Submitted URL: https://dik.si/2A_Us
Effective URL: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Submission: On February 19 via automatic, source openphish — Scanned from NL

Summary

This website contacted 4 IPs in 3 countries across 7 domains to perform 10 HTTP transactions. The main IP is 45.82.120.13, located in Germany and belongs to . The main domain is cbase-wet.duckdns.org.
TLS certificate: Issued by R3 on February 19th 2024. Valid for: 3 months.
This is the only time cbase-wet.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 104.244.42.133 13414 (TWITTER)
5 45.82.120.13 ()
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 193.191.245.121 ()
3 4 2a01:690:35:1... 16326 (SMALS-MVM)
10 4
Apex Domain
Subdomains
Transfer
5 duckdns.org
cbase-wet.duckdns.org
163 KB
3 gyazo.com
i.gyazo.com — Cisco Umbrella Rank: 84133
6 KB
2 werkenvoor.be
werkenvoor.be
834 B
2 workingfor.be
workingfor.be
955 B
1 selor.be
client.selor.be
304 B
1 t.co
t.co — Cisco Umbrella Rank: 641
572 B
1 dik.si
dik.si
1 KB
10 7
Domain Requested by
5 cbase-wet.duckdns.org t.co
cbase-wet.duckdns.org
3 i.gyazo.com cbase-wet.duckdns.org
2 werkenvoor.be 1 redirects cbase-wet.duckdns.org
2 workingfor.be 2 redirects
1 client.selor.be 1 redirects
1 t.co
1 dik.si 1 redirects
10 7

This site contains links to these domains. Also see Links.

Domain
coinbase.com
Subject Issuer Validity Valid
t.co
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-10-16 -
2024-10-14
a year crt.sh
cbase-wet.duckdns.org
R3
2024-02-19 -
2024-05-19
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-04 -
2024-05-03
a year crt.sh

This page contains 1 frames:

Primary Page: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Frame ID: 9A187E647C024BFCCF351275C7BC945E
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

© Coinbase Wallet 2024.

Page URL History Show full URLs

  1. https://dik.si/2A_Us HTTP 301
    https://t.co/gZMBfC1EVz Page URL
  2. https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html Page URL

Page Statistics

10
Requests

90 %
HTTPS

50 %
IPv6

7
Domains

7
Subdomains

4
IPs

3
Countries

170 kB
Transfer

243 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://dik.si/2A_Us HTTP 301
    https://t.co/gZMBfC1EVz Page URL
  2. https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://dik.si/2A_Us HTTP 301
  • https://t.co/gZMBfC1EVz
Request Chain 3
  • https://client.selor.be/img/federale_overheid_logo.png HTTP 301
  • https://workingfor.be/language_selection_page HTTP 301
  • https://workingfor.be/nl/language_selection_page HTTP 301
  • https://werkenvoor.be/nl/language_selection_page HTTP 302
  • https://werkenvoor.be/nl

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
gZMBfC1EVz
t.co/
Redirect Chain
  • https://dik.si/2A_Us
  • https://t.co/gZMBfC1EVz
318 B
572 B
Document
General
Full URL
https://t.co/gZMBfC1EVz
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
private,max-age=300
content-encoding
gzip
content-length
199
content-type
text/html; charset=utf-8
date
Mon, 19 Feb 2024 14:03:16 GMT
expires
Mon, 19 Feb 2024 14:08:16 GMT
perf
7469935968
server
tsa_f
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
76082e6019ba2987461d61ffa5a5e8505727839573ff83b18a12163bddfbdcc4
x-response-time
123
x-transaction-id
4d388f858e201231
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, private
cf-cache-status
DYNAMIC
cf-ray
857f0d596eefb896-AMS
content-type
text/html; charset=UTF-8
date
Mon, 19 Feb 2024 14:03:16 GMT
expires
-1
location
https://t.co/gZMBfC1EVz
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kP3wJufrid8NDvkdUB2gQoHJlXzluvf1eciBBj5RcBDLigEi4aTm1J4d%2FwQxdZQGAOdOQETGJfCKr9lIA7x8yFZHHQ0h3U8t8bn7Zg7GowedWTcI8Iech5SvsXQpCdbb2puGmio%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
Primary Request nl1.html
cbase-wet.duckdns.org/Zahlungseingang/
9 KB
3 KB
Document
General
Full URL
https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Requested by
Host: t.co
URL: https://t.co/gZMBfC1EVz
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.82.120.13 , Germany, ASN (),
Reverse DNS
default.bero-host.de
Software
Apache/2.4.18 (Ubuntu) /
Resource Hash
6942d8723c5a98e9336446e2a3403527358a31847f1bb358215417bf980ef16d

