ab-nprevent.serveo.net Open in urlscan Pro
159.89.214.31 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://x.co/6nx1s
Effective URL:
https://ab-nprevent.serveo.net/VAJDFR/
Submission: On August 03 via api (August 3rd 2019, 9:33:43 am UTC) from BE

Summary HTTP 8 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 159.89.214.31, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is ab-nprevent.serveo.net.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 12th 2019. Valid for: 3 months.

This is the only time ab-nprevent.serveo.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ABN Amro (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	45.40.140.1 45.40.140.1	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
4	159.89.214.31 159.89.214.31	14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
4	2a02:26f0:6c0... 2a02:26f0:6c00:182::6d2b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	3

2 45.40.140.1 (Scottsdale, United States) 2 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-140-1.ip.secureserver.net

x.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 159.89.214.31 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)

ab-nprevent.serveo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:6c00:182::6d2b (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

www.abnamro.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	abnamro.nl www.abnamro.nl	143 KB
4	serveo.net ab-nprevent.serveo.net	207 KB
2	x.co 2 redirects x.co	292 B
8	3

	Domain	Requested by
4	www.abnamro.nl	ab-nprevent.serveo.net
4	ab-nprevent.serveo.net	ab-nprevent.serveo.net
2	x.co	2 redirects
8	3

This site contains links to these domains. Also see Links.

Domain
www.abnamro.nl

Subject Issuer	Validity	Valid
*.serveo.net Let's Encrypt Authority X3	`2019-06-12` - `2019-09-10`	3 months	crt.sh
www.abnamro.nl QuoVadis EV SSL ICA G1	`2018-09-07` - `2020-09-07`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://ab-nprevent.serveo.net/VAJDFR/
Frame ID: 274CB813F11BBA1666C7D4516DB329F8
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://x.co/6nx1s HTTP 301
https://x.co/6nx1s HTTP 302
https://ab-nprevent.serveo.net/VAJDFR/ Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

350 kB
Transfer

1235 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.abnamro.nl/portalserver/nl/prive/index.html?r
Title: Een nieuwe Identificatiecode aanvragen (html, )

Search URL Search Domain Scan URL

URL: https://www.abnamro.nl/nl/prive/apps/tikkie/index.html
Title: Uw geld terugvragen via Whatsapp (html, )

Search URL Search Domain Scan URL

URL: https://www.abnamro.nl/nl/prive/betalen/geld-overmaken/incasso.html
Title: Incasso's terugboeken, stopzetten of wijzigen (html, )

Search URL Search Domain Scan URL

URL: https://www.abnamro.nl/nl/prive/betalen/geld-overmaken/geld-overmaken-naar-het-buitenland.html
Title: Geld overmaken naar het buitenland (html, )

Search URL Search Domain Scan URL

URL: https://www.abnamro.nl/nl/prive/betalen/geld-overmaken/periodieke-overboekingen.html
Title: Periodieke overboekingen (html, )

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://x.co/6nx1s HTTP 301
https://x.co/6nx1s HTTP 302
https://ab-nprevent.serveo.net/VAJDFR/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
ab-nprevent.serveo.net/VAJDFR/
Redirect Chain

http://x.co/6nx1s
https://x.co/6nx1s
https://ab-nprevent.serveo.net/VAJDFR/

89 KB
14 KB

1209ms
42ms

Document
text/html

159.89.214.31
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://ab-nprevent.serveo.net/VAJDFR/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.214.31 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 4959cb5c35e6b719de0802ea4d27ebc6da99bc5bcbc49f837939f9dea6e8374f

Request headers

:method: GET
:authority: ab-nprevent.serveo.net
:scheme: https
:path: /VAJDFR/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 03 Aug 2019 09:33:26 GMT
server: Apache/2.4.29 (Ubuntu)
vary: Accept-Encoding
content-length: 14103

Redirect headers

status: 302
server: nginx/1.12.2
date: Sat, 03 Aug 2019 09:33:24 GMT
content-type: text/html; charset=utf-8
location: https://ab-nprevent.serveo.net/VAJDFR/

