betaalverzoek-online.site Open in urlscan Pro
192.64.114.208 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57
Submission Tags: @andsyn1 phishing malicious Search All
Submission: On October 11 via api (October 11th 2020, 5:49:48 pm UTC) from NL

Summary HTTP 102 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 102 HTTP transactions. The main IP is 192.64.114.208, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is betaalverzoek-online.site.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 11th 2020. Valid for: 3 months.

This is the only time betaalverzoek-online.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address	AS Autonomous System
101	192.64.114.208 192.64.114.208	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1a	20446 (HIGHWINDS3) (HIGHWINDS3)
102	3

101 192.64.114.208 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)

betaalverzoek-online.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
101	betaalverzoek-online.site betaalverzoek-online.site	741 KB
1	jquery.com code.jquery.com	30 KB
102	2

	Domain	Requested by
101	betaalverzoek-online.site	code.jquery.com
1	code.jquery.com	betaalverzoek-online.site
102	2

This site contains links to these domains. Also see Links.

Domain
mijn.ing.nl
www.ing.nl
www.bancontact.com
about.ing.be
www.ing.jobs
www.ing.be
www.facebook.com
twitter.com
instagram.com
www.linkedin.com
www.youtube.com

Subject Issuer	Validity	Valid
betaalverzoek-online.site Let's Encrypt Authority X3	`2020-10-11` - `2021-01-09`	3 months	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57
Frame ID: B472944BCDA5D08EB5B58BD9C2C48033
Requests: 115 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

102
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

913 kB
Transfer

4047 kB
Size

0
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://mijn.ing.nl/login
Title: Inloggen

