domain15.sa.com Open in urlscan Pro
216.10.242.244  Malicious Activity! Public Scan

Submitted URL: https://300afelpeis.sa.com/link
Effective URL: https://domain15.sa.com/Teruggave/
Submission: On August 02 via manual from IN — Scanned from DE

Summary

This website contacted 2 IPs in 3 countries across 2 domains to perform 8 HTTP transactions. The main IP is 216.10.242.244, located in India and belongs to PUBLIC-DOMAIN-REGISTRY, US. The main domain is domain15.sa.com.
TLS certificate: Issued by R3 on July 31st 2023. Valid for: 3 months.
This is the only time domain15.sa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NL Government (Government)

Domain & IP information

IP Address AS Autonomous System
1 1 91.234.99.217 213058 (PIHL-AS)
6 216.10.242.244 394695 (PUBLIC-DO...)
2 2a04:9a00:101... 212157 (LOGIUS-AZ-1)
8 2
Apex Domain
Subdomains
Transfer
7 sa.com
300afelpeis.sa.com
domain15.sa.com
242 KB
2 digid.nl
digid.nl — Cisco Umbrella Rank: 123574
24 KB
8 2
Domain Requested by
6 domain15.sa.com domain15.sa.com
2 digid.nl domain15.sa.com
1 300afelpeis.sa.com 1 redirects
8 3

This site contains links to these domains. Also see Links.

Domain
www.digid.nl
Subject Issuer Validity Valid
domain15.sa.com
R3
2023-07-31 -
2023-10-29
3 months crt.sh
digid.nl
QuoVadis Europe SSL CA G2
2022-09-27 -
2023-09-27
a year crt.sh

This page contains 1 frames:

Primary Page: https://domain15.sa.com/Teruggave/
Frame ID: B0824EA92381AE5F59EB58F5067FF126
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

DigiD: Aanvraag | Teruggave 2022

Page URL History Show full URLs

  1. https://300afelpeis.sa.com/link HTTP 301
    https://domain15.sa.com/Teruggave/ Page URL

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

2
IPs

3
Countries

266 kB
Transfer

263 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://300afelpeis.sa.com/link HTTP 301
    https://domain15.sa.com/Teruggave/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
domain15.sa.com/Teruggave/
Redirect Chain
  • https://300afelpeis.sa.com/link
  • https://domain15.sa.com/Teruggave/
9 KB
9 KB
Document
General
Full URL
https://domain15.sa.com/Teruggave/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
216.10.242.244 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
216-10-242-244.webhostbox.net
Software
Apache /
Resource Hash
bf56d8ea15092b8a8317cabe1afd5af13cfbde2e958c391e9ddbdfbd13ed874c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
9250
Content-Type
text/html
Date
Wed, 02 Aug 2023 05:44:00 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Tue, 01 Aug 2023 23:20:44 GMT
Server
Apache

Redirect headers

Connection
Keep-Alive
Content-Length
242
Content-Type
text/html; charset=iso-8859-1
Date
Wed, 02 Aug 2023 05:44:02 GMT
Keep-Alive
timeout=5, max=100
Location
https://domain15.sa.com/Teruggave/
Server
Apache
style.css
domain15.sa.com/Teruggave/files/
83 KB
83 KB
Stylesheet
General
Full URL
https://domain15.sa.com/Teruggave/files/style.css
Requested by
Host: domain15.sa.com
URL: https://domain15.sa.com/Teruggave/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
216.10.242.244 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
216-10-242-244.webhostbox.net
Software
Apache /
Resource Hash
360c84c7a381cab09400dafdf2eed013ea29741153dd6bbabd4c6f235f72c950

