![](/screenshots/31b33607-ad59-40ad-bb6d-538907f40d63.png)
root5.localhost.run
Open in
urlscan Pro
35.193.161.204
Malicious Activity!
Public Scan
Submission: On July 08 via api from GB
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on April 15th 2019. Valid for: 3 months.
This is the only time root5.localhost.run was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: International Card Services (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
31 | 35.193.161.204 35.193.161.204 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 185.195.93.72 185.195.93.72 | 42649 (BBN) (BBN) | |
1 | 5.172.40.22 5.172.40.22 | 20559 (FUNDAMENT...) (FUNDAMENTS-AS) | |
1 | 2a02:26f0:6c0... 2a02:26f0:6c00:2a0::2db0 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
41 | 5 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 204.161.193.35.bc.googleusercontent.com
root5.localhost.run |
Apex Domain Subdomains |
Transfer | |
---|---|---|
31 |
localhost.run
root5.localhost.run |
1 MB |
2 |
icscards.nl
www.icscards.nl portalviewer.icscards.nl |
230 KB |
1 |
clicktale.net
cdnssl.clicktale.net |
10 KB |
0 |
sitestat.com
Failed
nl.sitestat.com Failed |
|
41 | 4 |
Domain | Requested by | |
---|---|---|
31 | root5.localhost.run |
root5.localhost.run
|
1 | cdnssl.clicktale.net |
root5.localhost.run
|
1 | portalviewer.icscards.nl |
root5.localhost.run
|
1 | www.icscards.nl |
root5.localhost.run
|
0 | nl.sitestat.com Failed |
root5.localhost.run
|
41 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.icscards.nl |
www.icsbusiness.nl |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.localhost.run Let's Encrypt Authority X3 |
2019-04-15 - 2019-07-14 |
3 months | crt.sh |
www.icscards.nl DigiCert SHA2 Extended Validation Server CA |
2018-08-29 - 2019-10-28 |
a year | crt.sh |
app.cobrowser.com Sectigo RSA Organization Validation Secure Server CA |
2019-01-28 - 2020-02-23 |
a year | crt.sh |
*.clicktale.net DigiCert SHA2 Secure Server CA |
2018-07-15 - 2019-10-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://root5.localhost.run/
Frame ID: 4A842726BF7DAC6B443B188AC70AAE7A
Requests: 41 HTTP requests in this frame
Screenshot
![](/screenshots/31b33607-ad59-40ad-bb6d-538907f40d63.png)
Detected technologies
![](/vendor/wappa/icons/Ubuntu.png)
Detected patterns
- headers server /Ubuntu/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
- html /<!-- (?:End )?Google Tag Manager -->/i
Detected patterns
- script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i
Page Statistics
30 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Klantenservice
Search URL Search Domain Scan URL
Title: Producten
Search URL Search Domain Scan URL
Title: Card-voordeel
Search URL Search Domain Scan URL
Title: Inloggen Mijn ICS
Search URL Search Domain Scan URL
Title: Nog geen gebruiker? Activeer nu Mijn ICS.
Search URL Search Domain Scan URL
Title: Inlognaam en/of wachtwoord vergeten?
