www.entreemagazine.nl Open in urlscan Pro
185.31.244.32  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response www.entreemagazine.nl/Home/office365/	3 KB 1 KB	321ms 247ms	Document text/html	185.31.244.32 NL-BIT BIT BV
General Check archive.org Show headers Download Go to Full URL https://www.entreemagazine.nl/Home/office365/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.31.244.32 , Netherlands, ASN12859 (NL-BIT BIT BV, NL), Reverse DNS web02.managementmedia.nl Software Apache/2 / Resource Hash ca20b22ccde5a48183d89c7089b38664415fb02ade6165bd84ca0b194fdb786f Request headers :method GET :authority www.entreemagazine.nl :scheme https :path /Home/office365/login.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 02:34:41 GMT server Apache/2 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=1d8af8cf86684f4116db34d3b67e39b6; path=/ vary Accept-Encoding,User-Agent content-encoding gzip content-length 1225 content-type text/html; charset=UTF-8
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.1.3/css/	138 KB 19 KB	35ms 19ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/css/bootstrap.min.css Requested by Host: www.entreemagazine.nl URL: https://www.entreemagazine.nl/Home/office365/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.entreemagazine.nl/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 02:34:42 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617 age 1580828 cdn-cachedat 2021-03-10 20:26:28 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 091d6e6ddc00001f45ba19c000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 91f303646715c1657f8f53960b32484e cf-ray 6375b35c9d051f45-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	login.css www.entreemagazine.nl/Home/office365/assets/css/	2 KB 836 B	20ms 18ms	Stylesheet text/css	185.31.244.32 NL-BIT BIT BV
General Check archive.org Show headers Download Go to Full URL https://www.entreemagazine.nl/Home/office365/assets/css/login.css Requested by Host: www.entreemagazine.nl URL: https://www.entreemagazine.nl/Home/office365/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.31.244.32 , Netherlands, ASN12859 (NL-BIT BIT BV, NL), Reverse DNS web02.managementmedia.nl Software Apache/2 / Resource Hash 35c946cbc580e838b6b3255ee94576ad8c31a741af87ee42a9fc27ccdb852f54 Request headers Referer https://www.entreemagazine.nl/Home/office365/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 02:34:42 GMT content-encoding gzip last-modified Mon, 29 Mar 2021 01:33:44 GMT server Apache/2 etag "7ad-5bea2df52231d-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=1209600 accept-ranges bytes content-length 687 expires Mon, 12 Apr 2021 02:34:42 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	27ms 6ms	Script text/javascript	2a00:1450:4001:813::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: www.entreemagazine.nl URL: https://www.entreemagazine.nl/Home/office365/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.entreemagazine.nl/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:14:15 GMT content-encoding gzip x-content-type-options nosniff age 48027 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Mon, 28 Mar 2022 13:14:15 GMT
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/	20 KB 7 KB	11ms 10ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js Requested by Host: www.entreemagazine.nl URL: https://www.entreemagazine.nl/Home/office365/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://www.entreemagazine.nl/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 02:34:42 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3522391 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6451 cf-request-id 091d6e6dcd00004de2010e0000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4f71" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=JgsGqsxIAERCljK3LLusI2IZEC9zcwRxeh9dGgxP%2FqGuDoit3E8qWF826CUKs2RutgVJ%2FSosPPc94lbJhuujZcUgyO8MsbFNdvw8tiMomeX%2BwSqVG3FbS9U5XJaWCtyHSg%3D%3D"}]} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6375b35c7fe84de2-FRA expires Sat, 19 Mar 2022 02:34:42 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 14 KB	33ms 17ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: www.entreemagazine.nl URL: https://www.entreemagazine.nl/Home/office365/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.entreemagazine.nl/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 02:34:42 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 632, 617, 617, 617 age 1580828 cdn-cachedat 2021-03-10 20:26:20 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 091d6e6ddd00001f4523137000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid bdab7194e1e9728273e5a7713a5b1035 cf-ray 6375b35c9d071f45-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	logo.svg www.entreemagazine.nl/Home/office365/assets/images/	4 KB 1 KB	20ms 18ms	Image image/svg+xml	185.31.244.32 NL-BIT BIT BV
General Check archive.org Show headers Download Go to Show image Full URL https://www.entreemagazine.nl/Home/office365/assets/images/logo.svg Requested by Host: www.entreemagazine.nl URL: https://www.entreemagazine.nl/Home/office365/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.31.244.32 , Netherlands, ASN12859 (NL-BIT BIT BV, NL), Reverse DNS web02.managementmedia.nl Software Apache/2 / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer https://www.entreemagazine.nl/Home/office365/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 02:34:42 GMT content-encoding gzip last-modified Mon, 29 Mar 2021 01:33:44 GMT server Apache/2 etag "e43-5bea2df5232bd-gzip" vary Accept-Encoding,User-Agent content-type image/svg+xml cache-control max-age=1209600 accept-ranges bytes content-length 1435 expires Mon, 12 Apr 2021 02:34:42 GMT
GET H2	200	ellipsis_white.svg www.entreemagazine.nl/Home/office365/assets/images/	915 B 319 B	19ms 18ms	Image image/svg+xml	185.31.244.32 NL-BIT BIT BV
General Check archive.org Show headers Download Go to Show image Full URL https://www.entreemagazine.nl/Home/office365/assets/images/ellipsis_white.svg Requested by Host: www.entreemagazine.nl URL: https://www.entreemagazine.nl/Home/office365/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.31.244.32 , Netherlands, ASN12859 (NL-BIT BIT BV, NL), Reverse DNS web02.managementmedia.nl Software Apache/2 / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Referer https://www.entreemagazine.nl/Home/office365/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 02:34:42 GMT content-encoding gzip last-modified Mon, 29 Mar 2021 01:33:44 GMT server Apache/2 etag "393-5bea2df5232bd-gzip" vary Accept-Encoding,User-Agent content-type image/svg+xml cache-control max-age=1209600 accept-ranges bytes content-length 263 expires Mon, 12 Apr 2021 02:34:42 GMT
GET H2	200	background.jpg www.entreemagazine.nl/Home/office365/assets/images/	277 KB 279 KB	19ms 18ms	Image image/jpeg	185.31.244.32 NL-BIT BIT BV
General Check archive.org Show headers Download Go to Show image Full URL https://www.entreemagazine.nl/Home/office365/assets/images/background.jpg Requested by Host: www.entreemagazine.nl URL: https://www.entreemagazine.nl/Home/office365/assets/css/login.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.31.244.32 , Netherlands, ASN12859 (NL-BIT BIT BV, NL), Reverse DNS web02.managementmedia.nl Software Apache/2 / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers Referer https://www.entreemagazine.nl/Home/office365/assets/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 29 Mar 2021 02:34:42 GMT last-modified Mon, 29 Mar 2021 01:33:44 GMT server Apache/2 etag "452d7-5bea2df5232bd" content-type image/jpeg cache-control max-age=1209600 accept-ranges bytes content-length 283351 expires Mon, 12 Apr 2021 02:34:42 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.entreemagazine.nl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1d8af8cf86684f4116db34d3b67e39b6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
www.entreemagazine.nl
185.31.244.32
2606:4700::6810:125e
2606:4700::6812:bcf
2a00:1450:4001:813::200a
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
35c946cbc580e838b6b3255ee94576ad8c31a741af87ee42a9fc27ccdb852f54
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
ca20b22ccde5a48183d89c7089b38664415fb02ade6165bd84ca0b194fdb786f
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e