20939-3616.s2.webspace.re
Open in
urlscan Pro
91.218.65.223
Malicious Activity!
Public Scan
Submission: On July 04 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on July 3rd 2022. Valid for: 3 months.
This is the only time 20939-3616.s2.webspace.re was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rabobank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 91.218.65.223 91.218.65.223 | 44486 (SYNLINQ s...) (SYNLINQ synlinq.de) | |
18 | 2a02:26f0:d6:... 2a02:26f0:d6::5f65:5390 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
20 | 3 |
ASN44486 (SYNLINQ synlinq.de, DE)
PTR: plesk2.living-bots.net
20939-3616.s2.webspace.re |
ASN20940 (AKAMAI-ASN1, NL)
bankieren.rabobank.nl |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
rabobank.nl
bankieren.rabobank.nl — Cisco Umbrella Rank: 54860 |
219 KB |
1 |
webspace.re
20939-3616.s2.webspace.re |
3 KB |
20 | 2 |
Domain | Requested by | |
---|---|---|
18 | bankieren.rabobank.nl |
20939-3616.s2.webspace.re
bankieren.rabobank.nl |
1 | 20939-3616.s2.webspace.re | |
20 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.rabobank.nl |
Subject Issuer | Validity | Valid | |
---|---|---|---|
20939-3616.s2.webspace.re R3 |
2022-07-03 - 2022-10-01 |
3 months | crt.sh |
bankieren.rabobank.nl DigiCert SHA2 Extended Validation Server CA |
2022-03-29 - 2023-03-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://20939-3616.s2.webspace.re/ddlm/index.php
Frame ID: FF63F044C8483A2C5832DC31F8D79119
Requests: 22 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
20939-3616.s2.webspace.re/ddlm/ |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rass-proto.css
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/css/ |
125 KB 82 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
www-extension.css
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/css/ |
29 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.css
bankieren.rabobank.nl/klanten/static/generic/font/myriad/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
x12.js
bankieren.rabobank.nl/rabo/sam/javascript/ |
43 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rabobank_logo.png
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/images/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
grayed-out-vc-nl.png
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/images/ |
27 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
brwfunc.js
bankieren.rabobank.nl/rabo/sam/javascript/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
device.min.js
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/scripts/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rass-proto.js
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/scripts/ |
61 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3b0f1c67-c2e4-4df6-976f-49d52e45aba1.woff2
bankieren.rabobank.nl/klanten/static/generic/font/myriad/fonts/ |
16 KB 17 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
itje_16x16_new.svg
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/css/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
checkbox_off.svg
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/css/images/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_supercirkel_kruisje.svg
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/css/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_supercirkel_vraagteken.svg
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/css/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_supercirkel_pijl.svg
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/css/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
e7e30ff2-3a95-49b0-bbf9-024f40ead426.woff2
bankieren.rabobank.nl/klanten/static/generic/font/myriad/fonts/ |
16 KB 17 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/opentype |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/opentype |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_supercirkel_pijl_bl.svg
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/css/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_supercirkel_pijl_wh.svg
bankieren.rabobank.nl/rabo/sam/vrs1112/newdesign/css/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2cc3ff2f-19fe-458d-99da-2fb1acb43d81.woff2
bankieren.rabobank.nl/klanten/static/generic/font/myriad/fonts/ |
16 KB 18 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- bankieren.rabobank.nl
- URL
- https://bankieren.rabobank.nl/rabo/sam/javascript/brwfunc.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rabobank (Banking)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation undefined| x12 object| conf object| Observer object| Collector object| Util object| Controler object| Timer object| Recorder object| Analyzer object| Dispatcher object| Logger object| OLB1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
20939-3616.s2.webspace.re/ | Name: PHPSESSID Value: qb7cokggm16b0p7s7v5ab34gdu |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
20939-3616.s2.webspace.re
bankieren.rabobank.nl
bankieren.rabobank.nl
2a02:26f0:d6::5f65:5390
91.218.65.223
03caeff0f4235241611956eeb18dcbfabb8b67083208f00a0b0f92fbff9b28bd
0516a3e62949bbde4c1af2e772ab7fe17d77270f1a9b7f1b131bd812728825d5
38c4d8545f516160836a743e226bdfc17fed5f4629060e113bb5be2b49a53544
430b74ebc9fa3839a744586bf75baece6290a2f1b5bd0d53ac40c15fb972b536
44a25ec929398794378467dafe45d4876f2a37664f86b4bed361b973e41df25e
4697186ecaff75575c6783e8cecd42dfd34b79858ef8baad9c1f7076cb072955
4a5aa48335009a38332afa6031d2ef19dde95a4b04c6c81ae74a2fbbbea5c86f
4dbba2be9bb99b3192ee293127cb103876e4b5bf66c2fede8a3f6678c242711e
5773218aa904974902cdd36862f042c9e4bcdb75a5c51881cd7c3ad70f45240e
5bc5eedf7164055f5658a7c6129ff8886564713fe82cad2ed3d9f94f6308f5f9
5bd13b67370a235b3132593811cbe6ff6c35ef1ec9f228994db0d30b29ef02b1
6bf49648ded3c320b956ddf452fe698858cb9822051449aa7147c79c5094cf0f
828129fe18f492866bcc822c9338af9244d4677404d899f80121dbfaccefe82d
944f2f099c260c23eb51b71280e61577cd2f4cf4980fc8ef57f578f2b9d3982d
9c2ad9917fb40d08a88081d08e04fc616d992ad29fcbaab7dcaa772a4d9af7fa
aa99f64a685d07bd6148d08a3446ff99ac31545b51f6ff54f550a58640229467
c0a3bbe501ee2ef2c8bc2031667bdc41d3f4d19e1715317d6a9ef924b0d39323
c0e45bbcde9bb989aa7d8df818179f789f4574ba858960f64dc006c95b619b5f
df8918107f3653608d7ed6efa7585294bb2f123e0825e7c9fd2f3658673fc6b9
e6f45fcfe73b74e4c5110dea82e02df4768721c0c7ece329fa89bac863d3883e
fe748922f0098bbdadddfbf0db28277e7ba4021d13d9a7f607bb7a2ec16863f2