Search URL Search Domain Scan URL
Title: Meer informatie over Mijn ICS
Search URL Search Domain Scan URL
Title: Ontdek het hier
Search URL Search Domain Scan URL
Title: Contact
Search URL Search Domain Scan URL
Title: Portalviewer
Search URL Search Domain Scan URL
Title: Pincode vergeten
Search URL Search Domain Scan URL
Title: Saldo bekijken
Search URL Search Domain Scan URL
Title: Onterechte betaling
Search URL Search Domain Scan URL
Title: Card-rekening betalen
Search URL Search Domain Scan URL
Title: Card deblokkeren
Search URL Search Domain Scan URL
Title: World Card
Search URL Search Domain Scan URL
Title: World Card Gold
Search URL Search Domain Scan URL
Title: World Card Platinum
Search URL Search Domain Scan URL
Title: Prepaid Card
Search URL Search Domain Scan URL
Title: Verzekeringen
Search URL Search Domain Scan URL
Title: Extra Card
Search URL Search Domain Scan URL
Title: Gespreid Betalen Faciliteit
Search URL Search Domain Scan URL
Title: Over ICS
Search URL Search Domain Scan URL
Title: Pers
Search URL Search Domain Scan URL
Title: Disclaimer
Search URL Search Domain Scan URL
Title: Algemene Voorwaarden
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: Zakelijke Cards
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
41 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
root5.localhost.run/ |
48 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
plx.check.js
root5.localhost.run/files/ |
385 B 557 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-ics.css
www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/ |
229 KB 230 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-ics.css
root5.localhost.run/files/ |
205 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
root5.localhost.run/files/ |
247 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cs.js
root5.localhost.run/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
analytics.js
root5.localhost.run/files/ |
29 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtm.js
root5.localhost.run/files/ |
58 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshare.js
root5.localhost.run/files/ |
235 KB 66 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr.js
root5.localhost.run/files/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.js
root5.localhost.run/files/ |
95 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
root5.localhost.run/files/ |
153 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
angular.js
root5.localhost.run/files/ |
2 MB 533 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common.js
root5.localhost.run/files/ |
684 KB 122 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
babel-poly-fill.js
root5.localhost.run/files/ |
86 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pub_002.js
root5.localhost.run/files/ |
667 KB 143 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pub.js
root5.localhost.run/files/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
e0516c44-9a5d-488f-9959-1b34185e5216.js
root5.localhost.run/files/ |
60 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
d41e1eae596e167f975877da5b8658cc.woff
root5.localhost.run/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5d4aa15f47dbbc8848e141699172fc7f.woff
root5.localhost.run/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
d70b257e8a0456bf50c796a8db830948.woff
root5.localhost.run/files/ |
10 KB 11 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.12.0.min.js
root5.localhost.run/webfiles/1495106534688/media/theme/ics-nl/js/3rdparty/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
8ba5c54d292507036373ed4ee0bb8c04.woff
root5.localhost.run/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
d7cfa0e76cf13c91a985a876d5214044.woff
root5.localhost.run/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0c62ecea9fbe2abf19c8fc1d8d3adc52.ttf
root5.localhost.run/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
d9c89afb33c578f113762ea7872fb4e1.ttf
root5.localhost.run/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenshare.latest.min.js
portalviewer.icscards.nl/generic/sitemonitor/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
s
nl.sitestat.com/icscards/undefined/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e0516c44-9a5d-488f-9959-1b34185e5216.js
cdnssl.clicktale.net/www16/ptc/ |
61 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sunot-light-webfont.woff2
root5.localhost.run/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sunot-regular-webfont.woff2
root5.localhost.run/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sunot-light-webfont.woff
root5.localhost.run/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sunot-regular-webfont.woff
root5.localhost.run/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sunot-light-webfont.ttf
