www.dontletdowns.com Open in urlscan Pro
69.55.55.84 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.dontletdowns.com/opsturen/gegevens.php
Submission: On February 06 via automatic, source openphish (February 6th 2019, 6:53:22 pm UTC)

Summary HTTP 11 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 69.55.55.84, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is www.dontletdowns.com.

This is the only time www.dontletdowns.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ABN Amro (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	69.55.55.84 69.55.55.84	14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
1	2.16.187.19 2.16.187.19	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	3

4 69.55.55.84 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)

www.dontletdowns.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.187.19 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-187-19.deploy.static.akamaitechnologies.com

www.abnamro.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	dontletdowns.com www.dontletdowns.com	659 KB
1	abnamro.nl www.abnamro.nl	725 B
11	2

	Domain	Requested by
4	www.dontletdowns.com	www.dontletdowns.com
1	www.abnamro.nl	www.dontletdowns.com
11	2

This site contains links to these domains. Also see Links.

Domain
renachterhemaan.com
www.abnamro.nl

Subject Issuer	Validity	Valid
www.abnamro.nl QuoVadis EV SSL ICA G1	`2018-09-07` - `2020-09-07`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://www.dontletdowns.com/opsturen/gegevens.php
Frame ID: 9B785D2584790AB02B72C2122679D3AA
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

11
Requests

9 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

660 kB
Transfer

664 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: http://renachterhemaan.com/portalserver/nl/prive/bankieren/rekeningen/overzicht/index.html
Title: NL

Search URL Search Domain Scan URL

URL: http://renachterhemaan.com/portalserver/en/personal/banking/accounts/overview/index.html
Title: EN

Search URL Search Domain Scan URL

URL: https://www.abnamro.nl/portalserver/nl/prive/index.html?r
Title: Een nieuwe Identificatiecode aanvragen (html, )

Search URL Search Domain Scan URL

URL: http://renachterhemaan.com/nl/prive/apps/tikkie/index.html
Title: Uw geld terugvragen via Whatsapp (html, )

Search URL Search Domain Scan URL

URL: http://renachterhemaan.com/nl/prive/service-en-contact/adres-wijzigen.html
Title: Zelf uw adresgegevens wijzigen (html, )

Search URL Search Domain Scan URL

URL: http://renachterhemaan.com/nl/prive/internet-en-mobiel/internet-bankieren/overboeken-met-identificatiecode.html
Title: Identificatiecode vergeten? (html, )

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request gegevens.php Show response
www.dontletdowns.com/opsturen/ 57 KB
57 KB 232ms
93ms Document
text/html 69.55.55.84
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dontletdowns.com/opsturen/gegevens.php
Protocol: HTTP/1.1
Server: 69.55.55.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 81cece038ef962bf21bc76d63c0cf09047d48191737cad0bea69ef3b08e96a7a

Request headers

Host: www.dontletdowns.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 06 Feb 2019 18:53:04 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK all.css
www.dontletdowns.com/www.abnamro.nl/portalserver/static/lib/static/portalclient/xml-lang/backbase.com.2012.view/css/ 9 KB
9 KB 258ms
101ms Stylesheet
text/css 69.55.55.84
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dontletdowns.com/www.abnamro.nl/portalserver/static/lib/static/portalclient/xml-lang/backbase.com.2012.view/css/all.css
Requested by: Host: www.dontletdowns.com
URL: http://www.dontletdowns.com/opsturen/gegevens.php
Protocol: HTTP/1.1
Server: 69.55.55.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: d0e34977d26e8efa9d1c1661f9c62efce9df42317655c6ed56427af349c1413a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.dontletdowns.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://www.dontletdowns.com/opsturen/gegevens.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.dontletdowns.com/opsturen/gegevens.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 06 Feb 2019 18:53:04 GMT
Last-Modified: Fri, 03 Nov 2017 13:43:02 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 9363

