premiesecure.com Open in urlscan Pro
185.120.57.40 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://premiesecure.com/be/portaal/groeipakket.html
Submission: On April 14 via api (April 14th 2021, 7:59:53 pm UTC) from BE

Summary HTTP 28 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 28 HTTP transactions. The main IP is 185.120.57.40, located in Moscow, Russian Federation and belongs to ITEXPRESS-AS, UA. The main domain is premiesecure.com.
TLS certificate: Issued by R3 on April 14th 2021. Valid for: 3 months.

This is the only time premiesecure.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Belgian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
21	185.120.57.40 185.120.57.40	47596 (ITEXPRESS-AS) (ITEXPRESS-AS)
2	2600:9000:21f... 2600:9000:21f3:5a00:1d:7847:f940:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
28	4

21 185.120.57.40 (Moscow, Russian Federation)

ASN47596 (ITEXPRESS-AS, UA)
PTR: koli.co

premiesecure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21f3:5a00:1d:7847:f940:93a1 (United States)

ASN16509 (AMAZON-02, US)

dij151upo6vad.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	premiesecure.com premiesecure.com	276 KB
2	cloudfront.net dij151upo6vad.cloudfront.net	97 KB
1	gstatic.com fonts.gstatic.com	16 KB
0	vlaanderengroeipakket.site Failed vlaanderengroeipakket.site Failed
28	4

	Domain	Requested by
21	premiesecure.com	premiesecure.com
2	dij151upo6vad.cloudfront.net	premiesecure.com
1	fonts.gstatic.com	premiesecure.com
0	vlaanderengroeipakket.site Failed	premiesecure.com
28	4

This site contains links to these domains. Also see Links.

Domain
www.vlaanderen.be
vlaanderengroeipakket.site

Subject Issuer	Validity	Valid
premiesecure.com R3	`2021-04-14` - `2021-07-13`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2021-02-22` - `2022-02-21`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://premiesecure.com/be/portaal/groeipakket.html
Frame ID: 9FE512CBD1CDC524F63C2AD21A0F6DFC
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

28
Requests

86 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

388 kB
Transfer

675 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.vlaanderen.be/corona
Title: vlaanderen.be/corona

Search URL Search Domain Scan URL

URL: https://vlaanderengroeipakket.site/covid19/toeslag/index.html
Title: Naar de homepagina van Vlaanderen Vlaanderen

Search URL Search Domain Scan URL

URL: https://vlaanderengroeipakket.site/covid19/toeslag/
Title: Afmelden

Search URL Search Domain Scan URL

URL: https://vlaanderengroeipakket.site/over-vlaanderenbe/uw-browser-wordt-niet-ondersteund
Title: Meer info

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request groeipakket.html Show response
premiesecure.com/be/portaal/ 257 KB
42 KB 1817ms
491ms Document
text/html 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 9da8b801ffda2e9936100f4b42fd0addab084de37632c26c9b149565185fe2dc

Request headers

Host: premiesecure.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:32 GMT
server: Apache/2.4.41 (Ubuntu)
last-modified: Mon, 15 Mar 2021 04:08:10 GMT
etag: "4029b-5bd8b65d33e80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 42222
content-type: text/html

GET d3f9cde6e9fdeda6a0be.js
vlaanderengroeipakket.site/_nuxt/ 0
0

GET 116a0daa836dbea86c15.js
vlaanderengroeipakket.site/_nuxt/ 0
0

GET
H/1.1 404
Not Found 59e659624be02fd0f57a.css
premiesecure.com/be/portaal/groeipakket_files/ 0
0 649ms
458ms Stylesheet
text/html 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/59e659624be02fd0f57a.css
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
server: Apache/2.4.41 (Ubuntu)
content-length: 278
content-type: text/html; charset=iso-8859-1

GET 31825b421e48a9b2a07b.js
vlaanderengroeipakket.site/_nuxt/ 0
0

GET
H/1.1 404
Not Found 4b272039d38bd85ff518.css
premiesecure.com/be/portaal/groeipakket_files/ 0
0 692ms
494ms Stylesheet
text/html 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/4b272039d38bd85ff518.css
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
server: Apache/2.4.41 (Ubuntu)
content-length: 278
content-type: text/html; charset=iso-8859-1

GET cec11eca3826ba9eafd6.js
vlaanderengroeipakket.site/_nuxt/ 0
0

GET
H/1.1 200
OK css
premiesecure.com/be/portaal/groeipakket_files/ 5 KB
5 KB 670ms
468ms Stylesheet
text/plain 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/css
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 5f2e43b0385f0a4cbbdfc5225b9d3abebcfa0390fffdf424064ef61783e0822e

