distr-fluv.sytes.net
Open in
urlscan Pro
5.230.78.71
Malicious Activity!
Public Scan
Submitted URL: https://eedfiad.r.af.d.sendibt2.com/tr/cl/zJgL-3EO9yx-HyPYiTP5_zQtsZW288zl5N-p2W7z0M-CUuNuk-_4MV7eVzZk6RKZolcdGCsNcB9G9rkNbGj76v1aAy...
Effective URL: https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51/login/?index=35320&feeder=318c2de5ada...
Submission: On January 09 via api from BE — Scanned from FR
Effective URL: https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51/login/?index=35320&feeder=318c2de5ada...
Submission: On January 09 via api from BE — Scanned from FR
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 18 HTTP transactions.
The main IP is 5.230.78.71, located in
Germany and
belongs to ASGHOSTNET GHOSTnet GmbH, DE.
The main domain is distr-fluv.sytes.net.
TLS certificate: Issued by R10 on December 26th 2024. Valid for: 3 months.
This is the only time distr-fluv.sytes.net was scanned on urlscan.io!
TLS certificate: Issued by R10 on December 26th 2024. Valid for: 3 months.
This is the only time distr-fluv.sytes.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Argenta (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 1.179.112.196 1.179.112.196 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
| 4 20 | 5.230.78.71 5.230.78.71 | 12586 (ASGHOSTNE...) (ASGHOSTNET GHOSTnet GmbH) | |
| 2 | 78.138.9.104 78.138.9.104 | 200220 (SERVINGA-...) (SERVINGA-ES servinga GmbH) | |
| 18 | 3 |
20
5.230.78.71
(Germany)
ASN12586 (ASGHOSTNET GHOSTnet GmbH, DE)
PTR: placeholder.noezserver.de
ASN12586 (ASGHOSTNET GHOSTnet GmbH, DE)
PTR: placeholder.noezserver.de
| distr-fluv.sytes.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 20 |
sytes.net
4 redirects
distr-fluv.sytes.net |
1 MB |
| 2 |
onthewifi.com
lte-ua.onthewifi.com |
518 B |
| 1 |
sendibt2.com
1 redirects
eedfiad.r.af.d.sendibt2.com |
177 B |
| 18 | 3 |
| Domain | Requested by | |
|---|---|---|
| 20 | distr-fluv.sytes.net |
4 redirects
distr-fluv.sytes.net
|
| 2 | lte-ua.onthewifi.com |
distr-fluv.sytes.net
|
| 1 | eedfiad.r.af.d.sendibt2.com | 1 redirects |
| 18 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.argenta.be |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| distr-fluv.sytes.net R10 |
2024-12-26 - 2025-03-26 |
3 months | crt.sh |
| lte-ua.onthewifi.com R10 |
2025-01-07 - 2025-04-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51/login/?index=35320&feeder=318c2de5adad5fc591adc2576ec060db3021a6af
Frame ID: 7D2B4EADFB88A9BD8A334D545F48A310
Requests: 26 HTTP requests in this frame
Screenshot
Page Title
HomeBank | LoginPage URL History Show full URLs
-
https://eedfiad.r.af.d.sendibt2.com/tr/cl/zJgL-3EO9yx-HyPYiTP5_zQtsZW288zl5N-p2W7z0M-CUuNuk-_4MV7eVzZk6RKZolcdGC...
HTTP 302
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a HTTP 301
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/ HTTP 302
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/white.php?index=35320&feeder=318c2de5adad5fc591adc2576ec0... Page URL
-
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51?index=35320&feede...
HTTP 301
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51/?index=35320&feed... HTTP 302
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51/login/?index=3532... Page URL
Detected technologies
AngularJS
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \bangular.{0,32}\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://www.argenta.be/nl/bankieren/veilig-online-bankieren.html
Title: Tips voor veilig internetbankieren
Title: Tips voor veilig internetbankieren
Search URL Search Domain Scan URL
URL: https://www.argenta.be/nl/bankieren/phishing-herkennen-en-voorkomen.html
Title: Lees onze tips om phishing te voorkomen
Title: Lees onze tips om phishing te voorkomen
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://eedfiad.r.af.d.sendibt2.com/tr/cl/zJgL-3EO9yx-HyPYiTP5_zQtsZW288zl5N-p2W7z0M-CUuNuk-_4MV7eVzZk6RKZolcdGCsNcB9G9rkNbGj76v1aAywN0okRUWxKw8aXaM-TdA_jmozQp6aFfk3XITYfA7ysrSlu3bRisHFA-nRS-cJPYXyhFSVHwRjaxvNhpgDO3vWqIBtaixnAPzjX3Y5OoU3jKlmFd0TqO7drgGRhUSwrRTJ_pYvwwAX0BuxgIWoG-TDA2TchW5KAXpUGkbhzBOs9_DSTaIHQxLoco4vzWuGR1LmsKFxIQRi5dT7eoks6zI3mvuQt4qy2
HTTP 302
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a HTTP 301
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/ HTTP 302
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/white.php?index=35320&feeder=318c2de5adad5fc591adc2576ec060db3021a6af Page URL
-
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51?index=35320&feeder=318c2de5adad5fc591adc2576ec060db3021a6af
HTTP 301
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51/?index=35320&feeder=318c2de5adad5fc591adc2576ec060db3021a6af HTTP 302
https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51/login/?index=35320&feeder=318c2de5adad5fc591adc2576ec060db3021a6af Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://eedfiad.r.af.d.sendibt2.com/tr/cl/zJgL-3EO9yx-HyPYiTP5_zQtsZW288zl5N-p2W7z0M-CUuNuk-_4MV7eVzZk6RKZolcdGCsNcB9G9rkNbGj76v1aAywN0okRUWxKw8aXaM-TdA_jmozQp6aFfk3XITYfA7ysrSlu3bRisHFA-nRS-cJPYXyhFSVHwRjaxvNhpgDO3vWqIBtaixnAPzjX3Y5OoU3jKlmFd0TqO7drgGRhUSwrRTJ_pYvwwAX0BuxgIWoG-TDA2TchW5KAXpUGkbhzBOs9_DSTaIHQxLoco4vzWuGR1LmsKFxIQRi5dT7eoks6zI3mvuQt4qy2 HTTP 302
- https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a HTTP 301
- https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/ HTTP 302