Request headers

Referer
https://t.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
2631
Content-Type
text/html
Date
Mon, 19 Feb 2024 14:03:17 GMT
ETag
"244f-610935c3cf680-gzip"
Keep-Alive
timeout=5, max=100
Last-Modified
Sun, 04 Feb 2024 19:29:14 GMT
Server
Apache/2.4.18 (Ubuntu)
Vary
Accept-Encoding
style.css
cbase-wet.duckdns.org/Zahlungseingang/files/
83 KB
14 KB
Stylesheet
General
Full URL
https://cbase-wet.duckdns.org/Zahlungseingang/files/style.css
Requested by
Host: cbase-wet.duckdns.org
URL: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.82.120.13 , Germany, ASN (),
Reverse DNS
default.bero-host.de
Software
Apache/2.4.18 (Ubuntu) /
Resource Hash
87fb9c3207fdfcc161f73fe9be582e9ed7860e39fd99cffb416612827db88dbd

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date
Mon, 19 Feb 2024 14:03:17 GMT
Content-Encoding
gzip
Last-Modified
Thu, 19 Oct 2023 11:01:48 GMT
Server
Apache/2.4.18 (Ubuntu)
ETag
"14c55-6080faea75f00-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
14501
9e378d1bfcf19a306c3a1ef12704b12b.png
i.gyazo.com/
3 KB
3 KB
Image
General
Full URL
https://i.gyazo.com/9e378d1bfcf19a306c3a1ef12704b12b.png
Requested by
Host: cbase-wet.duckdns.org
URL: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19e0aa94650a20242a79dcf2baa46a2f0f7a642e5a1eadf250bf298fd468e2e4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://cbase-wet.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 14:03:17 GMT
via
1.1 google
cf-cache-status
HIT
age
130152
content-length
3157
server
cloudflare
etag
"9e37"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
https://gyazo.com
cache-control
public, max-age=31536000
access-control-allow-credentials
true
content-dpr
1.250000
x-cache-level
ZS
accept-ranges
bytes
cf-ray
857f0d69c869669f-AMS
expires
Tue, 18 Feb 2025 14:03:17 GMT
nl
werkenvoor.be/
Redirect Chain
  • https://client.selor.be/img/federale_overheid_logo.png
  • https://workingfor.be/language_selection_page
  • https://workingfor.be/nl/language_selection_page
  • https://werkenvoor.be/nl/language_selection_page
  • https://werkenvoor.be/nl
0
0
Image
General
Full URL
https://werkenvoor.be/nl
Requested by
Host: cbase-wet.duckdns.org
URL: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Protocol
HTTP/1.1
Server
2a01:690:35:100::f5:79 Zottegem, Belgium, ASN16326 (SMALS-MVM, BE),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://cbase-wet.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Redirect headers

