mededinging.nl Open in urlscan Pro
2a04:8400:1:1::223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mededinging.nl/up-ppl
Effective URL:
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x...
Submission: On November 16 via manual (November 16th 2019, 11:56:07 pm UTC) from PS

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2a04:8400:1:1::223, located in Netherlands and belongs to PROLOCATION Transit policy pref 100, NL. The main domain is mededinging.nl.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 4th 2019. Valid for: 2 years.

This is the only time mededinging.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
4 9	2a04:8400:1:1... 2a04:8400:1:1::223	41887 (PROLOCATI...) (PROLOCATION Transit policy pref 100)
5	2.21.38.79 2.21.38.79	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
10	2

9 2a04:8400:1:1::223 (Netherlands) 4 redirects

ASN41887 (PROLOCATION Transit policy pref 100, NL)

mededinging.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.21.38.79 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-38-79.deploy.static.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	mededinging.nl 4 redirects mededinging.nl	49 KB
5	paypalobjects.com www.paypalobjects.com	148 KB
10	2

	Domain	Requested by
9	mededinging.nl	4 redirects mededinging.nl
5	www.paypalobjects.com	mededinging.nl
10	2

This site contains no links.

Subject Issuer	Validity	Valid
www.mededinging.nl Sectigo RSA Domain Validation Secure Server CA	`2019-06-04` - `2021-06-04`	2 years	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2019-09-10` - `2020-08-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$YtBoEEME$33hy9/EShepYSORRPJMKB/&safety=9lt5dSZ0fx1rd628Rub5FTcfzWeyDajn09io6cNI6H5LJB5gK7v37YahPb9q0XfGeb9cbM5s2QkCe4U14O8e15pEd4mwAV
Frame ID: 598D6F6CDFF276DC9012FC2A9C78CB98
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://mededinging.nl/up-ppl HTTP 301
https://mededinging.nl/up-ppl/ HTTP 302
https://mededinging.nl/up-ppl/XYSDIRX.php HTTP 302
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9 HTTP 301
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/ Page URL
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/secureaccount.php?country.x=DE&local... Page URL

Detected technologies

Debian (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Debian/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

196 kB
Transfer

342 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mededinging.nl/up-ppl HTTP 301
https://mededinging.nl/up-ppl/ HTTP 302
https://mededinging.nl/up-ppl/XYSDIRX.php HTTP 302
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9 HTTP 301
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/ Page URL
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$YtBoEEME$33hy9/EShepYSORRPJMKB/&safety=9lt5dSZ0fx1rd628Rub5FTcfzWeyDajn09io6cNI6H5LJB5gK7v37YahPb9q0XfGeb9cbM5s2QkCe4U14O8e15pEd4mwAV Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://mededinging.nl/up-ppl HTTP 301
https://mededinging.nl/up-ppl/ HTTP 302
https://mededinging.nl/up-ppl/XYSDIRX.php HTTP 302
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9 HTTP 301
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/
mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/
Redirect Chain

https://mededinging.nl/up-ppl
https://mededinging.nl/up-ppl/
https://mededinging.nl/up-ppl/XYSDIRX.php
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9
https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/

285 B
680 B

146ms
145ms

Document
text/html

2a04:8400:1:1::223
PROLOCATION Trans...

General

Check archive.org

Show headers Download Go to

Full URL

https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:8400:1:1::223 , Netherlands, ASN41887 (PROLOCATION Transit policy pref 100, NL),

Reverse DNS

Software

Apache/2.4.25 (Debian) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Host: mededinging.nl
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=l3fk3a0guejip33j71kfpdlod4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

Date: Sat, 16 Nov 2019 23:55:51 GMT
Server: Apache/2.4.25 (Debian)
Strict-Transport-Security: max-age=31536000; preload
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 265
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Sat, 16 Nov 2019 23:55:51 GMT
Server: Apache/2.4.25 (Debian)
Strict-Transport-Security: max-age=31536000; preload
Location: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/
Cache-Control: max-age=0
Expires: Sat, 16 Nov 2019 23:55:51 GMT
Content-Length: 352
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK Primary Request secureaccount.php Show response
mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/ 2 KB
1 KB 359ms
358ms Document
text/html 2a04:8400:1:1::223
PROLOCATION Trans...