GET
H2 200 all.css
www.abnamro.nl/portalserver/static/lib/static/portalclient/xml-lang/backbase.com.2012.view/css/ 9 KB
4 KB 1726ms
108ms Stylesheet
text/css 2a02:26f0:6c00:182::6d2b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.abnamro.nl/portalserver/static/lib/static/portalclient/xml-lang/backbase.com.2012.view/css/all.css

Requested by

Host: ab-nprevent.serveo.net
URL: https://ab-nprevent.serveo.net/VAJDFR/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:182::6d2b , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

2c2155928f0b6b14772e290974ce42d8be6fc7d81efbe79db07c68b6a4138f3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://ab-nprevent.serveo.net/VAJDFR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 03 Aug 2019 09:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-heist: HZFBMCbiA0zLSZnfEHcaG2SvQtTd4fRFBIdzxV020vDCBjdTCaHrKgkSYWaJdAYqSPWU5ywcuFNYMLvut9zwdQlS7xC6pDGsBdopbDgYxi7tYWuiEehOvEHwmlVUn8yUVV4qqzjEz4y6PWWKrE9GjICiBhvTLcWzd9YicbOjpNyOOpWV3HWxEoCo7sJ8a8rsTG8Gpfos5Uv2FYN6Q2i5WZSpou6pTPAFZAycxCiykJabmyAwqn7Yhxk5iApY2AhNOzi6SJTMja84In24zdtf73fwadAjYEs3RvDgNkpKH2eZLPKCBkiGfL5GJJiDxuM91I6qXexttmOF5TRUjhY2q7G543GUfEq1XPlE5C8RWVlQ0hHsasNQHvSuW6ohQZUs2Ox52uTQrwKefeEGQXNtMQn4ioFUucvNjWySu9qAYwb1mD1zaTusAKa9fIa1EZcXVYRENX9a8sbLqQJtevdsxhPL8NtFr8lcvkpC5MJl8yXRntkw2x0mPRMFUevuh1biOv6UksYqhC6WyI02XkbyNoVJhPJo8lxP2vT5cwdPl772Fh3hSH9JBueAWSJ6RHKGH4Q1Y0eHqoP3D3rMXPMOIY0Ckf3Wh0Sxvei7GrQILYVN2hxHjqK
status: 200
vary: Accept-Encoding
content-length: 2630
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 26 Jun 2019 06:40:52 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15768000
content-language: en-US
x-bbxsrf: 85dc880d-77f2-404f-afd6-f59995f70d51
cache-control: no-cache="set-cookie, set-cookie2"
accept-ranges: bytes
content-type: text/css;charset=UTF-8
expires

GET
H2 200 normalize.min.css
www.abnamro.nl/portalserver/static/portalclient/css/ 2 KB
2 KB 1757ms
139ms Stylesheet
text/css 2a02:26f0:6c00:182::6d2b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.abnamro.nl/portalserver/static/portalclient/css/normalize.min.css

Requested by

Host: ab-nprevent.serveo.net
URL: https://ab-nprevent.serveo.net/VAJDFR/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:182::6d2b , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

80bc044677cf80929d5d037919a68e2040d0b3632f80340b418a29fc8f5baaff

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://ab-nprevent.serveo.net/VAJDFR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 03 Aug 2019 09:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-heist: FBMCbiA0zLSZnfEHcaG2SvQtTd4fRFBIdzxV020vDCBjdTCaHrKgkSYWaJdAYqSPWU5ywcuFNYMLvut9zwdQlS7xC6pDGsBdopbDgYxi7tYWuiEe
status: 200
vary: Accept-Encoding
content-length: 929
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 18 May 2018 09:59:24 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15768000
content-language: en-US
x-bbxsrf: cfa0bc68-c991-42d8-9148-f95a9ec92c1d
cache-control: no-cache="set-cookie, set-cookie2"
accept-ranges: bytes
content-type: text/css;charset=UTF-8
expires