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request request.php Show response betaalverzoek-online.site/	4 MB 713 KB	502ms 171ms	Document text/html	192.64.114.208 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.64.114.208 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `1dabe756fbf084987ef9ff5acdd898022c23ed4c899c54af035a48168b6eda81` Request headers Host betaalverzoek-online.site Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 11 Oct 2020 17:49:30 GMT Server Apache/2.4.18 (Ubuntu) Vary Accept-Encoding Content-Encoding gzip Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	26ms 9ms	Script application/javascript	2001:4de0:ac19::1:b:1a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: betaalverzoek-online.site URL: https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a` Request headers Referer https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 11 Oct 2020 17:49:30 GMT content-encoding gzip last-modified Wed, 01 May 2019 21:14:27 GMT server nginx status 200 etag W/"5cca0c33-15851" vary Accept-Encoding x-hw 1602438570.dop208.fr8.t,1602438570.cds219.fr8.hn,1602438570.cds236.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30638
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5f2363faa5e0a7644c4f0da64e621d4c4fd3f59f85145a0ad7eae5102f745ae4` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f6feee1ba452536b2959447d5996ddc72329ce138594081c81bc422873341689` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0d48975b5e09b20b8d7795052820c17a1169303170ba16e9cc405add13d28b24` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	19 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f9f8fd5c837d08b8e24059ada189e30c358cc5aad2b13a5cc43cdfde474d2f46` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	36 KB 36 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4a0a7668aaa847d33f49023d0982c6331bc9705cad2586eccb8086a680ef534c` Request headers Origin https://betaalverzoek-online.site Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	68 KB 68 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3b5249aa62da52d9853ebd8a7c8f43ed84b3941f10bd6cd7eff0619889daa2d2` Request headers Origin https://betaalverzoek-online.site Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	37 KB 37 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e5cb35bd410aba4b717a1cc46814a88b50ff311f9514630dffa3480cb43b92e0` Request headers Origin https://betaalverzoek-online.site Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	23 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1457925150992ddbb523a5bb1bf16a7ab9743bd16286fb4f7d4c033fc958e5ae` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `54e5e667d74e28275add58f598f5fec4496ff5ec52713f4dd6bad2390c0b8a68` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	21 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `46398f6374e7f7afd4384087d40fc17b640714a90fb7267aeb8b4ebb60cc7df1` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	17 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a11523d8d9b247faab200bd3d51688352418c17341cf2da98db5beb8c1742cc7` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `282a91f39aa41aafd3e90e64cf3a600f806e1a019f9075acc75f42dd475d1d0c` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	18 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4d44e96e620584c1588fd60045508c88cd0a8ed6f6e3d9c9105b7ec803045e8b` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	bedrag.txt Show response betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/	5 B 286 B	162ms 161ms	XHR text/plain	192.64.114.208 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/bedrag.txt Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.64.114.208 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `28e8e389e66fda3e24d40e958d5ad80fe1d8fbcf1e30221aaf3a803c168cc8bf` Request headers Accept / Referer https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 11 Oct 2020 17:49:31 GMT Last-Modified Sun, 11 Oct 2020 16:04:04 GMT Server Apache/2.4.18 (Ubuntu) ETag "5-5b16754b2563d" Content-Type text/plain Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 5
GET H/1.1	200 OK	rekeningnummer.txt Show response betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/	16 B 299 B	319ms 156ms	XHR text/plain	192.64.114.208 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/rekeningnummer.txt Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.64.114.208 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `f4cdeb9f1e2972099a6573fc150b328aff37ed03708e978ddc72293783a7061b` Request headers Accept / Referer https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 11 Oct 2020 17:49:31 GMT Last-Modified Sun, 11 Oct 2020 16:05:41 GMT Server Apache/2.4.18 (Ubuntu) ETag "10-5b1675a7a02d6" Content-Type text/plain Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 16
GET H/1.1	200 OK	naam.txt Show response betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/	7 B 289 B	470ms 154ms	XHR text/plain	192.64.114.208 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/naam.txt Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.64.114.208 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `269c401b809a47d4010ae09bf2f233e514d365614c26733da5c034211afd2e40` Request headers Accept / Referer https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 11 Oct 2020 17:49:31 GMT Last-Modified Sun, 11 Oct 2020 16:03:56 GMT Server Apache/2.4.18 (Ubuntu) ETag "7-5b16754423721" Content-Type text/plain Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 7
GET H/1.1	200 OK	beschrijving.txt Show response betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/	15 B 297 B	476ms 157ms	XHR text/plain	192.64.114.208 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/beschrijving.txt Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.64.114.208 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `5c10c6575f7940d9007a3efccb461c9c1fde543fcf063ef9c14980ba514bb312` Request headers Accept / Referer https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 11 Oct 2020 17:49:31 GMT Last-Modified Sun, 11 Oct 2020 16:04:28 GMT Server Apache/2.4.18 (Ubuntu) ETag "f-5b167562aadef" Content-Type text/plain Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 15
GET H/1.1	200 OK	bedrag.txt Show response betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/	5 B 286 B	157ms 156ms	XHR text/plain	192.64.114.208 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://betaalverzoek-online.site/uadmin/plugins/core/betaalverzoek/bedrag.txt Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.64.114.208 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash `28e8e389e66fda3e24d40e958d5ad80fe1d8fbcf1e30221aaf3a803c168cc8bf` Request headers Accept / Referer https://betaalverzoek-online.site/request.php?trxid=5f52cc7c8cb57 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 11 Oct 2020 17:49:32 GMT Last-Modified Sun, 11 Oct 2020 16:04:04 GMT Server Apache/2.4.18 (Ubuntu) ETag "5-5b16754b2563d" Content-Type text/plain Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 5

betaalverzoek-online.site Open in urlscan Pro 192.64.114.208 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

102 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

913 kBTransfer

4047 kBSize

0 Cookies

17 Outgoing links

Redirected requests

102 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

betaalverzoek-online.site Open in urlscan Pro
192.64.114.208 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

102
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

913 kB
Transfer

4047 kB
Size

0
Cookies

102 HTTP transactions
13 data transactions