root5.localhost.run/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sunot-regular-webfont.ttf
root5.localhost.run/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sunot-light-webfont.woff2
www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sunot-regular-webfont.woff2
www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sunot-light-webfont.woff
www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sunot-regular-webfont.woff
www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sunot-light-webfont.ttf
www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sunot-regular-webfont.ttf
www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- nl.sitestat.com
- URL
- https://nl.sitestat.com/icscards/undefined/s?name=&ns__t=1562622039839&ns_c=UTF-8&c8=Inloggen%20-%20Mijn%20ICS%20%7C%20International%20Card%20Services&c7=https%3A%2F%2Froot5.localhost.run%2F&c9=
- Domain
- www.icscards.nl
- URL
- https://www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/sunot-light-webfont.woff2
- Domain
- www.icscards.nl
- URL
- https://www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/sunot-regular-webfont.woff2
- Domain
- www.icscards.nl
- URL
- https://www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/sunot-light-webfont.woff
- Domain
- www.icscards.nl
- URL
- https://www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/sunot-regular-webfont.woff
- Domain
- www.icscards.nl
- URL
- https://www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/sunot-light-webfont.ttf
- Domain
- www.icscards.nl
- URL
- https://www.icscards.nl/webfiles/1547105755875/media/theme/ics-nl/css/fonts/sunot-regular-webfont.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: International Card Services (Financial)70 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| PLX function| ga object| gaplugins object| google_tag_manager object| dataLayer object| Modernizr boolean| alreadyLoaded boolean| hasJQuery boolean| cbQueryLoaded undefined| brancheNum undefined| revisionNum undefined| revisionMinor function| CobrowsingLoader object| Cobrowser function| ExceptionLogger function| diff_match_patch number| DIFF_DELETE number| DIFF_INSERT number| DIFF_EQUAL function| Cobrowsing function| cbQuery function| $ function| jQuery object| _cbmo function| cbErrorMessage object| _cbSettings string| cbHost function| angular_daccb986af70b4aac82f function| common_daccb986af70b4aac82f object| core object| __core-js_shared__ object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| angular object| reTree function| udm_ object| ns_p function| ClickTaleCreateDOMElement number| WRInitTime string| ct_pdc_qs_val object| ClickTaleGlobal object| ct_dispatcher function| ClickTaleAppendInHead function| ClickTaleXHTMLCompliantScriptTagCreate boolean| isHttps object| pccScriptElement object| ClickTaleOnReadyList boolean| ClickTaleIsXHTMLCompliant string| ClickTaleScriptSource object| ClickTaleSettings boolean| ClickTaleIncludedOnDOMReady function| ClickTalePrevOnReady function| ClickTaleOnReady object| cookieBarModule object| cobrowsingLoader undefined| autoMonitorConfig object| ClickTaleMonitor object| ctVEconfig function| ClickTaleOnRecording string| scriptSource string| pccSource string| pccSrc0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnssl.clicktale.net
nl.sitestat.com
portalviewer.icscards.nl
root5.localhost.run
www.icscards.nl
nl.sitestat.com
www.icscards.nl
185.195.93.72
2a02:26f0:6c00:2a0::2db0
35.193.161.204
5.172.40.22
159c36c3936070cdc6d98829bcbff4cf6d1a719ca6ae92a1da30380d3173b112
20d72df7fca09c9d0a1abcbde89b6053dee61fbf5a387683e77c5f8cde0d990e
5fbb236c4475bab5f36be4fdc912da1385010e42cbcfab06637f0b13f183b825
6059384bbd0cdbc97dc5bfe6eca7131d63af5180abd677945c506ebf6fd0785c
6339c3cf10a78b9068fe1212140c41ac57c9b3d21b84ac48a44b8c3208fb7448
6770de6de4689892fd2499c559bfb5b3d81ee2137538fefe9f17ee1ba3d231b3
71cb1400a01fc661b57a559c23a140ea97fb26ccae189cf436851fde40e0d715
78e8d34bf351331508bc548e9ff1ffa15f2fa7478e031908ce2a9fe51c219add
7a24ab7ed80542601c759b4e0536bfb163566e4e011aa70667d5c1148f31483d
9de97eeaf0eff44556a3cf9ed7f0a906265fb1e4c3df7dfa4fb695cccb7bdd58
be8fd2248ef59e87b622bae876e674b92adfef0e05025e6c3f5670a2722977db
c68bbfd2d18e2ae77eb3f2ae219c566fb7d99523f120c5cab325c2281f3f7a0d
d2192a545ccac1c1d3d731fdef9951cd0342adc57d3ddf33bce9a6a726d78826
d61a647e895f3c5218174f74d8c6cbc7574c593d6a49defe2d56a4ff1d4b6e6c
de33fe1ba0d81147fc56ff19149e85914d13c4c4d7a5969aeda463d9f4787848
ecb2f826246fe0640dd702baaee112c41b398c3dc7878afb6d0c965eb7bdbd71
f7328679f40c86a22c2eb25459c541f912935ba6efdd740b0d0a5136f50e7b12
fe7d29589cd794c363f533a1cbca823e81828534e8dd714a8e4b93cbd73ec657
ffc2f731191aef9f25ea6198d824a5347194aefc2397c0ed97f27455c6ba44be