www.aatjeras.nl - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd, located in Dublin, Ireland and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.aatjeras.nl.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 11th 2019. Valid for: 3 months.

This is the only time www.aatjeras.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
3 9	2a05:d018:964... 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	23.52.57.239 23.52.57.239	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	23.38.61.52 23.38.61.52	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.38.48.215 23.38.48.215	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	2

9 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

www.aatjeras.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.52.57.239 (Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-52-57-239.deploy.static.akamaitechnologies.com

banknorthgeorgia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.38.61.52 (Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-61-52.deploy.static.akamaitechnologies.com

banknorthgeorgia.synovus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.38.48.215 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-48-215.deploy.static.akamaitechnologies.com

www.synovus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	aatjeras.nl 3 redirects www.aatjeras.nl	338 KB
2	synovus.com 1 redirects banknorthgeorgia.synovus.com www.synovus.com	170 B
1	banknorthgeorgia.com 1 redirects banknorthgeorgia.com	174 B
7	3

	Domain	Requested by
9	www.aatjeras.nl	3 redirects www.aatjeras.nl
1	www.synovus.com	www.aatjeras.nl
1	banknorthgeorgia.synovus.com	1 redirects
1	banknorthgeorgia.com	1 redirects
7	4

This site contains no links.

Subject Issuer	Validity	Valid
aatjeras.nl Let's Encrypt Authority X3	`2019-06-11` - `2019-09-09`	3 months	crt.sh
banknorthgeorgia.synovus.com Sectigo RSA Extended Validation Secure Server CA	`2019-05-14` - `2021-05-13`	2 years	crt.sh

This page contains 2 frames:

Primary Page: https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&.
Frame ID: F3FBA52EAE78D556BEDAE388D804D891
Requests: 2 HTTP requests in this frame

Frame: https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c=
Frame ID: C7FE4B9C513E2AEA91E3EFD5ED6EED9F
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main?x=x&a=lindabanks@banknorthgeor... HTTP 301
https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main?x=x&a=lindabanks@banknorthgeor... HTTP 301
https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/?x=x&a=lindabanks@banknorthgeo... HTTP 302
https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php... Page URL

Detected technologies

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /varnish(?: $Varnish\/([\d.]+)$)?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

2
IPs

2
Countries

337 kB
Transfer

336 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main?x=x&a=lindabanks@banknorthgeorgia.com HTTP 301
https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main?x=x&a=lindabanks@banknorthgeorgia.com HTTP 301
https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/?x=x&a=lindabanks@banknorthgeorgia.com HTTP 302
https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&. Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://banknorthgeorgia.com/favicon.ico HTTP 301
https://banknorthgeorgia.synovus.com/favicon.ico HTTP 301
https://www.synovus.com/