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
last-modified: Wed, 25 Nov 2020 23:34:18 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1208-5b4f6ddb2f280"
content-length: 4616

GET
H/1.1 200
OK mmenu.css
premiesecure.com/be/portaal/groeipakket_files/ 47 KB
7 KB 722ms
468ms Stylesheet
text/css 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/mmenu.css
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: f0e44d3d60c12b0b1ecaa625a389aa51ef04a1669cad832350a10017a8ae995d

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
content-encoding: gzip
last-modified: Wed, 25 Nov 2020 23:34:18 GMT
server: Apache/2.4.41 (Ubuntu)
etag: "bda3-5b4f6ddb2f280-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 6693

GET
H/1.1 200
OK font-awesome.min.css
premiesecure.com/be/portaal/groeipakket_files/ 23 KB
6 KB 1133ms
485ms Stylesheet
text/css 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/font-awesome.min.css
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
content-encoding: gzip
last-modified: Wed, 25 Nov 2020 23:34:18 GMT
server: Apache/2.4.41 (Ubuntu)
etag: "5cbb-5b4f6ddb2f280-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 5443

GET
H/1.1 200
OK master.css
premiesecure.com/be/portaal/groeipakket_files/ 22 KB
4 KB 1147ms
477ms Stylesheet
text/css 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/master.css
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 18e1fe9601b5863d9c3c5076428a1f535345f1e1cf78575fe40bcb4d4ed6864b

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
content-encoding: gzip
last-modified: Wed, 25 Nov 2020 23:34:18 GMT
server: Apache/2.4.41 (Ubuntu)
etag: "56ef-5b4f6ddb2f280-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 4142

GET
H/1.1 200
OK Belfius-Pay-Button.png
premiesecure.com/be/portaal/groeipakket_files/ 2 KB
2 KB 534ms
490ms Image
image/png 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/Belfius-Pay-Button.png
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 27a90fd9b77579e5a20798deeb381cd978a8b08641e4437086d0f7643793b8c5

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
last-modified: Wed, 25 Nov 2020 23:34:18 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "8b6-5b4f6ddb2f280"
content-length: 2230
content-type: image/png

GET
H/1.1 200
OK 303px-KBC_Logo.svg.png
premiesecure.com/be/portaal/groeipakket_files/ 8 KB
9 KB 523ms
470ms Image
image/png 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/303px-KBC_Logo.svg.png
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 657231dd849913d013b47217800b7f2100976e02a379daab3d1d9b522dd8a449

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "2151-5b4f6ddd17700"
content-length: 8529
content-type: image/png

GET
H/1.1 200
OK 0
premiesecure.com/be/portaal/groeipakket_files/ 31 KB
31 KB 927ms
484ms Image
image/png 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/0
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: f1d7673927f0412d5399ebe53f0fee4b22a2153dda9b890df031860fe3916886

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "7a13-5b4f6ddd17700"
content-length: 31251

GET
H/1.1 200
OK Z7GJVM4p.jpg
premiesecure.com/be/portaal/groeipakket_files/ 12 KB
12 KB 891ms
466ms Image
image/jpeg 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/Z7GJVM4p.jpg
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b284bb8019b8db0bf0515a31238ee2314eab0683acbccc2a8d06d40ee0e7003

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:33 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "300e-5b4f6ddd17700"
content-length: 12302
content-type: image/jpeg

GET
H/1.1 200
OK ing_logo_sq.jpg
premiesecure.com/be/portaal/groeipakket_files/ 34 KB
34 KB 559ms
497ms Image
image/jpeg 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/ing_logo_sq.jpg
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 65d8f44a8cb66acc1e58127c7360f3507f0363c93917575f57fe3aca88a1777f

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:34 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "886d-5b4f6ddd17700"
content-length: 34925
content-type: image/jpeg

GET
H/1.1 200
OK 0bj3I9dl_400x400.jpg
premiesecure.com/be/portaal/groeipakket_files/ 6 KB
7 KB 971ms
463ms Image
image/jpeg 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/0bj3I9dl_400x400.jpg
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: dbc46668c7b721a63b9a60273d98f74a357cbdec9ab29f9f2dddb60ee8ea4997

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:34 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1974-5b4f6ddd17700"
content-length: 6516
content-type: image/jpeg

GET
H/1.1 200
OK unnamed.png
premiesecure.com/be/portaal/groeipakket_files/ 15 KB
15 KB 476ms
475ms Image
image/png 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/unnamed.png
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 451cadcfc88ac4645079e3cb33e388589c164df7c7e25974c599b3956f0a54f6

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:34 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "3c30-5b4f6ddd17700"
content-length: 15408
content-type: image/png

