db-incasso.eu
Open in
urlscan Pro
172.67.213.178
Malicious Activity!
Public Scan
Submission: On September 05 via automatic, source certstream-suspicious — Scanned from IT
Summary
TLS certificate: Issued by WE1 on September 1st 2024. Valid for: 3 months.
This is the only time db-incasso.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NL Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 12 | 172.67.213.178 172.67.213.178 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.128.176 151.101.128.176 | 54113 (FASTLY) (FASTLY) | |
1 | 18.245.31.104 18.245.31.104 | 16509 (AMAZON-02) (AMAZON-02) | |
14 | 4 |
ASN16509 (AMAZON-02, US)
PTR: server-18-245-31-104.fra56.r.cloudfront.net
js.stripe.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
db-incasso.eu
2 redirects
db-incasso.eu |
122 KB |
2 |
stripe.com
js.stripe.com — Cisco Umbrella Rank: 2856 |
3 KB |
14 | 2 |
Domain | Requested by | |
---|---|---|
12 | db-incasso.eu |
2 redirects
db-incasso.eu
|
2 | js.stripe.com |
db-incasso.eu
js.stripe.com |
14 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
db-incasso.eu WE1 |
2024-09-01 - 2024-11-30 |
3 months | crt.sh |
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA |
2024-08-29 - 2024-12-05 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://db-incasso.eu/
Frame ID: 0BE6A2723E4339BF3D232AFEF0A43426
Requests: 7 HTTP requests in this frame
Frame:
https://db-incasso.eu/cdn-cgi/challenge-platform/h/b/scripts/jsd/a5b175b00260/main.js
Frame ID: 5E20321A1FA16B530089EAD596A31560
Requests: 4 HTTP requests in this frame
Frame:
https://js.stripe.com/v3/buy-button-app-019cc908568105131cd27cac59fd04524a676ebe.html
Frame ID: FE0E823663F5DEF8BEACD99600389D8A
Requests: 3 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://db-incasso.eu/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://db-incasso.eu/cdn-cgi/challenge-platform/h/b/scripts/jsd/a5b175b00260/main.js
- https://db-incasso.eu/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://db-incasso.eu/cdn-cgi/challenge-platform/h/b/scripts/jsd/a5b175b00260/main.js
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
db-incasso.eu/ |
55 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
10afe7601742890d52c39135e520ec1afef22d5e.png
db-incasso.eu/ |
53 KB 54 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rocket-loader.min.js
db-incasso.eu/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
393311bde26b99a4ad935fa55bad1dce7994388b.woff2
db-incasso.eu/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom-loading-script-riddance.js
db-incasso.eu/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
buy-button.js
js.stripe.com/v3/ |
10 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
db-incasso.eu/cdn-cgi/challenge-platform/h/b/scripts/jsd/a5b175b00260/ Frame 5E20 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2.png
db-incasso.eu/ |
280 B 666 B |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
8be278e2185c0e1e
db-incasso.eu/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 5E20 |
0 802 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
db-incasso.eu/cdn-cgi/challenge-platform/h/b/scripts/jsd/a5b175b00260/ Frame 5E20 Redirect Chain
|
8 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
8be278e2185c0e1e
db-incasso.eu/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 5E20 |
0 700 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
buy-button-app-019cc908568105131cd27cac59fd04524a676ebe.html
js.stripe.com/v3/ Frame FE0E |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
buy-button-app-019cc908568105131cd27cac59fd04524a676ebe.html
js.stripe.com/v3/ Frame FE0E |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
buy-button-app-019cc908568105131cd27cac59fd04524a676ebe.html
js.stripe.com/v3/ Frame FE0E |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- js.stripe.com
- URL
- https://js.stripe.com/v3/buy-button-app-019cc908568105131cd27cac59fd04524a676ebe.html
- Domain
- js.stripe.com
- URL
- https://js.stripe.com/v3/buy-button-app-019cc908568105131cd27cac59fd04524a676ebe.html
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NL Government (Government)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| __cfQR function| updateData boolean| __cfRLUnblockHandlers1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.db-incasso.eu/ | Name: cf_clearance Value: PsKGCzdRU.3C8GbIfLTmoJe5n8yllvxLDJ9gqnpZLn8-1725500017-1.2.1.1-FDiuEWgaKQIGQoltcAPfKMbwF43nPjMzcFWo9I.PpLl5DpX_mF5yDEQlHTpT0Ba3yhjOppnxytHPnqEVsTP.jfUG5DKiD2FH7wGAA41NJbaOQVEG5ND4ZVv_bIFhSYPqrcJjShMF4ibJWiYu8Osa1fuv9Kipy8OeEAHGa5ZBA_LYRRh3E0u0iMWmsqvbUqoT.rUJskr8koO0ctdKmLxzNV6L0CkF8.GSv83Ox0NX18RP0p7DhyqCuC2sLyllkwY8FbolsoM6xCDetYZfNYb.t9wRADDR1xXa7rIKkmNDj.ZLbY.gz8Cn4YZzEYjjEMgxCYDqfjH3MspeMh4bOnLon_i5LXxdexOhIXnLqgjhiY85VHoGjz9MSInium7.KR8O |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
db-incasso.eu
js.stripe.com
js.stripe.com
151.101.128.176
172.67.213.178
18.245.31.104
0149f7a894e28f6971802b0f74b0254337ce6176709d8113baacc0f691f8e69a
38feff8c29017cd2390c202480162851ef1900bbfeeb8388a68f8d4db9da9c30
671400527201139e160a3c238e7fd04c434738317fcb3ffc149d619baeee18e0
7a76da0389f34e0710b11ddde0561ae3a678d2a400e3e8e713c996b0d50aef4c
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
cb552ae5513453213a801e2814f2ef08220ad7e3525de1caee7c44bd2e1c3238
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d6e7738a8852c285d45f63add2d2e15930428b4c6753c6bf722a3f86f62d5a22
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855