GET
H2 200 core.css
ab-nprevent.serveo.net/VAJDFR/ 420 KB
60 KB 55ms
54ms Stylesheet
text/css 159.89.214.31
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://ab-nprevent.serveo.net/VAJDFR/core.css
Requested by: Host: ab-nprevent.serveo.net
URL: https://ab-nprevent.serveo.net/VAJDFR/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.214.31 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: ac7050f5f400d1260ae73c4ecb33405e5b75eb4805991f56f3b7ec55737a0916

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://ab-nprevent.serveo.net/VAJDFR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 03 Aug 2019 09:33:26 GMT
content-encoding: gzip
last-modified: Sat, 04 May 2019 19:09:36 GMT
server: Apache/2.4.29 (Ubuntu)
etag: "68f5d-588149babbc00-gzip"
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes

GET
H2 200 shared.css
www.abnamro.nl/portalserver/static/backbase.com.2012.aurora/css/ 4 KB
3 KB 1727ms
109ms Stylesheet
text/css 2a02:26f0:6c00:182::6d2b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.abnamro.nl/portalserver/static/backbase.com.2012.aurora/css/shared.css

Requested by

Host: ab-nprevent.serveo.net
URL: https://ab-nprevent.serveo.net/VAJDFR/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:182::6d2b , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

3196a7a2d769ead66c3e0b6ab702d03c596d5cfd31d78b7621ef074151318b15

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://ab-nprevent.serveo.net/VAJDFR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 03 Aug 2019 09:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-heist: xRIs6tLdvc3QZQnGTOFIsB23G2MHYtTH8aDaGzU92ME4ZXdDHDprawAPB8PeNIl3S0s2HQIwy0DkHb4tgPOKJZFEdlg1N88IFB5LFKAcSYzbqm6Q7x1bucG6KqY5k5zrMBbACnsOaYdPO0HqzZsKuKrZMpeyFO4dy5KV3IGmUeyBcpgGawtE84rn0NuFoC7WxGDanDDI7QUPEWksJwq5f9jG1dJfTGCKG0Z0f9fu0ouSg5PIgXELl9UnsVXafRHNujOfvz0Hv1mmnaw9fnbJylDysLkUnG5URtsferIGEtJE6YnITBGnOKFYJJyC32LngyAEs2AFzLurBaCYvuxFvGYYu5ZIbZaoKvzf3JpOI4rnlRNtB7yK294UAWdMx7d8xUNUB7XPA3zJb6155T0sxSp5j0tt3teOu4W4UkYRwa3isEpKd3MUkxMZFRJV5uuA2xHg6MOGmHZOOSbVO9COeVLHkWtFyMD2Xpo5ycnkzIkeLGZvuPsqyor6pz7N9xkuzCDrw0mZtFqk6Y86ZAtLn2DXNzOVa7U530N8h2xTYLfjPQ5ycpBTcIZge0l5QhO8l55Tz4yFOINtSqSLrbAvPmt7g6BEm2n1Gy
status: 200
vary: Accept-Encoding
content-length: 1207
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 18 May 2018 10:00:26 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15768000
content-language: en-US
x-bbxsrf: 7500a83d-42b5-4f72-b692-a0ef8fb1b15a
cache-control: no-cache="set-cookie, set-cookie2"
accept-ranges: bytes
content-type: text/css;charset=UTF-8
expires

GET
H2 200 icons.css
www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/css/themes/abnamro/ 571 KB
135 KB 1676ms
142ms Stylesheet
text/css 2a02:26f0:6c00:182::6d2b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.abnamro.nl/nl/widgetdelivery/unauthenticated/oca/style/css/themes/abnamro/icons.css

Requested by

Host: ab-nprevent.serveo.net
URL: https://ab-nprevent.serveo.net/VAJDFR/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:182::6d2b , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