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://domain15.sa.com/Teruggave/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date
Wed, 02 Aug 2023 05:44:01 GMT
Last-Modified
Fri, 03 Jun 2022 18:23:52 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
85088
RO_DigiD_Logo_Homepage.svg
digid.nl/static-assets/
21 KB
22 KB
Image
General
Full URL
https://digid.nl/static-assets/RO_DigiD_Logo_Homepage.svg
Requested by
Host: domain15.sa.com
URL: https://domain15.sa.com/Teruggave/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a04:9a00:1010:1900::a , Netherlands, ASN212157 (LOGIUS-AZ-1, NL),
Reverse DNS
Software
/
Resource Hash
345fece8164e7c89abdcac29f20c438ca6b74414af1373642da630abd862da97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://domain15.sa.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000 ; includeSubDomains
Date
Wed, 02 Aug 2023 05:44:02 GMT
Last-Modified
Tue, 05 Jul 2022 10:12:40 GMT
Age
74201
ETag
"62c40e98-53f5"
Content-Type
image/svg+xml
Permissions-Policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=()
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
21493
digid.svg
digid.nl/static-assets/
2 KB
2 KB
Image
General
Full URL
https://digid.nl/static-assets/digid.svg
Requested by
Host: domain15.sa.com
URL: https://domain15.sa.com/Teruggave/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a04:9a00:1010:1900::a , Netherlands, ASN212157 (LOGIUS-AZ-1, NL),
Reverse DNS
Software
/
Resource Hash
55f1daa50e8a463ddb0718ad1781c22195c16d3bfee3535b1df04fed763f488a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://domain15.sa.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000 ; includeSubDomains
Date
Wed, 02 Aug 2023 05:44:02 GMT
Last-Modified
Tue, 05 Jul 2022 10:12:40 GMT
Age
74183
ETag
"62c40e98-63a"
Content-Type
image/svg+xml
Permissions-Policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=()
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1594
ROsanswebtextregular-54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a.woff
domain15.sa.com/Teruggave/files/
75 KB
75 KB
Font
General
Full URL
https://domain15.sa.com/Teruggave/files/ROsanswebtextregular-54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a.woff
Requested by
Host: domain15.sa.com
URL: https://domain15.sa.com/Teruggave/files/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
216.10.242.244 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
216-10-242-244.webhostbox.net
Software
Apache /
Resource Hash
54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a

Request headers

Referer
https://domain15.sa.com/Teruggave/files/style.css
Origin
https://domain15.sa.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date
Wed, 02 Aug 2023 05:44:01 GMT
Last-Modified
Fri, 03 Jun 2022 18:23:52 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
76489
ROsanswebtextbold-27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591.woff
domain15.sa.com/Teruggave/files/
68 KB
68 KB
Font
General
Full URL
https://domain15.sa.com/Teruggave/files/ROsanswebtextbold-27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591.woff
Requested by
Host: domain15.sa.com
URL: https://domain15.sa.com/Teruggave/files/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
216.10.242.244 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
216-10-242-244.webhostbox.net
Software
Apache /
Resource Hash
27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591

Request headers

Referer
https://domain15.sa.com/Teruggave/files/style.css
Origin
https://domain15.sa.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date
Wed, 02 Aug 2023 05:44:01 GMT
Last-Modified
Fri, 03 Jun 2022 18:23:52 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
69467
icons-650b3ba27798de4eaf8cfc95c3ef953beff6658da3a4cfc5762c77eeb050a630.html
domain15.sa.com/Teruggave/files/
3 KB
3 KB
Font
General
Full URL
https://domain15.sa.com/Teruggave/files/icons-650b3ba27798de4eaf8cfc95c3ef953beff6658da3a4cfc5762c77eeb050a630.html
Requested by
Host: domain15.sa.com
URL: https://domain15.sa.com/Teruggave/files/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
216.10.242.244 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
216-10-242-244.webhostbox.net
Software
Apache /
Resource Hash
17653d3465e19e906eeb797f34102cb7a5304671d78529d9428de31d76f701ef

Request headers

Referer
https://domain15.sa.com/Teruggave/files/style.css
Origin
https://domain15.sa.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date
Wed, 02 Aug 2023 05:44:01 GMT
Last-Modified
Fri, 03 Jun 2022 18:23:52 GMT
Server
Apache
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
2717
icons-a44f7b76a1573f16af0101cc1a3890bb7881de3c3da7652ecad521b35304d7b1.woff
domain15.sa.com/Teruggave/files/
3 KB
4 KB
Font
General
Full URL
https://domain15.sa.com/Teruggave/files/icons-a44f7b76a1573f16af0101cc1a3890bb7881de3c3da7652ecad521b35304d7b1.woff
Requested by
Host: domain15.sa.com
URL: https://domain15.sa.com/Teruggave/files/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
216.10.242.244 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
216-10-242-244.webhostbox.net
Software
Apache /
Resource Hash
a44f7b76a1573f16af0101cc1a3890bb7881de3c3da7652ecad521b35304d7b1

Request headers

Referer
https://domain15.sa.com/Teruggave/files/style.css
Origin
https://domain15.sa.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date
Wed, 02 Aug 2023 05:44:01 GMT
Last-Modified
Fri, 03 Jun 2022 18:23:52 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
3460

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NL Government (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| yesnoCheck

0 Cookies

2 Console Messages

Source Level URL
Text
other warning URL: https://domain15.sa.com/Teruggave/
Message:
Failed to decode downloaded font: https://domain15.sa.com/Teruggave/files/icons-650b3ba27798de4eaf8cfc95c3ef953beff6658da3a4cfc5762c77eeb050a630.html
other warning URL: https://domain15.sa.com/Teruggave/
Message:
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT