kollo2030.com Open in urlscan Pro
5.79.69.109 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php
Submission Tags: 7348330
Submission: On November 12 via api (November 12th 2021, 8:40:54 am UTC) from NL — Scanned from NL

Summary HTTP 9 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 5.79.69.109, located in Netherlands and belongs to LEASEWEB-NL-AMS-01 Netherlands, NL. The main domain is kollo2030.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 28th 2021. Valid for: 3 months.

This is the only time kollo2030.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Global Sources (E-commerce)

Domain & IP information

	IP Address		AS Autonomous System
9	5.79.69.109 5.79.69.109		60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
9	2

9 5.79.69.109 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: box106.exaservers.com

kollo2030.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	kollo2030.com kollo2030.com	214 KB
9	1

	Domain	Requested by
9	kollo2030.com	kollo2030.com
9	1

This site contains links to these domains. Also see Links.

Domain
www.globalsources.com
login.globalsources.com
mrw.so

Subject Issuer	Validity	Valid
kollo2030.com cPanel, Inc. Certification Authority	`2021-10-28` - `2022-01-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php
Frame ID: 6C1C03610C92499060A74C687438C47A
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Global SourcesInsert title here

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

214 kB
Transfer

213 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.globalsources.com/

Search URL Search Domain Scan URL

URL: https://login.globalsources.com/sso/GeneralManager?action=RegisterGSOLUser&userTemplate=GSOLUSERMAG&validate=false&fromWhere=GSOL&language=en&country=US
Title: Sign up

Search URL Search Domain Scan URL

URL: http://mrw.so/6rcK0e

Search URL Search Domain Scan URL

URL: http://mrw.so/5t7fTE

Search URL Search Domain Scan URL

URL: https://www.globalsources.com/SITE/TERMSOFUSE.HTM
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.globalsources.com/HELP/PRIVACY.HTM
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.globalsources.com/CUSTOMER/SECMEASURES.HTM
Title: Security Measures