0a1de2dd57da485992183b71e94298c58a25daffd101cbc142267a20ad4f5e9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://ab-nprevent.serveo.net/VAJDFR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 03 Aug 2019 09:33:27 GMT
content-encoding: gzip
last-modified: Fri, 12 Jul 2019 11:35:54 GMT
x-heist: 5ZIbZaoKvzf3JpOI4rnlRNtB7yK294UAWdMx7d8xUNUB7XPA3zJb6155T0sxSp5j0tt3teOu4W4UkYRwa3isEpKd3MUkxMZFRJV5uuA2xHg6MOGmHZOOSbVO9COeVLHkWtFyMD2Xpo5ycnkzIkeLGZvuPsqyor6pz7N9xkuzCDrw0mZtFqk6Y86ZAtLn2DXNzOVa7U530N8h2xTYLfjPQ5ycpBTcIZge0l5QhO8l55Tz4yFOINtSqSLrbAvPmt7g6BEm2n1GyC9ACGeZk7PQYFJOmjzZVfYcRXin9Iep6EzprmboYkMvjC6x4kO0ug6QK8FIw29wuysevyE98OhIJ08CVwvZhrtDkFYBzYmKCrAX8wm3aQuckRCK64K2YrQyrfkJ1aHZFBMCbiA0zLSZnfEHcaG2SvQtTd4fRFBIdzxV020vDCBjdTCaHrKgkSYWaJdAYqSPWU5ywcuFNYMLvut9zwdQlS7xC6pDGsBdopbDgYxi7tYWuiEehOvEHwmlVUn8yUVV4qqzjEz4y6PWWKrE9GjICiBhvTLcWzd9YicbOjpNyOOpWV3HWxEoCo7sJ8a8rsTG8Gpfos5Uv2FYN6Q2i5WZSpou6pTPAFZAycxCiykJabmyAwqn7Yhxk5iApY2AhNOzi6SJTMja84In24zdtf73fwadAjYEs3RvDgNkpKH2eZLPKCBkiGfL5GJJiDxuM91I6qXexttmOF5TRUjhY2q7G543GUfEq1XPlE5C8RWVlQ0hHsasNQHvSuW6ohQZUs2Ox52uTQrwKefeEGQXNtMQn4ioFUucvNjWySu9qAYwb1mD1zaTusAKa9fIa1EZcXVYRENX9a8sbLqQJtevdsxhPL8NtFr8lcvkpC5MJl8yXRntkw2x0mPRMFUevuh1biOv6UksYqhC6WyI02XkbyNoVJhPJo8lxP2vT5cwdPl772Fh3hSH9JBueAWSJ6RHKGH4Q
x-frame-options: SAMEORIGIN
surrogate-control: max-age=900, cacheid="URL"
vary: Accept-Encoding
content-language: en-US
status: 200
cache-control: no-cache="set-cookie, set-cookie2"
strict-transport-security: max-age=15768000
content-type: text/css
expires: Sat, 03 Aug 2019 10:03:27 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1e1d99d43ab313eb41d38bdba892888025c041e67bd9111762473f090920eaa

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 160 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 293680a5c9b05ee7c9c775597a78a96e2326217111b9d8d46689349877dc497c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 247 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dae57d591e1c32826e496e78403c02222d00fc73d343591aa1d4b4fa3753b4b1

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0c20036cad791f2fe3957eb5e629e606313eaaff0f6b665194ee54213d1c17c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f646c87e16a2fb953c805ff4dfb142764b559765aad550fdcfc319d48ccd53f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 243 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9141c8fb2be2ea05e12ab9e8e2795e38d523c8866397cc9bb0be72d5b90b35f5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 roboto-regular.woff2
ab-nprevent.serveo.net/VAJDFR/fonts/ 66 KB
66 KB 45ms
44ms Font
font/woff2 159.89.214.31
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://ab-nprevent.serveo.net/VAJDFR/fonts/roboto-regular.woff2
Requested by: Host: ab-nprevent.serveo.net
URL: https://ab-nprevent.serveo.net/VAJDFR/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.214.31 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 44ad606492c593adb173cd8d728fdd5c1ef2971196c18afe58bb8f57851bb580

