dubbel16.nl
Open in
urlscan Pro
2a01:7c8:eb:0:95:170:70:28
Malicious Activity!
Public Scan
Effective URL: https://dubbel16.nl/geAMsds/0a613039022a7d5/
Submission: On July 24 via manual from IN
Summary
TLS certificate: Issued by R3 on July 20th 2021. Valid for: 3 months.
This is the only time dubbel16.nl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 143.204.98.49 143.204.98.49 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 13.226.145.53 13.226.145.53 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 13.226.145.36 13.226.145.36 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 34.203.174.136 34.203.174.136 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 13.226.145.20 13.226.145.20 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 54.157.80.110 54.157.80.110 | 14618 (AMAZON-AES) (AMAZON-AES) | |
3 16 | 2a01:7c8:eb:0... 2a01:7c8:eb:0:95:170:70:28 | 20857 (TRANSIP-A...) (TRANSIP-AS Amsterdam) | |
23 | 8 |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-49.fra50.r.cloudfront.net
sites.ziftsolutions.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-226-145-53.dus51.r.cloudfront.net
widgets.ziftsolutions.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-226-145-36.dus51.r.cloudfront.net
static.ziftsolutions.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-203-174-136.compute-1.amazonaws.com
cisco.ziftsolutions.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-226-145-20.dus51.r.cloudfront.net
dynamic.ziftsolutions.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-80-110.compute-1.amazonaws.com
analytics.ziftsolutions.com |
ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL)
www.dubbel16.nl | |
dubbel16.nl |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
dubbel16.nl
3 redirects
www.dubbel16.nl dubbel16.nl |
724 KB |
9 |
ziftsolutions.com
sites.ziftsolutions.com widgets.ziftsolutions.com static.ziftsolutions.com cisco.ziftsolutions.com dynamic.ziftsolutions.com analytics.ziftsolutions.com |
58 KB |
23 | 2 |
Domain | Requested by | |
---|---|---|
15 | dubbel16.nl |
2 redirects
sites.ziftsolutions.com
dubbel16.nl |
3 | static.ziftsolutions.com |
widgets.ziftsolutions.com
|
2 | analytics.ziftsolutions.com |
static.ziftsolutions.com
|
1 | www.dubbel16.nl | 1 redirects |
1 | dynamic.ziftsolutions.com |
widgets.ziftsolutions.com
|
1 | cisco.ziftsolutions.com |
widgets.ziftsolutions.com
|
1 | widgets.ziftsolutions.com |
sites.ziftsolutions.com
|
1 | sites.ziftsolutions.com | |
23 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ziftsolutions.com Amazon |
2021-07-01 - 2022-07-30 |
a year | crt.sh |
*.dubbel16.nl R3 |
2021-07-20 - 2021-10-18 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://dubbel16.nl/geAMsds/0a613039022a7d5/
Frame ID: E783B0EB24FF76FDA057BEDE75A1A4EE
Requests: 22 HTTP requests in this frame
Frame:
https://dubbel16.nl/geAMsds/assets/prefetch.html
Frame ID: 6A336F50B4523368BD643A5E5A72E191
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://sites.ziftsolutions.com/cisco.ziftsolutions.com/ff80818155cb9e5b0155d9bc34ae2a6a?cid=ff8081816385bef... Page URL
-
https://www.dubbel16.nl/geAMsds
HTTP 301
http://dubbel16.nl/geAMsds/ HTTP 301
https://dubbel16.nl/geAMsds/ HTTP 302
https://dubbel16.nl/geAMsds/0a613039022a7d5/ Page URL
Detected technologies
Amazon Web Services (PaaS) ExpandDetected patterns
- headers via /\(CloudFront\)$/i
- headers server /^AmazonS3$/i
Amazon Cloudfront (CDN) Expand
Detected patterns
- headers via /\(CloudFront\)$/i
Amazon S3 (Miscellaneous) Expand
Detected patterns
- headers server /^AmazonS3$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://sites.ziftsolutions.com/cisco.ziftsolutions.com/ff80818155cb9e5b0155d9bc34ae2a6a?cid=ff8081816385befc01639383f9e82fc1&url=https%3A%2F%2Fwww.dubbel16.nl%2FgeAMsds Page URL
-
https://www.dubbel16.nl/geAMsds
HTTP 301
http://dubbel16.nl/geAMsds/ HTTP 301
https://dubbel16.nl/geAMsds/ HTTP 302
https://dubbel16.nl/geAMsds/0a613039022a7d5/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
ff80818155cb9e5b0155d9bc34ae2a6a
sites.ziftsolutions.com/cisco.ziftsolutions.com/ |