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request hdakfemzhezf91k844uuo3hszt.php Show response www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ Redirect Chain http://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main?x=x&a=lindabanks@banknorthgeorgia.com https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main?x=x&a=lindabanks@banknorthgeorgia.com https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/?x=x&a=lindabanks@banknorthgeorgia.com https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_...	954 B 1 KB	105ms 104ms	Document text/html	2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&. Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software Apache / Resource Hash `7a17039f6f5aab642307fcc004b7e2d8e03c613bdff62abec24003ff79edfd82` Request headers :method GET :authority www.aatjeras.nl :scheme https :path /wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&. pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none accept-encoding gzip, deflate, br cookie PHPSESSID=3kn6p6ku8va2cqlmq43n9p46of Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Tue, 13 Aug 2019 01:26:10 GMT server Apache content-length 954 content-type text/html; charset=UTF-8 x-dynamic-cache 1 cache-control max-age=60 x-varnish-host ip-172-16-1-85 x-varnish 152594748 age 0 via 1.1 varnish (Varnish/5.0) accept-ranges bytes Redirect headers status 302 date Tue, 13 Aug 2019 01:26:10 GMT server Apache expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache location hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&.#n=12528&c=&99642&fid=1&fav=1 content-length 0 content-type text/html; charset=UTF-8 set-cookie PHPSESSID=3kn6p6ku8va2cqlmq43n9p46of; path=/ x-varnish-host ip-172-16-1-85 x-varnish 155508645 age 0 via 1.1 varnish (Varnish/5.0)
GET H2	200	ova.php Show response www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ Frame C7FE	3 KB 4 KB	117ms 117ms	Document text/html	2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c= Requested by Host: www.aatjeras.nl URL: https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&. Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software Apache / Resource Hash `a1f5b5e95862c177d3da9c5209d4dc79993e7613fe140c5fa7455f7447066c6f` Request headers :method GET :authority www.aatjeras.nl :scheme https :path /wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode nested-navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site same-origin referer https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&. accept-encoding gzip, deflate, br cookie PHPSESSID=3kn6p6ku8va2cqlmq43n9p46of Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&. Response headers status 200 date Tue, 13 Aug 2019 01:26:10 GMT server Apache content-length 3393 content-type text/html; charset=UTF-8 x-dynamic-cache 1 cache-control max-age=60 x-varnish-host ip-172-16-1-85 x-varnish 157497057 age 0 via 1.1 varnish (Varnish/5.0) accept-ranges bytes
GET H2	200	default.jpg www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ico/bg/	165 KB 165 KB	61ms 60ms	Image image/jpeg	2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ico/bg/default.jpg Requested by Host: www.aatjeras.nl URL: https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&. Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software Apache / Resource Hash `6ed2882d1fa0602748acd16fca96bb884f446a356bb4db1f14e72b924cb646b6` Request headers Sec-Fetch-Mode no-cors Referer https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/hdakfemzhezf91k844uuo3hszt.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&loginID=&. User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 13 Aug 2019 01:26:10 GMT via 1.1 varnish (Varnish/5.0) last-modified Mon, 12 Aug 2019 21:27:03 GMT server Apache age 0 etag "29443-58ff22f660ee8" x-dynamic-cache 1 content-type image/jpeg status 200 cache-control max-age=60 x-varnish 157138217 accept-ranges bytes x-varnish-host ip-172-16-1-85 content-length 169027
GET H2	404	style.css www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/css/ Frame C7FE	0 0	52ms 52ms	Stylesheet text/html	2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/css/style.css Requested by Host: www.aatjeras.nl URL: https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software Apache / Resource Hash Request headers Sec-Fetch-Mode no-cors Referer https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 13 Aug 2019 01:26:10 GMT via 1.1 varnish (Varnish/5.0) server Apache age 0 x-varnish-host ip-172-16-1-85 status 404 cache-control no-cache, must-revalidate, max-age=0 x-varnish 152829033 content-type text/html; charset=UTF-8 link <https://www.aatjeras.nl/wp/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	js.js Show response www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ico/ Frame C7FE	6 KB 6 KB	32ms 32ms	Script application/javascript	2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ico/js.js Requested by Host: www.aatjeras.nl URL: https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software Apache / Resource Hash `1bcbd711541fce74fc4c58fce450956c507db9e1e9d83af8f13ed448e114f9a0` Request headers Sec-Fetch-Mode no-cors Referer https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 13 Aug 2019 01:26:10 GMT via 1.1 varnish (Varnish/5.0) last-modified Mon, 12 Aug 2019 21:24:14 GMT server Apache age 0 etag "1648-58ff2254f3463" x-dynamic-cache 1 content-type application/javascript status 200 cache-control max-age=60 x-varnish 144907669 accept-ranges bytes x-varnish-host ip-172-16-1-85 content-length 5704
GET H/1.1	200 OK	/ www.synovus.com/ Frame C7FE Redirect Chain http://banknorthgeorgia.com/favicon.ico https://banknorthgeorgia.synovus.com/favicon.ico https://www.synovus.com/	0 0	1268ms 1073ms	Image text/html	23.38.48.215 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://www.synovus.com/ Requested by Host: www.aatjeras.nl URL: https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.38.48.215 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a23-38-48-215.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Location https://www.synovus.com Date Tue, 13 Aug 2019 01:26:11 GMT Server AkamaiGHost Connection keep-alive Content-Length 0
GET H2	200	default.png www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ico/ Frame C7FE	161 KB 161 KB	34ms 33ms	Image image/png	2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ico/default.png Requested by Host: www.aatjeras.nl URL: https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software Apache / Resource Hash `6042219576f290d653a3942f0cbdae7708e2910f5bbd24c0a2e0d828e51a4df3` Request headers Sec-Fetch-Mode no-cors Referer https://www.aatjeras.nl/wp/wp-includes/SimplePie/HTTP/_custom/en/main/ova.php?a=bGluZGFiYW5rc0BiYW5rbm9ydGhnZW9yZ2lhLmNvbQ==&i=0&c= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 13 Aug 2019 01:26:12 GMT via 1.1 varnish (Varnish/5.0) last-modified Mon, 12 Aug 2019 21:24:14 GMT server Apache age 0 etag "282fc-58ff2254f3463" x-dynamic-cache 1 content-type image/png status 200 cache-control max-age=60 x-varnish 157010043 accept-ranges bytes x-varnish-host ip-172-16-1-85 content-length 164604

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.aatjeras.nl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3kn6p6ku8va2cqlmq43n9p46of

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

banknorthgeorgia.com
banknorthgeorgia.synovus.com
www.aatjeras.nl
www.synovus.com
23.38.48.215
23.38.61.52
23.52.57.239
2a05:d018:964:c0b:ca65:7773:2dd7:d9bd
1bcbd711541fce74fc4c58fce450956c507db9e1e9d83af8f13ed448e114f9a0
6042219576f290d653a3942f0cbdae7708e2910f5bbd24c0a2e0d828e51a4df3
6ed2882d1fa0602748acd16fca96bb884f446a356bb4db1f14e72b924cb646b6
7a17039f6f5aab642307fcc004b7e2d8e03c613bdff62abec24003ff79edfd82
a1f5b5e95862c177d3da9c5209d4dc79993e7613fe140c5fa7455f7447066c6f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

www.aatjeras.nl Open in urlscan Pro 2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

25 %IPv6

3 Domains

4 Subdomains

2 IPs

2 Countries

337 kBTransfer

336 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

www.aatjeras.nl Open in urlscan Pro
2a05:d018:964:c0b:ca65:7773:2dd7:d9bd Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

2
IPs

2
Countries

337 kB
Transfer

336 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!