GET
H/1.1 200
OK core.css
www.dontletdowns.com/www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/css/themes/retail/ 328 KB
328 KB 264ms
103ms Stylesheet
text/css 69.55.55.84
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dontletdowns.com/www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/css/themes/retail/core.css
Requested by: Host: www.dontletdowns.com
URL: http://www.dontletdowns.com/opsturen/gegevens.php
Protocol: HTTP/1.1
Server: 69.55.55.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 4807d32dff507e4fa1d72631c5feee6dcdcfc67720798c67ef2b9a80b36094d5

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.dontletdowns.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://www.dontletdowns.com/opsturen/gegevens.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.dontletdowns.com/opsturen/gegevens.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 06 Feb 2019 18:53:04 GMT
Last-Modified: Fri, 24 Nov 2017 13:47:00 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 335421

GET
H2 200 arrow.gif
www.abnamro.nl/nl/images/Systeem/abnamroNL/Content/includes/images/System/Includes/quinity/ 57 B
725 B 237ms
54ms Image
image/gif 2.16.187.19
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.abnamro.nl/nl/images/Systeem/abnamroNL/Content/includes/images/System/Includes/quinity/arrow.gif

Requested by

Host: www.dontletdowns.com
URL: http://www.dontletdowns.com/opsturen/gegevens.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.16.187.19 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-16-187-19.deploy.static.akamaitechnologies.com

Software

Resource Hash

a7b17479884ffc04faace2e83387b238e3a98988b8418f0cb298ca2b58d47d05

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.dontletdowns.com/opsturen/gegevens.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 06 Feb 2019 18:53:04 GMT
last-modified: Tue, 01 Feb 2011 18:03:55 GMT
x-heist: S0s2HQIwy0DkHb4tgPOKJZFEdlg1N88IFB5LFKAcSYzbqm6Q7x1bucG6KqY5k5zrMBbACnsOaYdPO0HqzZsKuKrZMpeyFO4dy5KV3IGmUeyBcpgGawtE84rn0NuFoC7WxGDanDDI7QUPEWksJwq5f9jG1dJfTGCKG0Z0f9fu0ouSg5PIgXELl9UnsVXafRHNujOfvz0Hv1mmnaw9fnbJylDysLkUnG5URtsferIGEtJE6YnITBGnOKFYJJyC32LngyAEs2AFzLurBaCYvuxFvGYYu5ZIbZaoKvzf3JpOI4rnlRNtB7yK294UAWdMx7d8xUNUB7XPA3zJb6155T0sxSp5j0tt3teOu4W4UkYRwa3isEpKd3MUkxMZFRJV5uuA2xHg6MOGmHZOOSbVO9COeVLHkWtFyMD2Xpo5ycnkzIkeLGZvuPsqyor6pz7N9xkuzCDrw0mZtFqk6Y86ZAtLn2DXNzOVa7U530N8h2xTYLfjPQ5yc
x-frame-options: SAMEORIGIN
content-language: en-US
status: 200
strict-transport-security: max-age=15768000
content-type: image/gif
content-length: 57
expires: Wed, 06 Feb 2019 19:08:04 GMT

GET
H/1.1 200
OK icons.css
www.dontletdowns.com/www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/css/themes/abnamro/ 265 KB
265 KB 104ms
104ms Stylesheet
text/css 69.55.55.84
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://www.dontletdowns.com/www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/css/themes/abnamro/icons.css
Requested by: Host: www.dontletdowns.com
URL: http://www.dontletdowns.com/opsturen/gegevens.php
Protocol: HTTP/1.1
Server: 69.55.55.84 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: ea3f433a57ca871d93787ba87194136fe158677621aed63fc31e9b642ad207f3

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.dontletdowns.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://www.dontletdowns.com/opsturen/gegevens.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.dontletdowns.com/opsturen/gegevens.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 06 Feb 2019 18:53:05 GMT
Last-Modified: Fri, 24 Nov 2017 13:46:52 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 270953