542 B 930 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ff80818155cb9e5b0155d9bc34ae2a6a
widgets.ziftsolutions.com/cisco.ziftsolutions.com/js/ |
10 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zpanel_20170605.js
static.ziftsolutions.com/widgets/js/ |
17 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zsizzle.20110528.js
static.ziftsolutions.com/widgets/js/ |
21 KB 22 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ztrack.20170214.js
static.ziftsolutions.com/widgets/js/ |
9 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v
cisco.ziftsolutions.com/uuid/ |
0 528 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0
dynamic.ziftsolutions.com/8a0c5e3b4b61cb0f014b62d8b5de00a1/Default/ff80818155cb9e5b0155d9bc34ae2a6a/ |
317 B 704 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v
analytics.ziftsolutions.com/trk/ |
48 B 660 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c
analytics.ziftsolutions.com/trk/ |
70 B 629 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
dubbel16.nl/geAMsds/0a613039022a7d5/ Redirect Chain
|
203 KB 203 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
v
analytics.ziftsolutions.com/trk/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
dubbel16.nl/geAMsds/0a613039022a7d5/ |
0 203 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ConvergedLogin_PCore_FZ20atAlhirHa_737xNftg2.js.download
dubbel16.nl/geAMsds/assets/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logos.svg
dubbel16.nl/geAMsds/assets/img/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sec.svg
dubbel16.nl/geAMsds/assets/img/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ConvergedLogin_PCore_FZ20atAlhirHa_737xNftg2.js.download
dubbel16.nl/geAMsds/assets/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
dubbel16.nl/geAMsds/assets/css/ |
0 105 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
prefetch.html
dubbel16.nl/geAMsds/assets/ Frame 6A33 |
196 B 399 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bk.svg
dubbel16.nl/geAMsds/assets/img/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ConvergedLogin_PCore_FZ20atAlhirHa_737xNftg2.js.download
dubbel16.nl/geAMsds/assets/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
dubbel16.nl/geAMsds/0a613039022a7d5/ |
0 203 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
dubbel16.nl/geAMsds/0a613039022a7d5/ |
203 KB 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
dubbel16.nl/geAMsds/0a613039022a7d5/ |
203 KB 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- analytics.ziftsolutions.com
- URL
- https://analytics.ziftsolutions.com/trk/v?id=ff80818155cb9e5b0155d9bc34ae2a6a&clid=8a12350747c4c06e0147c691962f772a&u=D63816BB39925FF982EF&ekey=&p=8abfca7a5260e1c7015268d14c716bb0&uuid_holder=zt_tJ3ot02f&fr=true&duration=0.744&random=0.705263065214953
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| $Debug object| $Do function| $Loader function| GetString function| GetErrorString function| GetUrl object| $B object| StringRepository object| PROOF boolean| __1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
dubbel16.nl/ | Name: PHPSESSID Value: eb4bdbd114f1bee0a36b2ca275567852 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.ziftsolutions.com
cisco.ziftsolutions.com
dubbel16.nl
dynamic.ziftsolutions.com
sites.ziftsolutions.com
static.ziftsolutions.com
widgets.ziftsolutions.com
www.dubbel16.nl
analytics.ziftsolutions.com
13.226.145.20
13.226.145.36
13.226.145.53
143.204.98.49
2a01:7c8:eb:0:95:170:70:28
34.203.174.136
54.157.80.110
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
218e54287719754c522cb29718424e2d167555f34f43c059ad9a58eb7cdec74e
701e16f9669e6ed4c0d367125e69fd7fe69d5ef04711d6d2cac9a29813f5858d
743c0c95f18dcb4ce4b59db52c8130d47b9cb8804c78e518b0638c2456d8d65f
7ff13ba51d3a8635d3242731c2b43b9bec775092e4cd021b71825acaf83364a6
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
d9ecd8dea1d12cb88d51df4fb8b88115460220c90d0d30d79b116d4d2bc7558f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f29b9469f49eec6610c10039e8a7a82535979f35bef16085894a858e289daefb
f68d1762e067c25b07eceed2203661ea4998bd3867ab50e0be054a1ce12633df