Search URL Search Domain Scan URL

URL: https://www.globalsources.com/CUSTOMER/IPPOLICY.HTM
Title: IP Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request cjaxdb8yi6wpt437g1ylfsyh.php Show response kollo2030.com/zfftp/	11 KB 11 KB	84ms 49ms	Document text/html	5.79.69.109 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.79.69.109 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS box106.exaservers.com Software Apache / Resource Hash `7d41e767820a51c8aa6bec56ac7196286c75ac341ebc0495b9b711482678131f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language nl-NL,nl;q=0.9 Response headers Date Fri, 12 Nov 2021 08:40:49 GMT Server Apache Keep-Alive timeout=5 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	SSO.CSS kollo2030.com/zfftp/css/	41 KB 41 KB	19ms 18ms	Stylesheet text/css	5.79.69.109 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://kollo2030.com/zfftp/css/SSO.CSS Requested by Host: kollo2030.com URL: https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.79.69.109 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS box106.exaservers.com Software Apache / Resource Hash `b40a66d8255f46b1c25e96910c1e64cf213cf651a891d2307ae28c186006474e` Request headers Accept-Language nl-NL,nl;q=0.9 Referer https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 08:40:49 GMT Last-Modified Wed, 02 Sep 2020 11:15:08 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 42027
GET H/1.1	200 OK	jquery-3.2.1.min.js Show response kollo2030.com/zfftp/vendor/jquery/	85 KB 85 KB	45ms 16ms	Script application/javascript	5.79.69.109 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://kollo2030.com/zfftp/vendor/jquery/jquery-3.2.1.min.js Requested by Host: kollo2030.com URL: https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.79.69.109 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS box106.exaservers.com Software Apache / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers Accept-Language nl-NL,nl;q=0.9 Referer https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 08:40:49 GMT Last-Modified Fri, 28 Jul 2017 11:24:16 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 86659
GET H/1.1	200 OK	GSLOGO.PNG kollo2030.com/zfftp/img/	4 KB 4 KB	14ms 14ms	Image image/png	5.79.69.109 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Show image Full URL https://kollo2030.com/zfftp/img/GSLOGO.PNG Requested by Host: kollo2030.com URL: https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.79.69.109 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS box106.exaservers.com Software Apache / Resource Hash `465c8b941a45a964b3c73162a3357083c03e807f2eb45a6e0cc03658f686ece6` Request headers Accept-Language nl-NL,nl;q=0.9 Referer https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 08:40:49 GMT Last-Modified Wed, 02 Sep 2020 11:15:08 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 3788
GET H/1.1	200 OK	APPEDU_LOGO_APP.JPG kollo2030.com/zfftp/img/	4 KB 4 KB	14ms 13ms	Image image/jpeg	5.79.69.109 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Show image Full URL https://kollo2030.com/zfftp/img/APPEDU_LOGO_APP.JPG Requested by Host: kollo2030.com URL: https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.79.69.109 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS box106.exaservers.com Software Apache / Resource Hash `900774ab9d108ddeee13c38f67680d8b855588ab4b3c37949fa79f4b15c4e3a9` Request headers Accept-Language nl-NL,nl;q=0.9 Referer https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 08:40:49 GMT Last-Modified Wed, 02 Sep 2020 11:15:08 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 4284
GET H/1.1	200 OK	APPEDU_LOGO_GOOGLE.JPG kollo2030.com/zfftp/img/	5 KB 5 KB	14ms 13ms	Image image/jpeg	5.79.69.109 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Show image Full URL https://kollo2030.com/zfftp/img/APPEDU_LOGO_GOOGLE.JPG Requested by Host: kollo2030.com URL: https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.79.69.109 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS box106.exaservers.com Software Apache / Resource Hash `b0501c9294231206d2aeb28e8bbd622910de7fc139e02756dc339cb9a68d017f` Request headers Accept-Language nl-NL,nl;q=0.9 Referer https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 08:40:49 GMT Last-Modified Wed, 02 Sep 2020 11:15:08 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 4667
GET H/1.1	200 OK	GSLOGIN_PROMO_PIC.JPG kollo2030.com/zfftp/img/	63 KB 63 KB	14ms 14ms	Image image/jpeg	5.79.69.109 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Show image Full URL https://kollo2030.com/zfftp/img/GSLOGIN_PROMO_PIC.JPG Requested by Host: kollo2030.com URL: https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.79.69.109 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS box106.exaservers.com Software Apache / Resource Hash `a333d615df16eae983fc674e1e06c445d08bc440cb16eff950ec7570d98c3206` Request headers Accept-Language nl-NL,nl;q=0.9 Referer https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 08:40:49 GMT Last-Modified Wed, 02 Sep 2020 11:15:08 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 64609
GET H/1.1	200 OK	BLANK.GIF kollo2030.com/zfftp/img/	43 B 275 B	13ms 13ms	Image image/gif	5.79.69.109 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Show image Full URL https://kollo2030.com/zfftp/img/BLANK.GIF Requested by Host: kollo2030.com URL: https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.79.69.109 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS box106.exaservers.com Software Apache / Resource Hash `e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e` Request headers Accept-Language nl-NL,nl;q=0.9 Referer https://kollo2030.com/zfftp/cjaxdb8yi6wpt437g1ylfsyh.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 08:40:49 GMT Last-Modified Wed, 02 Sep 2020 11:15:08 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 43
GET DATA	200 OK	truncated /	318 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3ba73f75360efd1e119b4be51ab2d2b78eefe1a3474f8fb0608f7b876194a17d` Request headers Accept-Language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	404 Not Found	LINKEDIN_BUTTON.PNG kollo2030.com/sso/gsol/pex/en/balat/images/	315 B 315 B	19ms 13ms	Image text/html	5.79.69.109 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Show image Full URL https://kollo2030.com/sso/gsol/pex/en/balat/images/LINKEDIN_BUTTON.PNG Requested by Host: kollo2030.com URL: https://kollo2030.com/zfftp/css/SSO.CSS Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.79.69.109 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS box106.exaservers.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Accept-Language nl-NL,nl;q=0.9 Referer https://kollo2030.com/zfftp/css/SSO.CSS User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 08:40:49 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5 Content-Length 315 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Global Sources (E-commerce)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://kollo2030.com/sso/gsol/pex/en/balat/images/LINKEDIN_BUTTON.PNG Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kollo2030.com
5.79.69.109
3ba73f75360efd1e119b4be51ab2d2b78eefe1a3474f8fb0608f7b876194a17d
465c8b941a45a964b3c73162a3357083c03e807f2eb45a6e0cc03658f686ece6
7d41e767820a51c8aa6bec56ac7196286c75ac341ebc0495b9b711482678131f
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
900774ab9d108ddeee13c38f67680d8b855588ab4b3c37949fa79f4b15c4e3a9
a333d615df16eae983fc674e1e06c445d08bc440cb16eff950ec7570d98c3206
b0501c9294231206d2aeb28e8bbd622910de7fc139e02756dc339cb9a68d017f
b40a66d8255f46b1c25e96910c1e64cf213cf651a891d2307ae28c186006474e
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

kollo2030.com Open in urlscan Pro 5.79.69.109 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

214 kBTransfer

213 kBSize

0 Cookies

8 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

kollo2030.com Open in urlscan Pro
5.79.69.109 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

214 kB
Transfer

213 kB
Size

0
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!