wedmee.nl
Open in
urlscan Pro
2a00:f10:13f:0:1c00:c7ff:fe00:19b
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On December 02 via api from US — Scanned from NL
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 23rd 2021. Valid for: 3 months.
This is the only time wedmee.nl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2a00:f10:13f:... 2a00:f10:13f:0:1c00:c7ff:fe00:19b | 48635 (PCEXTREME-) (PCEXTREME-) | |
1 | 54.231.195.89 54.231.195.89 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 2a00:1450:400... 2a00:1450:4001:80f::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 173.233.94.191 173.233.94.191 | 40244 (TURNKEY-I...) (TURNKEY-INTERNET) | |
1 | 2620:1ec:c11:... 2620:1ec:c11::200 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::2001 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
13 | 8 |
ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
myselfandme.s3.amazonaws.com |
ASN40244 (TURNKEY-INTERNET, US)
PTR: 173-233-94-191.static.as40244.net
downinspector.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
wedmee.nl
wedmee.nl |
6 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com |
36 KB |
2 |
googleapis.com
fonts.googleapis.com |
|
1 |
tenor.com
c.tenor.com |
41 KB |
1 |
bing.com
th.bing.com |
26 KB |
1 |
downinspector.com
downinspector.com |
15 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
amazonaws.com
myselfandme.s3.amazonaws.com |
|
13 | 8 |
Domain | Requested by | |
---|---|---|
4 | wedmee.nl |
wedmee.nl
|
2 | cdnjs.cloudflare.com |
wedmee.nl
|
2 | fonts.googleapis.com |
wedmee.nl
|
1 | c.tenor.com |
wedmee.nl
|
1 | th.bing.com |
wedmee.nl
|
1 | downinspector.com |
wedmee.nl
|
1 | code.jquery.com |
wedmee.nl
|
1 | myselfandme.s3.amazonaws.com |
wedmee.nl
|
13 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
wedmee.nl cPanel, Inc. Certification Authority |
2021-11-23 - 2022-02-21 |
3 months | crt.sh |
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2021-01-11 - 2022-02-11 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-11-01 - 2022-01-24 |
3 months | crt.sh |
downinspector.com R3 |
2021-11-14 - 2022-02-12 |
3 months | crt.sh |
www.bing.com Microsoft RSA TLS CA 02 |
2021-09-30 - 2022-03-30 |
6 months | crt.sh |
c.tenor.com GTS CA 1C3 |
2021-11-01 - 2022-01-24 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-09-21 - 2022-09-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wedmee.nl/zaza/?sender=redacted_email
Frame ID: E1529DB77E7ABD46F715EE0415DAFC4E
Requests: 13 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
wedmee.nl/zaza/ |
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
my.css
wedmee.nl/zaza/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
my.js
myselfandme.s3.amazonaws.com/ |
0 0 |
Script
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dropbox.png
downinspector.com/img/logos/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R.dfead413848e4732e81b168ba7b2af2c
th.bing.com/th/id/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading-buffering.gif
c.tenor.com/I6kN-6X7nhAAAAAj/ |
40 KB 41 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ |
85 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/ |
36 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
wedmee.nl/zaza/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
css
fonts.googleapis.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
wedmee.nl/zaza/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery function| _0x5d39 function| _0x5a49 function| ajaxget0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c.tenor.com
cdnjs.cloudflare.com
code.jquery.com
downinspector.com
fonts.googleapis.com
myselfandme.s3.amazonaws.com
th.bing.com
wedmee.nl
173.233.94.191
2001:4de0:ac18::1:a:1a
2606:4700::6810:135e
2620:1ec:c11::200
2a00:1450:4001:80f::200a
2a00:1450:4001:810::2001
2a00:f10:13f:0:1c00:c7ff:fe00:19b
54.231.195.89
1a8735795f13900c49899d6eec17bc2e3d93b018a57206b983e73f09e59a14e6
2eff2ae61047456178738bb7f10017cd66509ef3a547d5e3666267c7f4943b66
42678884b889ffd0c76bfb185d55a16344d0d45575a301288ca89b73d9435801
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
c0c0234bb1cf2ea79d8da2899643719dfa995917bad624829ae54cab1d7bc7d7
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d