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1e1d99d43ab313eb41d38bdba892888025c041e67bd9111762473f090920eaa

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 160 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 293680a5c9b05ee7c9c775597a78a96e2326217111b9d8d46689349877dc497c

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 414 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 72824d976dd203300249f3217972df6ab89f9d94c53d84acb0a148d85693e845

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET roboto-regular.woff2
www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/ 0
0

GET roboto-bold.woff2
www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/ 0
0

GET roboto-condensed-regular.woff2
www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/ 0
0

GET
DATA 200
OK truncated
/ 243 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 192e39d75de6896a814e51f02c87d703fbbe92564f508bfbfeb7117de557f7a0

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 511 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 48aefbd70b8a894f8ddeabd890d7cf65068b70c684b8622dc960f4f77ac4949b

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03d20bf8b5b0038140f3fbb948a92886ad361363d906cde4f32403017615a9b8

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 247 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ae2c55388de4ece9e9c03c290f61bcc1058fcac2ee7edfbbb7d41f3180e45e6a

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 301 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 37c79bdaaa744992cb8febf79562dd125f78f6d44716bd31d24d003add56f559

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 506 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99791a76a86495fbcd0f5cdbdd778ffbadc99110b2149d5714772494c2e36b83

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET roboto-regular.woff
www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/ 0
0

GET roboto-bold.woff
www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/ 0
0

GET roboto-condensed-regular.woff
www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.abnamro.nl
URL: https://www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/roboto-regular.woff2

Domain: www.abnamro.nl
URL: https://www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/roboto-bold.woff2

Domain: www.abnamro.nl
URL: https://www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/roboto-condensed-regular.woff2

Domain: www.abnamro.nl
URL: https://www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/roboto-regular.woff

Domain: www.abnamro.nl
URL: https://www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/roboto-bold.woff

Domain: www.abnamro.nl
URL: https://www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/fonts/roboto-condensed-regular.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ABN Amro (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.abnamro.nl
www.dontletdowns.com
www.abnamro.nl
2.16.187.19
69.55.55.84
03d20bf8b5b0038140f3fbb948a92886ad361363d906cde4f32403017615a9b8
192e39d75de6896a814e51f02c87d703fbbe92564f508bfbfeb7117de557f7a0
293680a5c9b05ee7c9c775597a78a96e2326217111b9d8d46689349877dc497c
37c79bdaaa744992cb8febf79562dd125f78f6d44716bd31d24d003add56f559
4807d32dff507e4fa1d72631c5feee6dcdcfc67720798c67ef2b9a80b36094d5
48aefbd70b8a894f8ddeabd890d7cf65068b70c684b8622dc960f4f77ac4949b
72824d976dd203300249f3217972df6ab89f9d94c53d84acb0a148d85693e845
81cece038ef962bf21bc76d63c0cf09047d48191737cad0bea69ef3b08e96a7a
99791a76a86495fbcd0f5cdbdd778ffbadc99110b2149d5714772494c2e36b83
a7b17479884ffc04faace2e83387b238e3a98988b8418f0cb298ca2b58d47d05
ae2c55388de4ece9e9c03c290f61bcc1058fcac2ee7edfbbb7d41f3180e45e6a
b1e1d99d43ab313eb41d38bdba892888025c041e67bd9111762473f090920eaa
d0e34977d26e8efa9d1c1661f9c62efce9df42317655c6ed56427af349c1413a
ea3f433a57ca871d93787ba87194136fe158677621aed63fc31e9b642ad207f3

www.dontletdowns.com Open in urlscan Pro 69.55.55.84 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

9 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

660 kBTransfer

664 kBSize

0 Cookies

6 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

www.dontletdowns.com Open in urlscan Pro
69.55.55.84 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

9 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

660 kB
Transfer

664 kB
Size

0
Cookies

11 HTTP transactions
9 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!