General

Check archive.org

Show headers Download Go to

Full URL

https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$YtBoEEME$33hy9/EShepYSORRPJMKB/&safety=9lt5dSZ0fx1rd628Rub5FTcfzWeyDajn09io6cNI6H5LJB5gK7v37YahPb9q0XfGeb9cbM5s2QkCe4U14O8e15pEd4mwAV

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:8400:1:1::223 , Netherlands, ASN41887 (PROLOCATION Transit policy pref 100, NL),

Reverse DNS

Software

Apache/2.4.25 (Debian) /

Resource Hash

660040017906365b9198d8c8b9fb0c69609407f6b2070c9bf6b2dce1dcfc6fd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Host: mededinging.nl
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: same-origin
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=l3fk3a0guejip33j71kfpdlod4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/

Response headers

Date: Sat, 16 Nov 2019 23:55:51 GMT
Server: Apache/2.4.25 (Debian)
Strict-Transport-Security: max-age=31536000; preload
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 889
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery.min.js Show response
mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/js/ 85 KB
30 KB 284ms
284ms Script
application/javascript 2a04:8400:1:1::223
PROLOCATION Trans...

General

Check archive.org

Show headers Download Go to

Full URL

https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/js/jquery.min.js

Requested by

Host: mededinging.nl
URL: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$YtBoEEME$33hy9/EShepYSORRPJMKB/&safety=9lt5dSZ0fx1rd628Rub5FTcfzWeyDajn09io6cNI6H5LJB5gK7v37YahPb9q0XfGeb9cbM5s2QkCe4U14O8e15pEd4mwAV

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:8400:1:1::223 , Netherlands, ASN41887 (PROLOCATION Transit policy pref 100, NL),

Reverse DNS

Software

Apache/2.4.25 (Debian) /

Resource Hash

d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$YtBoEEME$33hy9/EShepYSORRPJMKB/&safety=9lt5dSZ0fx1rd628Rub5FTcfzWeyDajn09io6cNI6H5LJB5gK7v37YahPb9q0XfGeb9cbM5s2QkCe4U14O8e15pEd4mwAV
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 16 Nov 2019 23:55:51 GMT
Content-Encoding: gzip
Last-Modified: Sat, 16 Nov 2019 23:55:51 GMT
Server: Apache/2.4.25 (Debian)
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; preload
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 30309
Expires: Sun, 15 Nov 2020 23:55:51 GMT

GET
H/1.1 200
OK xappx.css
mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/css/ 108 KB
15 KB 320ms
245ms Stylesheet
text/css 2a04:8400:1:1::223
PROLOCATION Trans...

General

Check archive.org

Show headers Download Go to

Full URL

https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/css/xappx.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:8400:1:1::223 , Netherlands, ASN41887 (PROLOCATION Transit policy pref 100, NL),

Reverse DNS

Software

Apache/2.4.25 (Debian) /

Resource Hash

544dfa59462862db7bafc2d2e4b3925ac3eacb11e52834916df02bd1cda19b1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$YtBoEEME$33hy9/EShepYSORRPJMKB/&safety=9lt5dSZ0fx1rd628Rub5FTcfzWeyDajn09io6cNI6H5LJB5gK7v37YahPb9q0XfGeb9cbM5s2QkCe4U14O8e15pEd4mwAV
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 16 Nov 2019 23:55:52 GMT
Content-Encoding: gzip
Last-Modified: Sat, 16 Nov 2019 23:55:51 GMT
Server: Apache/2.4.25 (Debian)
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; preload
Content-Type: text/css; charset=utf-8
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 14671
Expires: Sun, 15 Nov 2020 23:55:52 GMT

GET
H/1.1 200
OK xsecx.js Show response
mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/js/ 268 B
646 B 311ms
235ms Script
application/javascript 2a04:8400:1:1::223
PROLOCATION Trans...