GET
H/1.1 200
OK d6c120098f41fee817f0cfc0850b0e646a4bfabe.png
premiesecure.com/be/portaal/groeipakket_files/ 27 KB
27 KB 501ms
467ms Image
image/png 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/d6c120098f41fee817f0cfc0850b0e646a4bfabe.png
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 9bdf2b71b714fc6cb098b356dc279f25debcf6f2751f57500f0f0795d11db7eb

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:34 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "6abd-5b4f6ddd17700"
content-length: 27325
content-type: image/png

GET
H/1.1 200
OK axa.jpg
premiesecure.com/be/portaal/groeipakket_files/ 18 KB
18 KB 740ms
467ms Image
image/jpeg 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/axa.jpg
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: f180bd6f19d8e724315b2cacdc5aeea6f1ed76e8a76089229b8ff5b7fdd3a3a9

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:34 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "46d8-5b4f6ddd17700"
content-length: 18136
content-type: image/jpeg

GET
H/1.1 200
OK bpost.png
premiesecure.com/be/portaal/groeipakket_files/ 46 KB
46 KB 575ms
465ms Image
image/png 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/bpost.png
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 9853e9d0c527cd2c62c1cf80f8b23810ba9f78e8ca0a03d723918fa3789b6f65

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:34 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "b6c4-5b4f6ddd17700"
content-length: 46788
content-type: image/png

GET
H/1.1 200
OK vlaanderen-logo.svg
premiesecure.com/be/portaal/groeipakket_files/ 11 KB
11 KB 628ms
471ms Image
image/svg+xml 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/vlaanderen-logo.svg
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: eb896b3443dcd5154bfa49d3231258b8e5c7df7c3c05cc2c05cd07c9937096db

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:34 GMT
last-modified: Wed, 25 Nov 2020 23:34:20 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "2bc7-5b4f6ddd17700"
content-length: 11207
content-type: image/svg+xml

GET
H/1.1 200
OK print.css
premiesecure.com/be/portaal/groeipakket_files/ 786 B
639 B 564ms
481ms Stylesheet
text/css 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/print.css
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 0799c36d1b03608b74039316f495e8364db7e947ae067d7b26d20f74fecd6bae

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:35 GMT
content-encoding: gzip
last-modified: Wed, 25 Nov 2020 23:34:18 GMT
server: Apache/2.4.41 (Ubuntu)
etag: "312-5b4f6ddb2f280-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 359

GET
H/1.1 404
Not Found 59e659624be02fd0f57a.css
premiesecure.com/be/portaal/groeipakket_files/ 0
0 502ms
472ms Stylesheet
text/html 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/59e659624be02fd0f57a.css
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:34 GMT
server: Apache/2.4.41 (Ubuntu)
content-length: 278
content-type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found 4b272039d38bd85ff518.css
premiesecure.com/be/portaal/groeipakket_files/ 0
0 503ms
465ms Stylesheet
text/html 185.120.57.40
ITEXPRESS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://premiesecure.com/be/portaal/groeipakket_files/4b272039d38bd85ff518.css
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.120.57.40 Moscow, Russian Federation, ASN47596 (ITEXPRESS-AS, UA),
Reverse DNS: koli.co
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Referer: https://premiesecure.com/be/portaal/groeipakket.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:34 GMT
server: Apache/2.4.41 (Ubuntu)
content-length: 278
content-type: text/html; charset=iso-8859-1

GET
H2 200 flanders-sans-regular.woff
dij151upo6vad.cloudfront.net/2.latest/fonts/ 49 KB
50 KB 65ms
39ms Font
application/octet-stream 2600:9000:21f3:5a00:1d:7847:f940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dij151upo6vad.cloudfront.net/2.latest/fonts/flanders-sans-regular.woff
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:5a00:1d:7847:f940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9175ef498f7a5e3be1bd699a1b831320a798facaef4a93edd087867191a44af6

Request headers

Origin: https://premiesecure.com
Referer: https://premiesecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:35 GMT
via: 1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
vary: Origin
x-amz-cf-pop: FRA2-C2
x-amz-meta-cb-modifiedtime: Thu, 07 Sep 2017 13:32:09 GMT
x-cache: Miss from cloudfront
content-length: 50272
last-modified: Thu, 06 Sep 2018 20:55:58 GMT
server: AmazonS3
etag: "f91515c105b07b113cc8d84756a6ec97"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: 7Yis5papVxTs3kVwq64Ulrp2wUA2XsMnyyeO-C7BXmulb1-xbEJKMg==

