be-ltsnowportal.duckdns.org
Open in
urlscan Pro
37.114.49.147
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On June 18 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by R11 on June 11th 2024. Valid for: 3 months.
This is the only time be-ltsnowportal.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Kamer van Koophandel (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 37.114.49.147 37.114.49.147 | 44486 (SYNLINQ s...) (SYNLINQ synlinq.de) | |
1 | 2606:4700::68... 2606:4700::6812:18a3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 3.160.150.62 3.160.150.62 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 13.226.153.94 13.226.153.94 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 44.226.121.151 44.226.121.151 | 16509 (AMAZON-02) (AMAZON-02) | |
13 | 5 |
ASN44486 (SYNLINQ synlinq.de, DE)
PTR: default.bero-host.de
be-ltsnowportal.duckdns.org |
ASN16509 (AMAZON-02, US)
PTR: server-3-160-150-62.fra60.r.cloudfront.net
cdn.appdynamics.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-226-153-94.dus51.r.cloudfront.net
persoonlijk.knab.nl |
ASN16509 (AMAZON-02, US)
PTR: ec2-44-226-121-151.us-west-2.compute.amazonaws.com
col.eum-appdynamics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
duckdns.org
be-ltsnowportal.duckdns.org |
188 KB |
1 |
eum-appdynamics.com
col.eum-appdynamics.com — Cisco Umbrella Rank: 3280 |
868 B |
1 |
knab.nl
persoonlijk.knab.nl |
3 KB |
1 |
appdynamics.com
cdn.appdynamics.com — Cisco Umbrella Rank: 4683 |
20 KB |
1 |
gyazo.com
i.gyazo.com — Cisco Umbrella Rank: 98501 |
36 KB |
13 | 5 |
Domain | Requested by | |
---|---|---|
9 | be-ltsnowportal.duckdns.org |
be-ltsnowportal.duckdns.org
|
1 | col.eum-appdynamics.com |
cdn.appdynamics.com
|
1 | persoonlijk.knab.nl | |
1 | cdn.appdynamics.com |
be-ltsnowportal.duckdns.org
|
1 | i.gyazo.com |
be-ltsnowportal.duckdns.org
|
13 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.knab.nl |
www.kvk.nl |
Subject Issuer | Validity | Valid | |
---|---|---|---|
be-ltsnowportal.duckdns.org R11 |
2024-06-11 - 2024-09-09 |
3 months | crt.sh |
gyazo.com E1 |
2024-06-01 - 2024-08-30 |
3 months | crt.sh |
*.appdynamics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-06-21 - 2024-07-21 |
a year | crt.sh |
persoonlijk-nieuw.knab.nl DigiCert EV RSA CA G2 |
2023-10-20 - 2024-10-19 |
a year | crt.sh |
*.eum-appdynamics.com DigiCert TLS RSA SHA256 2020 CA1 |
2024-06-13 - 2025-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://be-ltsnowportal.duckdns.org/kna/
Frame ID: 22F42B09B4047A4AC96E8BE0509F80AB
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Controleer het gebruik van uw KnabDetected technologies
AppDynamics (Analytics) ExpandDetected patterns
- adrum
Google Tag Manager (Tag Managers) Expand
Detected patterns
- <!-- (?:End )?Google Tag Manager -->
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: knab.nl
Search URL Search Domain Scan URL
Title: Service & contact
Search URL Search Domain Scan URL
Title: Ga naar de homepage van knab.nl
Search URL Search Domain Scan URL
Title: Service & contact
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
be-ltsnowportal.duckdns.org/kna/ |
23 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-40.min.css
be-ltsnowportal.duckdns.org/kna/KvK/ |
587 KB 65 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.min.css
be-ltsnowportal.duckdns.org/kna/KvK/ |
71 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
adrum.js.download
be-ltsnowportal.duckdns.org/kna/KvK/ |
73 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
65b651813978dd7ac51dbd804c2d051a.png
i.gyazo.com/ |
36 KB 36 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tbPageWrapper.bundle.j.download
be-ltsnowportal.duckdns.org/kna/KvK/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
roboto-v18-latin-regular.woff2
be-ltsnowportal.duckdns.org/kna/KvK/ |
15 KB 15 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
roboto-v18-latin-300.woff2
be-ltsnowportal.duckdns.org/kna/KvK/ |
15 KB 15 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CiutadellaRounded-SmBd.woff2
be-ltsnowportal.duckdns.org/kna/KvK/ |
35 KB 36 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
roboto-v18-latin-500.woff2
be-ltsnowportal.duckdns.org/kna/KvK/ |
15 KB 15 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adrum-ext.e4202fb1b0ba7cdba12532dc74bf7403.js
cdn.appdynamics.com/ |
50 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
persoonlijk.knab.nl/ |
1 KB 3 KB |
Other
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
adrum
col.eum-appdynamics.com/eumcollector/beacons/browser/v1/APP_KEY_NOT_SET/ |
0 868 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Kamer van Koophandel (Government)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage object| ADRUM number| adrum-start-time2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
be-ltsnowportal.duckdns.org/ | Name: PHPSESSID Value: he9b6gfnhplc97o9smk8ur2mu0 |
|
i.gyazo.com/ | Name: Gyazo_cfwoker Value: i |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
be-ltsnowportal.duckdns.org
cdn.appdynamics.com
col.eum-appdynamics.com
i.gyazo.com
persoonlijk.knab.nl
13.226.153.94
2606:4700::6812:18a3
3.160.150.62
37.114.49.147
44.226.121.151
23062bc7a332a30c4d8f6a15f24996ffc6b2bba442e9da34313bb200fd89dd6a
2b466db7bf2c5ea9ed3fe29e6022f840d510dc9a226e0a4a3d68a04d30bb3244
2ee14c678486082c694e73bbd1553ed2c6198800bb5ca2ef348305dda8f2861c
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
58673b5bfbd3074f5f018b0d522ade3c23327f8aff5d9b684c3e4c7046f9b0a7
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
720b8b1a3ad5b7b53c9d0a9d7431e9e920e7e76030e6a7ffd2652bc90933a3c6
942ed53abb04f55fe15a2bfb2e9d3ada1b82369e634e9ababa4c6e296c9cb464
9fead1ef71ee8f78c977215440f7d1f2db426c16795493931098fc781800926e
c06e0b1a85abaa52015b901655c427365188b6b48df398474add8ab6a09b3936
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eca8ffa764a66cd084800e2e71c4176ef089ebd805515664a6cb8d4fb3b598bf