General

Check archive.org

Show headers Download Go to

Full URL

https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/js/xsecx.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:8400:1:1::223 , Netherlands, ASN41887 (PROLOCATION Transit policy pref 100, NL),

Reverse DNS

Software

Apache/2.4.25 (Debian) /

Resource Hash

12bec3e411f30e9f988a001dc06817aef7a8d2513fb2e78c989d75a4946714de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$YtBoEEME$33hy9/EShepYSORRPJMKB/&safety=9lt5dSZ0fx1rd628Rub5FTcfzWeyDajn09io6cNI6H5LJB5gK7v37YahPb9q0XfGeb9cbM5s2QkCe4U14O8e15pEd4mwAV
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 16 Nov 2019 23:55:52 GMT
Content-Encoding: gzip
Last-Modified: Sat, 16 Nov 2019 23:55:51 GMT
Server: Apache/2.4.25 (Debian)
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; preload
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 178
Expires: Sun, 15 Nov 2020 23:55:52 GMT

GET
H2 200 monogram@2x.png
www.paypalobjects.com/images/shared/ 2 KB
2 KB 55ms
12ms Image
image/png 2.21.38.79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/monogram@2x.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.21.38.79 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-38-79.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

2a2cacf1f67863eedabdf29f70e2ad64391a1a1cb005f722fea3fe5e3c47230d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 16 Nov 2019 23:55:52 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Mar 2016 21:42:48 GMT
server: Apache
strict-transport-security: max-age=31536000
p3p: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-type: image/png
content-length: 2020
expires: Sat, 16 Nov 2019 23:55:52 GMT

GET
H2 200 animation-oval.png
www.paypalobjects.com/images/shared/ 5 KB
5 KB 34ms
13ms Image
image/png 2.21.38.79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/animation-oval.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.21.38.79 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-38-79.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

fd7b4a21981e9d86de41dba75185c948797d7c4f10944f8a202bee6fe8f03b7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/css/xappx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 16 Nov 2019 23:55:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 13 Aug 2015 18:35:25 GMT
server: Apache
strict-transport-security: max-age=31536000
p3p: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-type: image/png
content-length: 5095
expires: Sat, 16 Nov 2019 23:55:52 GMT

GET
H2 200 PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 48 KB
48 KB 27ms
6ms Font
application/x-font-woff 2.21.38.79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Light.woff

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.21.38.79 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-38-79.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/css/xappx.css
Origin: https://mededinging.nl
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 16 Nov 2019 23:55:52 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 49115
expires: Mon, 16 Dec 2019 23:55:52 GMT

GET
H2 200 PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 46 KB
46 KB 33ms
12ms Font
application/x-font-woff 2.21.38.79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Light.woff

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.21.38.79 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-38-79.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/css/xappx.css
Origin: https://mededinging.nl
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 16 Nov 2019 23:55:52 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 46703
expires: Mon, 16 Dec 2019 23:55:52 GMT

GET
H2 200 PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ 46 KB
47 KB 38ms
17ms Font
application/x-font-woff 2.21.38.79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansSmall-Regular.woff

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.21.38.79 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-38-79.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://mededinging.nl/up-ppl/671eff0dd599bb105c5852b4ce5a46e9/XYSASSETSX/css/xappx.css
Origin: https://mededinging.nl
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 16 Nov 2019 23:55:52 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2015 05:09:04 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 47339
expires: Mon, 16 Dec 2019 23:55:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mededinging.nl/	1969-12-31 23:59:59	Name: PHPSESSID Value: l3fk3a0guejip33j71kfpdlod4

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mededinging.nl
www.paypalobjects.com
2.21.38.79
2a04:8400:1:1::223
12bec3e411f30e9f988a001dc06817aef7a8d2513fb2e78c989d75a4946714de
2a2cacf1f67863eedabdf29f70e2ad64391a1a1cb005f722fea3fe5e3c47230d
544dfa59462862db7bafc2d2e4b3925ac3eacb11e52834916df02bd1cda19b1d
660040017906365b9198d8c8b9fb0c69609407f6b2070c9bf6b2dce1dcfc6fd1
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
fd7b4a21981e9d86de41dba75185c948797d7c4f10944f8a202bee6fe8f03b7b

mededinging.nl Open in urlscan Pro 2a04:8400:1:1::223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

196 kBTransfer

342 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

mededinging.nl Open in urlscan Pro
2a04:8400:1:1::223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

196 kB
Transfer

342 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!