GET
H2 200 flanders-sans-medium.woff
dij151upo6vad.cloudfront.net/2.latest/fonts/ 47 KB
47 KB 76ms
50ms Font
application/octet-stream 2600:9000:21f3:5a00:1d:7847:f940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dij151upo6vad.cloudfront.net/2.latest/fonts/flanders-sans-medium.woff
Requested by: Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:5a00:1d:7847:f940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa4df60f848395cba9acc15f738f5f9b5b53b3fd9e9a9e1d594bef130f848cf0

Request headers

Origin: https://premiesecure.com
Referer: https://premiesecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Apr 2021 19:59:35 GMT
via: 1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
vary: Origin
x-amz-cf-pop: FRA2-C2
x-amz-meta-cb-modifiedtime: Thu, 07 Sep 2017 13:32:09 GMT
x-cache: Miss from cloudfront
content-length: 47820
last-modified: Thu, 06 Sep 2018 20:55:58 GMT
server: AmazonS3
etag: "8cfb4970e46ee18fe321b9a168ceb19e"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: klpQzw6fc14XoKGxdJ_dL7JuIR2TJs2TVnuNY5lqqKeuwSm-ouWcig==

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v20/ 15 KB
16 KB 34ms
20ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: premiesecure.com
URL: https://premiesecure.com/be/portaal/groeipakket_files/css

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://premiesecure.com
Referer: https://premiesecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Apr 2021 10:03:38 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:36 GMT
server: sffe
age: 294956
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15736
x-xss-protection: 0
expires: Mon, 11 Apr 2022 10:03:38 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: vlaanderengroeipakket.site
URL: https://vlaanderengroeipakket.site/_nuxt/d3f9cde6e9fdeda6a0be.js

Domain: vlaanderengroeipakket.site
URL: https://vlaanderengroeipakket.site/_nuxt/116a0daa836dbea86c15.js

Domain: vlaanderengroeipakket.site
URL: https://vlaanderengroeipakket.site/_nuxt/31825b421e48a9b2a07b.js

Domain: vlaanderengroeipakket.site
URL: https://vlaanderengroeipakket.site/_nuxt/cec11eca3826ba9eafd6.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Belgian Government (Government)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dij151upo6vad.cloudfront.net
fonts.gstatic.com
premiesecure.com
vlaanderengroeipakket.site
vlaanderengroeipakket.site
185.120.57.40
2600:9000:21f3:5a00:1d:7847:f940:93a1
2a00:1450:4001:802::2003
0799c36d1b03608b74039316f495e8364db7e947ae067d7b26d20f74fecd6bae
18e1fe9601b5863d9c3c5076428a1f535345f1e1cf78575fe40bcb4d4ed6864b
27a90fd9b77579e5a20798deeb381cd978a8b08641e4437086d0f7643793b8c5
3b284bb8019b8db0bf0515a31238ee2314eab0683acbccc2a8d06d40ee0e7003
451cadcfc88ac4645079e3cb33e388589c164df7c7e25974c599b3956f0a54f6
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5f2e43b0385f0a4cbbdfc5225b9d3abebcfa0390fffdf424064ef61783e0822e
657231dd849913d013b47217800b7f2100976e02a379daab3d1d9b522dd8a449
65d8f44a8cb66acc1e58127c7360f3507f0363c93917575f57fe3aca88a1777f
9175ef498f7a5e3be1bd699a1b831320a798facaef4a93edd087867191a44af6
9853e9d0c527cd2c62c1cf80f8b23810ba9f78e8ca0a03d723918fa3789b6f65
9bdf2b71b714fc6cb098b356dc279f25debcf6f2751f57500f0f0795d11db7eb
9da8b801ffda2e9936100f4b42fd0addab084de37632c26c9b149565185fe2dc
aa4df60f848395cba9acc15f738f5f9b5b53b3fd9e9a9e1d594bef130f848cf0
dbc46668c7b721a63b9a60273d98f74a357cbdec9ab29f9f2dddb60ee8ea4997
eb896b3443dcd5154bfa49d3231258b8e5c7df7c3c05cc2c05cd07c9937096db
f0e44d3d60c12b0b1ecaa625a389aa51ef04a1669cad832350a10017a8ae995d
f180bd6f19d8e724315b2cacdc5aeea6f1ed76e8a76089229b8ff5b7fdd3a3a9
f1d7673927f0412d5399ebe53f0fee4b22a2153dda9b890df031860fe3916886

premiesecure.com Open in urlscan Pro 185.120.57.40 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

28 Requests

86 %HTTPS

67 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

388 kBTransfer

675 kBSize

0 Cookies

4 Outgoing links

Redirected requests

28 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

premiesecure.com Open in urlscan Pro
185.120.57.40 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

28
Requests

86 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

388 kB
Transfer

675 kB
Size

0
Cookies

28 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!