rabobank-mpoll.nl - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2001:4c08:2001:1350::117, located in Les Pavillons-sous-Bois, France and belongs to LEVEL3, US. The main domain is rabobank-mpoll.nl.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on July 8th 2021. Valid for: a year.

This is the only time rabobank-mpoll.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rabobank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	2001:4c08:200... 2001:4c08:2001:1350::117	3356 (LEVEL3) (LEVEL3)
1	185.211.249.113 185.211.249.113	20857 (TRANSIP-A...) (TRANSIP-AS Amsterdam)
2	2a02:26f0:d6:... 2a02:26f0:d6::5f65:53ab	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	3

2 2001:4c08:2001:1350::117 (Les Pavillons-sous-Bois, France)

ASN3356 (LEVEL3, US)

rabobank-mpoll.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.211.249.113 (Netherlands)

ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL)

mail.rabobank.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:d6::5f65:53ab (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.rabobank.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	rabobank.nl mail.rabobank.nl — Cisco Umbrella Rank: 961842 www.rabobank.nl — Cisco Umbrella Rank: 66944	50 KB
2	rabobank-mpoll.nl rabobank-mpoll.nl	12 KB
5	2

	Domain	Requested by
2	www.rabobank.nl	rabobank-mpoll.nl
2	rabobank-mpoll.nl	rabobank-mpoll.nl
1	mail.rabobank.nl	rabobank-mpoll.nl
5	3

This site contains no links.

Subject Issuer	Validity	Valid
poll.emm-mmm.nl DigiCert TLS RSA SHA256 2020 CA1	`2021-07-08` - `2022-07-13`	a year	crt.sh
mail.rabobank.nl DigiCert TLS RSA SHA256 2020 CA1	`2022-05-20` - `2023-05-23`	a year	crt.sh
rabobank.nl DigiCert SHA2 Extended Validation Server CA	`2021-06-04` - `2022-06-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://rabobank-mpoll.nl/
Frame ID: 802884778B99ECDDF845159C0F3E60E8
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Rabobank Poll Resultaat

Detected technologies

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<input[^>]+name="__VIEWSTATE

Page Statistics

5
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

3
Countries

62 kB
Transfer

60 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
rabobank-mpoll.nl/ 2 KB
2 KB 101ms
27ms Document
text/html 2001:4c08:2001:1350::117
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://rabobank-mpoll.nl/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:4c08:2001:1350::117 Les Pavillons-sous-Bois, France, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c196735b820c465f0899ff44436953f70792be3cc253ca6b697ea7266b445e2b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

cache-control: private
content-length: 1749
content-type: text/html; charset=utf-8
date: Wed, 25 May 2022 06:48:51 GMT
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET

GET
H2 200 style.css
rabobank-mpoll.nl/include/css/ 10 KB
10 KB 27ms
27ms Stylesheet
text/css 2001:4c08:2001:1350::117
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://rabobank-mpoll.nl/include/css/style.css?v=637646972600000000
Requested by: Host: rabobank-mpoll.nl
URL: https://rabobank-mpoll.nl/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:4c08:2001:1350::117 Les Pavillons-sous-Bois, France, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 826553e874b6d61eb085dc391ac48d3087e2c9b6346dcc69e72f1efd842077db

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://rabobank-mpoll.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Wed, 25 May 2022 06:48:51 GMT
last-modified: Mon, 16 Aug 2021 05:54:20 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "04eed276392d71:0"
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 9871

GET
H/1.1 200 image_K8WKN7n754JWuyJdeQRecA.png
mail.rabobank.nl/public/ 16 KB
16 KB 255ms
54ms Image
image/png 185.211.249.113
TRANSIP-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.rabobank.nl/public/image_K8WKN7n754JWuyJdeQRecA.png
Requested by: Host: rabobank-mpoll.nl
URL: https://rabobank-mpoll.nl/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.211.249.113 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: 03caeff0f4235241611956eeb18dcbfabb8b67083208f00a0b0f92fbff9b28bd

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://rabobank-mpoll.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Wed, 25 May 2022 06:48:50 GMT
Cache-Control: max-age=600
Last-Modified: Thu, 30 Nov 2017 10:20:04 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Content-Language: nl-NL
Expires: Wed, 25 May 2022 06:58:51 GMT

GET
H2 200 2cc3ff2f-19fe-458d-99da-2fb1acb43d81.woff2
www.rabobank.nl/static/generic/font/myriad/fonts/ 16 KB
17 KB 242ms
37ms Font
application/octet-stream 2a02:26f0:d6::5f65:53ab
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rabobank.nl/static/generic/font/myriad/fonts/2cc3ff2f-19fe-458d-99da-2fb1acb43d81.woff2

Requested by

Host: rabobank-mpoll.nl
URL: https://rabobank-mpoll.nl/include/css/style.css?v=637646972600000000

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:d6::5f65:53ab Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

6bf49648ded3c320b956ddf452fe698858cb9822051449aa7147c79c5094cf0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://rabobank-mpoll.nl/
Origin: https://rabobank-mpoll.nl
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Wed, 25 May 2022 06:48:51 GMT
content-encoding: gzip
last-modified: Fri, 20 Apr 2018 10:42:30 GMT
server: Apache
etag: "41fc-56a455848b180"
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1492948
strict-transport-security: max-age=15768000
accept-ranges: bytes
content-length: 16915

GET
H2 200 3b0f1c67-c2e4-4df6-976f-49d52e45aba1.woff2
www.rabobank.nl/static/generic/font/myriad/fonts/ 16 KB
17 KB 268ms
64ms Font
application/octet-stream 2a02:26f0:d6::5f65:53ab
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rabobank.nl/static/generic/font/myriad/fonts/3b0f1c67-c2e4-4df6-976f-49d52e45aba1.woff2

Requested by

Host: rabobank-mpoll.nl
URL: https://rabobank-mpoll.nl/include/css/style.css?v=637646972600000000

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:d6::5f65:53ab Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

5bd13b67370a235b3132593811cbe6ff6c35ef1ec9f228994db0d30b29ef02b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://rabobank-mpoll.nl/
Origin: https://rabobank-mpoll.nl
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Wed, 25 May 2022 06:48:51 GMT
content-encoding: gzip
last-modified: Fri, 20 Apr 2018 10:42:30 GMT
server: Apache
etag: "3ff8-56a455848b180"
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=2419932
strict-transport-security: max-age=15768000
accept-ranges: bytes
content-length: 16399

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rabobank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			rabobank-mpoll.nl/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: encswsau5qpcjud4dmtvu3jf

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail.rabobank.nl
rabobank-mpoll.nl
www.rabobank.nl
185.211.249.113
2001:4c08:2001:1350::117
2a02:26f0:d6::5f65:53ab
03caeff0f4235241611956eeb18dcbfabb8b67083208f00a0b0f92fbff9b28bd
5bd13b67370a235b3132593811cbe6ff6c35ef1ec9f228994db0d30b29ef02b1
6bf49648ded3c320b956ddf452fe698858cb9822051449aa7147c79c5094cf0f
826553e874b6d61eb085dc391ac48d3087e2c9b6346dcc69e72f1efd842077db
c196735b820c465f0899ff44436953f70792be3cc253ca6b697ea7266b445e2b

rabobank-mpoll.nl Open in urlscan Pro 2001:4c08:2001:1350::117 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

67 %IPv6

2 Domains

3 Subdomains

3 IPs

3 Countries

62 kBTransfer

60 kBSize

1 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

rabobank-mpoll.nl Open in urlscan Pro
2001:4c08:2001:1350::117 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

3
Countries

62 kB
Transfer

60 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!