axabank.be.webonline-factureringen.site
Open in
urlscan Pro
68.65.120.206
Malicious Activity!
Public Scan
Submission: On April 30 via manual from NL
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 30th 2020. Valid for: a year.
This is the only time axabank.be.webonline-factureringen.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Axa (Insurance)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
21 | 68.65.120.206 68.65.120.206 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 171.18.26.113 171.18.26.113 | 43722 (ATNEDC-AS) (ATNEDC-AS) | |
24 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server178-3.web-hosting.com
axabank.be.webonline-factureringen.site |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
webonline-factureringen.site
axabank.be.webonline-factureringen.site |
100 KB |
2 |
axabank.be
www.axabank.be |
|
1 |
jquery.com
code.jquery.com |
81 KB |
24 | 3 |
Domain | Requested by | |
---|---|---|
21 | axabank.be.webonline-factureringen.site |
axabank.be.webonline-factureringen.site
code.jquery.com |
2 | www.axabank.be |
axabank.be.webonline-factureringen.site
|
1 | code.jquery.com |
axabank.be.webonline-factureringen.site
|
24 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.axabank.be |
itunes.apple.com |
play.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
axabank.be.webonline-factureringen.site Sectigo RSA Domain Validation Secure Server CA |
2020-04-30 - 2021-04-30 |
a year | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
www.axabank.be DigiCert SHA2 High Assurance Server CA |
2019-12-12 - 2020-12-16 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://axabank.be.webonline-factureringen.site/login
Frame ID: C93B0B2F419731083F7352C329C2A5E7
Requests: 22 HTTP requests in this frame
Frame:
https://www.axabank.be/nl/homebanking/logon/notification-top
Frame ID: 0DE31D07B9C1CC610CD7EABEC23B6ED5
Requests: 1 HTTP requests in this frame
Frame:
https://www.axabank.be/nl/homebanking/logon/notification-bottom
Frame ID: 584C3DD19A1D24A1685AF89F742E492E
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Essential JS 2 () Expand
Detected patterns
- html /<[^<]+class="[^"]*[^-](?:e-control|e-lib)/i
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: AXA Homebanking
Search URL Search Domain Scan URL
Title: cookies
Search URL Search Domain Scan URL
Title: Lees meer
Search URL Search Domain Scan URL
Title: A
Search URL Search Domain Scan URL
Title: G
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Juridische informatie
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
axabank.be.webonline-factureringen.site/ |
15 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
axabank.be.webonline-factureringen.site/public/axa/css/ |
356 KB 51 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
axabank.be.webonline-factureringen.site/public/axa/css/ |
2 KB 517 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.4.1.js
code.jquery.com/ |
274 KB 81 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
notification-top
www.axabank.be/nl/homebanking/logon/ Frame 0DE3 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
notification-bottom
www.axabank.be/nl/homebanking/logon/ Frame 584C |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo6481.svg
axabank.be.webonline-factureringen.site/public/axa/img/svg/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
carret-sprite-small-new6481.svg
axabank.be.webonline-factureringen.site/public/axa/img/svg/ |
822 B 574 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-store-new6481.png
axabank.be.webonline-factureringen.site/public/axa/img/png/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-play-new6481.png
axabank.be.webonline-factureringen.site/public/axa/img/png/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
source-sans-pro-v11-latin-700.woff2
axabank.be.webonline-factureringen.site/public/axa/fonts// |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
source-sans-pro-v11-latin-regular.woff2
axabank.be.webonline-factureringen.site/public/axa/fonts// |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 259 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 259 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 196 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 259 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
heartbeat
axabank.be.webonline-factureringen.site/ |
0 259 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Axa (Insurance)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery number| interval function| doAjax5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.www.axabank.be/ | Name: TS0154f53f Value: 01f064368a0349b5fe7909435dcadf0e709d9afee9354836410b35032f43422c80d732464da5ad64a93a56e0eaa52424aa8dcf5463 |
|
www.axabank.be/ | Name: tls_notification_exp Value: exp=4/30/2020 4:40:47 PM |
|
.axabank.be/ | Name: dtCookie Value: v_4_srv_1_sn_11F27C25A5A2E48CB403213D46599EA1_perc_100000_ol_0_mul_1 |
|
www.axabank.be/ | Name: axa#lang Value: nl |
|
axabank.be.webonline-factureringen.site/ | Name: PHPSESSID Value: b9b17066398407e4b1a3f7c2aa5b0c09 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
axabank.be.webonline-factureringen.site
code.jquery.com
www.axabank.be
171.18.26.113
2001:4de0:ac19::1:b:3a
68.65.120.206
0c86c2c271543cb6fc24577be85b29f634d95637b6cf4ca3476a632b354d45d9
4f15551e8df16365a4eba91f078b16e4dc40959a98f6f8e1de8b2ad895ccc705
54a75f49cb12c58d57a321f4a9e46240575f36957e2a5a209505cc83d7b25af6
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
6f4faedf7db9712b3c3299ab430b0cf725dcfb09754aa7617c0de98b3acf33b0
7145dba4167f67fe98f59e22bf567c37e47ca8d3f36570135b17037990bac7ef
716d5073916b9a9d1c6b4b76b60728ba66ea6e4c2211d8a70c483b303706dabc
c09055f0d3ce5ac45f886c935226d1e4cb0f7488525e9f8b298f26fc0171e5a8
cb992eae898417162c48b37712991d9ad8053c4a64fce51aff195edc69dc35f2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f4ba1c3cbb97291ff424113bfa8525be04947309a8cb8b584ca3985f20224a6e