Expires
Sun, 19 Nov 1978 05:00:00 GMT
Date
Mon, 19 Feb 2024 05:02:49 GMT
Content-Security-Policy
frame-src https://*; child-src https://*; report-uri /report-csp-violation; upgrade-insecure-requests
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=10886400
Age
0
X-Cache
MISS
Connection
keep-alive
X-Forwarded-Proto
https
Content-Length
338
X-UA-Compatible
IE=edge
X-Frame-Options
SAMEORIGIN
Content-language
nl
Location
http://werkenvoor.be/nl
Content-Type
text/html; charset=UTF-8
Cache-Control
must-revalidate, no-cache, private
Permissions-Policy
interest-cohort=()
X-Robots-Tag
all
X-Drupal-Cache
HIT
X-Forwarded-Ssl
on
X-Cache-Hits
0
6ef2dc2fef98fc027321199f53e56968.png
i.gyazo.com/
654 B
999 B
Image
General
Full URL
https://i.gyazo.com/6ef2dc2fef98fc027321199f53e56968.png
Requested by
Host: cbase-wet.duckdns.org
URL: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d7e3f87c4af38a42aca1f0d1dab8bf2ec77e1e01f8d136a433340490047b17e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://cbase-wet.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 14:03:17 GMT
via
1.1 google
cf-cache-status
HIT
age
130152
content-length
654
server
cloudflare
etag
"6ef2"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
https://gyazo.com
cache-control
public, max-age=31536000
access-control-allow-credentials
true
content-dpr
1.250000
x-cache-level
ZS
accept-ranges
bytes
cf-ray
857f0d69c86b669f-AMS
expires
Tue, 18 Feb 2025 14:03:17 GMT
63dd88e9a4a09c80fc6ac23b86e80e37.png
i.gyazo.com/
1 KB
1 KB
Image
General
Full URL
https://i.gyazo.com/63dd88e9a4a09c80fc6ac23b86e80e37.png
Requested by
Host: cbase-wet.duckdns.org
URL: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
68dc668fbe74a9a565049cdd89870e916a24df414ac5ed736fc65db48c75013b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://cbase-wet.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 14:03:17 GMT
via
1.1 google
cf-cache-status
HIT
age
130152
content-length
1445
server
cloudflare
etag
"63dd"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
https://gyazo.com
cache-control
public, max-age=31536000
access-control-allow-credentials
true
content-dpr
1.250000
x-cache-level
ZS
accept-ranges
bytes
cf-ray
857f0d69c86d669f-AMS
expires
Tue, 18 Feb 2025 14:03:17 GMT
ROsanswebtextregular-54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a.woff
cbase-wet.duckdns.org/Zahlungseingang/files/
75 KB
75 KB
Font
General
Full URL
https://cbase-wet.duckdns.org/Zahlungseingang/files/ROsanswebtextregular-54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a.woff
Requested by
Host: cbase-wet.duckdns.org
URL: https://cbase-wet.duckdns.org/Zahlungseingang/files/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.82.120.13 , Germany, ASN (),
Reverse DNS
default.bero-host.de
Software
Apache/2.4.18 (Ubuntu) /
Resource Hash
54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a

Request headers

Referer
https://cbase-wet.duckdns.org/Zahlungseingang/files/style.css
Origin
https://cbase-wet.duckdns.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date
Mon, 19 Feb 2024 14:03:17 GMT
Last-Modified
Thu, 19 Oct 2023 11:01:48 GMT
Server
Apache/2.4.18 (Ubuntu)
ETag
"12ac9-6080faea75f00"
Content-Type
application/font-woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
76489
ROsanswebtextbold-27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591.woff
cbase-wet.duckdns.org/Zahlungseingang/files/
68 KB
68 KB
Font
General
Full URL
https://cbase-wet.duckdns.org/Zahlungseingang/files/ROsanswebtextbold-27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591.woff
Requested by
Host: cbase-wet.duckdns.org
URL: https://cbase-wet.duckdns.org/Zahlungseingang/files/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.82.120.13 , Germany, ASN (),
Reverse DNS
default.bero-host.de
Software
Apache/2.4.18 (Ubuntu) /
Resource Hash
27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591