Request headers

Sec-Fetch-Mode: cors
Referer: https://ab-nprevent.serveo.net/VAJDFR/core.css
Origin: https://ab-nprevent.serveo.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 03 Aug 2019 09:33:28 GMT
last-modified: Sat, 04 May 2019 19:09:38 GMT
server: Apache/2.4.29 (Ubuntu)
etag: "1087c-588149bca4080"
content-type: font/woff2
status: 200
accept-ranges: bytes
content-length: 67708

GET
DATA 200
OK truncated
/ 396 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dba4c42b0b9001bbcff21f0ff5294d158ecdcff4d8216d4891faea016d56ebe4

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 roboto-condensed-regular.woff2
ab-nprevent.serveo.net/VAJDFR/fonts/ 66 KB
66 KB 82ms
81ms Font
font/woff2 159.89.214.31
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://ab-nprevent.serveo.net/VAJDFR/fonts/roboto-condensed-regular.woff2
Requested by: Host: ab-nprevent.serveo.net
URL: https://ab-nprevent.serveo.net/VAJDFR/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.214.31 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 7c2c3aa607fb24e5f8d522cb359816f105564dadeb40dee703de43d12936da78

Request headers

Sec-Fetch-Mode: cors
Referer: https://ab-nprevent.serveo.net/VAJDFR/core.css
Origin: https://ab-nprevent.serveo.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 03 Aug 2019 09:33:28 GMT
last-modified: Sat, 04 May 2019 19:09:38 GMT
server: Apache/2.4.29 (Ubuntu)
etag: "10948-588149bca4080"
content-type: font/woff2
status: 200
accept-ranges: bytes
content-length: 67912

GET
DATA 200
OK truncated
/ 153 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b73f147d47c338515c33f6882c53a8090f95a7a273d1ad99168ee2752568e32

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 243 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 192e39d75de6896a814e51f02c87d703fbbe92564f508bfbfeb7117de557f7a0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ABN Amro (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ab-nprevent.serveo.net
www.abnamro.nl
x.co
159.89.214.31
2a02:26f0:6c00:182::6d2b
45.40.140.1
0a1de2dd57da485992183b71e94298c58a25daffd101cbc142267a20ad4f5e9c
192e39d75de6896a814e51f02c87d703fbbe92564f508bfbfeb7117de557f7a0
293680a5c9b05ee7c9c775597a78a96e2326217111b9d8d46689349877dc497c
2c2155928f0b6b14772e290974ce42d8be6fc7d81efbe79db07c68b6a4138f3c
2f646c87e16a2fb953c805ff4dfb142764b559765aad550fdcfc319d48ccd53f
3196a7a2d769ead66c3e0b6ab702d03c596d5cfd31d78b7621ef074151318b15
44ad606492c593adb173cd8d728fdd5c1ef2971196c18afe58bb8f57851bb580
4959cb5c35e6b719de0802ea4d27ebc6da99bc5bcbc49f837939f9dea6e8374f
5b73f147d47c338515c33f6882c53a8090f95a7a273d1ad99168ee2752568e32
7c2c3aa607fb24e5f8d522cb359816f105564dadeb40dee703de43d12936da78
80bc044677cf80929d5d037919a68e2040d0b3632f80340b418a29fc8f5baaff
9141c8fb2be2ea05e12ab9e8e2795e38d523c8866397cc9bb0be72d5b90b35f5
ac7050f5f400d1260ae73c4ecb33405e5b75eb4805991f56f3b7ec55737a0916
b1e1d99d43ab313eb41d38bdba892888025c041e67bd9111762473f090920eaa
c0c20036cad791f2fe3957eb5e629e606313eaaff0f6b665194ee54213d1c17c
dae57d591e1c32826e496e78403c02222d00fc73d343591aa1d4b4fa3753b4b1
dba4c42b0b9001bbcff21f0ff5294d158ecdcff4d8216d4891faea016d56ebe4

ab-nprevent.serveo.net Open in urlscan Pro 159.89.214.31 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

350 kBTransfer

1235 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

ab-nprevent.serveo.net Open in urlscan Pro
159.89.214.31 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

350 kB
Transfer

1235 kB
Size

0
Cookies

8 HTTP transactions
9 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!