![](/screenshots/405f9160-0ab9-4aa2-8350-19aa9d6044dd.png)
betaalsimpel.cc
Open in
urlscan Pro
162.213.251.133
Malicious Activity!
Public Scan
Submission: On December 21 via manual from NL
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 15th 2020. Valid for: a year.
This is the only time betaalsimpel.cc was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rabobank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 162.213.251.133 162.213.251.133 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
7 | 2a02:26f0:170... 2a02:26f0:1700:1a9::1077 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a00:1450:400... 2a00:1450:4001:81b::200a | 15169 (GOOGLE) (GOOGLE) | |
11 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: business90-1.web-hosting.com
betaalsimpel.cc |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
rabobank.nl
bankieren.rabobank.nl |
128 KB |
3 |
betaalsimpel.cc
betaalsimpel.cc |
24 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
11 | 3 |
Domain | Requested by | |
---|---|---|
7 | bankieren.rabobank.nl |
betaalsimpel.cc
bankieren.rabobank.nl |
3 | betaalsimpel.cc |
betaalsimpel.cc
|
1 | ajax.googleapis.com |
betaalsimpel.cc
|
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
betaalsimpel.cc Sectigo RSA Domain Validation Secure Server CA |
2020-12-15 - 2021-12-15 |
a year | crt.sh |
bankieren.rabobank.nl DigiCert SHA2 Extended Validation Server CA |
2020-04-16 - 2021-04-21 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://betaalsimpel.cc/modal.php
Frame ID: A2CDEA1D136D9CEC1B5D81F6AF1455FE
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/405f9160-0ab9-4aa2-8350-19aa9d6044dd.png)
Detected technologies
Detected patterns
- url /\.php(?:$|\?)/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
modal.php
betaalsimpel.cc/ |
5 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rass-proto.css
bankieren.rabobank.nl/rabo/sam/staticcontent/vrs_13_7_22__202009101151/simpledpo/css/ |
129 KB 83 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dpo-extension.css
bankieren.rabobank.nl/rabo/sam/staticcontent/vrs_13_7_22__202009101151/simpledpo/css/ |
41 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.css
bankieren.rabobank.nl/klanten/static/generic/font/myriad/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.css
bankieren.rabobank.nl/bankierenplus/static/appls/rfs-styleguide-versions/0.31.0/font/myriad/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ |
86 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rabobank_logo.png
betaalsimpel.cc/rabopage/bestanden/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qslimage.png
betaalsimpel.cc/rabobank/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3b0f1c67-c2e4-4df6-976f-49d52e45aba1.woff2
bankieren.rabobank.nl/bankierenplus/static/appls/rfs-styleguide-versions/0.31.0/font/myriad/fonts/ |
16 KB 16 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_supercirkel_met_kruisje.svg
bankieren.rabobank.nl/rabo/sam/staticcontent/vrs_13_7_22__202009101151/simpledpo/css/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
e7e30ff2-3a95-49b0-bbf9-024f40ead426.woff2
bankieren.rabobank.nl/bankierenplus/static/appls/rfs-styleguide-versions/0.31.0/font/myriad/fonts/ |
16 KB 16 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rabobank (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery number| sendMessage1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
betaalsimpel.cc/ | Name: PHPSESSID Value: 1ee50e22dbaa45d0de0ac38488ca3624 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload; |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
bankieren.rabobank.nl
betaalsimpel.cc
162.213.251.133
2a00:1450:4001:81b::200a
2a02:26f0:1700:1a9::1077
02177780115022cb1685de42f8b04ad06f26d752dac6d6f6fa24e2161c5a3c31
03caeff0f4235241611956eeb18dcbfabb8b67083208f00a0b0f92fbff9b28bd
08c9ac2b416541a742fda276c1c5ac3a8b3e7679936bbd3fc0928c61e85a9a7c
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
2ca13350f18c29ca23177619c725981a4be72e44e5d4812355fef76b90da8642
430b74ebc9fa3839a744586bf75baece6290a2f1b5bd0d53ac40c15fb972b536
4dbba2be9bb99b3192ee293127cb103876e4b5bf66c2fede8a3f6678c242711e
5bd13b67370a235b3132593811cbe6ff6c35ef1ec9f228994db0d30b29ef02b1
cb57654a4d26ee2ff2dbac30fdb8856beedf8f34ba6b431182dcd134811802d8
ea6137f203075f3d4b4c07e66f62bbf0672615435ed362b43740df71d16d9d31
efdae3b0637a1f83b7dd765183bf5d15ef4cd739740a0e6903ed9dd9ba8c3523