Request headers

Referer
https://cbase-wet.duckdns.org/Zahlungseingang/files/style.css
Origin
https://cbase-wet.duckdns.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date
Mon, 19 Feb 2024 14:03:17 GMT
Last-Modified
Thu, 19 Oct 2023 11:01:48 GMT
Server
Apache/2.4.18 (Ubuntu)
ETag
"10f5b-6080faea75f00"
Content-Type
application/font-woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
69467
icons-650b3ba27798de4eaf8cfc95c3ef953beff6658da3a4cfc5762c77eeb050a630.woff2
cbase-wet.duckdns.org/Zahlungseingang/files/
3 KB
3 KB
Font
General
Full URL
https://cbase-wet.duckdns.org/Zahlungseingang/files/icons-650b3ba27798de4eaf8cfc95c3ef953beff6658da3a4cfc5762c77eeb050a630.woff2
Requested by
Host: cbase-wet.duckdns.org
URL: https://cbase-wet.duckdns.org/Zahlungseingang/files/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.82.120.13 , Germany, ASN (),
Reverse DNS
default.bero-host.de
Software
Apache/2.4.18 (Ubuntu) /
Resource Hash
650b3ba27798de4eaf8cfc95c3ef953beff6658da3a4cfc5762c77eeb050a630

Request headers

Referer
https://cbase-wet.duckdns.org/Zahlungseingang/files/style.css
Origin
https://cbase-wet.duckdns.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date
Mon, 19 Feb 2024 14:03:17 GMT
Last-Modified
Thu, 19 Oct 2023 11:01:46 GMT
Server
Apache/2.4.18 (Ubuntu)
ETag
"a98-6080fae88da80"
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2712

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| yesnoCheck2 function| yesnoCheck

4 Cookies

Domain/Path Name / Value
dik.si/ Name: XSRF-TOKEN
Value: eyJpdiI6InF1MGNqT244N0t6MXZPUEpoLzhUeVE9PSIsInZhbHVlIjoiWE1CeVBZdTl4cHJScHFzMjhmWndzQ0dDdDNUbnBtOHJMUC8zb2NGcUJybDZzOFF1ZVJMN2l5RTRicVQxYXJCNzF0RUZsTndXRG5OYk95M1ZyTTk2OHF6aC9LSDlGNTc1Mk53ZFdvdS9mbzljTFNnNXR2NklnTFVCbUNRYk4rRFEiLCJtYWMiOiJjYjM0ZTE0Nzk2MWQ2ZmY2NDExNTViYzQxMzA1MzUyMDkyMTY1OWIyOGVhNTg1NjQ4YzNiYTU3NjFjODBiZDUxIiwidGFnIjoiIn0%3D
dik.si/ Name: diksi_session
Value: eyJpdiI6InA0OFZ3NWxvcG96QkNKa2pTTXZ6bWc9PSIsInZhbHVlIjoicmw5ZUlBTDJnaDJmWUcvdVlEekNOejFYT2pvY01xTnViSkkzNFErRmJrcVc0R0hjNU9QM0JXNzJ1ZEhXeE5RRkZ6SUxqVHBSQ3JBa05NYkVENG4rai9BcnA3U1RLZ3ZsZEVEM25iRGN4K3JDVGlHbTZwYUVxNzNEU3l5a09WUnMiLCJtYWMiOiI1NDFmNGMyOGIxYmU4OTczMzY3MjY1ZjlkMTE1NTk0YWM3NDFkYjQwMzg2MDIwMGMxNmIyZWRjYTc4OTc1ODlhIiwidGFnIjoiIn0%3D
.t.co/ Name: muc
Value: 505a5107-4098-44c1-a723-c568f00fb742
i.gyazo.com/ Name: Gyazo_cfwoker
Value: i

3 Console Messages

Source Level URL
Text
other warning URL: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://cbase-wet.duckdns.org/Zahlungseingang/nl1.html
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0