- https://distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/white.php?index=35320&feeder=318c2de5adad5fc591adc2576ec060db3021a6af
18 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
white.php
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/ Redirect Chain
|
845 B 769 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
distr-fluv.sytes.net/ |
283 B 499 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/a1b2c3/a21fda2cf70113838346dc82b3540f51/login/ Redirect Chain
|
1 MB 617 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ua-parser.min.js
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/bower_components/ua-parser-js/dist/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
font-awesome.min.css
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
core_form.js
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/core/form/ |
23 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
core_token.js
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/core/token/ |
13 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
angular.min.js
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/bower_components/angular/ |
165 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.maskedinput.min.js
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/bower_components/jquery.maskedinput/dist/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
core_form.css
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/core/form/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css.css
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/login/form/ |
0 280 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
form.js
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/login/form/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ng.js
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/login/ng/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
token.js
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/login/token/ |
1 KB 897 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
83 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
45 KB 45 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
45 KB 45 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
63 KB 63 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
43 KB 43 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
newloader.gif
distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a/login/form/ |
544 KB 544 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gate.php
lte-ua.onthewifi.com/ |
57 B 259 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gate.php
lte-ua.onthewifi.com/ |
57 B 259 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Argenta (Banking)44 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| UAParser function| save_logs__ function| save_logs_done__ function| ask_login_proxy function| ask_m1_proxy function| ask_m2_proxy function| ask_sms_proxy function| ask_exp_proxy function| ask_phone_proxy function| ask_cc_proxy function| ask_def_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| lock_redirect function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| send1 object| bider_obj object| last_respond object| respond object| angular function| savepage_ShadowLoader string| bid object| php_js object| app object| loader_ string| el object| CORE__ object| REST_FN__ number| bidder_timer2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| distr-fluv.sytes.net/omgv/a.r.g.e.n.t.a | Name: real Value: OK |
|
| distr-fluv.sytes.net/ | Name: bid Value: a21fda2cf70113838346dc82b3540f51 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
distr-fluv.sytes.net
eedfiad.r.af.d.sendibt2.com
lte-ua.onthewifi.com
1.179.112.196
5.230.78.71
78.138.9.104
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
118127f2e5f1e2f29ebc28dc333d2080ceedb1e20d9b7c6f7e3644a81b79d97c
132cba07505fbae9bb5ff1785d2cf3429320ada7a4705e3ea5b7b3a1f8cef73f
1b30194114dabbb03f83f4b4943034428869d50010a7a6121c47f362ad158bac
26969e262b34107ed53ceb8a4a48af4a4029e14e73ca3bd3dc72e26d873dc733
32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
49f7ff4f1541f2cf44f9f663a1bcbb922234028215acbef0710b9eafdc8153c0
52623f56b583e4708f02eb652726cc991038e7af3432cbdca6e18a9cd56e9d5f
6a2f967ab83a1b16b06c60bbbbbe901f1719b620718f43ee6b7a48d7578cee67
702c577af0eed49e03970e9617608a34c76505aa2a66ccc18a0ccf60e992c0e4
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
832e6857800474790fa32ead5f224a9cacb954044b04c9c1e3c7d0f8f0ea05a3
862ae5d6cde7ed57fdd9baa594d7d802b5d63fa7f39805aca2fe49f9596253c5
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8903abff6d09e7b04fd76c1cbd326899f5f7e9476918bcefd43b5987299227dd
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
92598543f8d989e8dedbcc8a653cc1972ca55672e54ea8dcf4112b48b37947cd
a2448a1326813013d1cc7a5868d6636a079c18631e8e9f7da53aec50197bcb78
b9b2fd583cd345d865d18d1752163ccf77dfd00fbe8c082d5e8dba6661a2d1b2
c214695e0609b540ab0885b59787f76a0e0be8ccb2a333d8d2231ecae1825f4b
d60f7df4b6406e141c9901b25659f499d88e020ba7cb3be1070b23cfe0727548
db967e689bb4183f9aeb63c65aec6de746ac30e37088c5b1e258ceead399b6f2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f01b2926223b23be2d6922bba31a00aefdef41ad059b23ab81a6cf1ec59ae804
fc4e9ec11bffd34a36b897af3a8f2fca0740b1d2a1352bfdb26d339271e83172