro-prive-nl.028180.com/cdn-cgi/styles/main.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.abnamro-prive-nl.028180.com/	1970-01-20 17:47:32	Name: __cf_mw_byp Value: wWuoUL1qbj8x3QLcfPZiXRkt4MoTxik7HXVTgJtIHC4-1705566562-0-/zelfregelen

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://abnamro-prive-nl.028180.com/zelfregelen Message: Failed to load resource: the server responded with a status of 522 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abnamro-prive-nl.028180.com
www.topclones.biz
abnamro-prive-nl.028180.com
188.114.97.3
89.46.107.242
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
2822fecd7d6a9cfa72110c97ac1ca0a4feaeefc26cfc753fd0eb8c05cd2bb8fb
b62e1a757611dccb08d2b158519ffa910a43db8cccf5dc49c78e9ae4241798ff
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

abnamro-prive-nl.028180.com Open in urlscan Pro 188.114.97.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

8 kBTransfer

35 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

abnamro-prive-nl.028180.com Open in urlscan Pro
188.114.97.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

8 kB
Transfer

35 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!