![](/screenshots/489c1202-7f68-4359-b773-f4b2f351a84f.png)
inleverpuntrbnk.icu
Open in
urlscan Pro
88.214.56.9
Malicious Activity!
Public Scan
Effective URL: https://inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW/
Submission: On March 27 via api from BE
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on March 26th 2020. Valid for: 3 months.
This is the only time inleverpuntrbnk.icu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rabobank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a01:238:20a:... 2a01:238:20a:202:1148:: | 6724 (STRATO ST...) (STRATO STRATO AG) | |
1 8 | 88.214.56.9 88.214.56.9 | 197071 (ACTIVE-SE...) (ACTIVE-SERVERS active-servers.com) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
14 | 95.101.46.25 95.101.46.25 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 2a00:1450:400... 2a00:1450:4001:81a::200e | 15169 (GOOGLE) (GOOGLE) | |
25 | 5 |
ASN197071 (ACTIVE-SERVERS active-servers.com, DE)
PTR: vps-zap502712-1.zap-srv.com
inleverpuntrbnk.icu |
ASN16625 (AKAMAI-AS, US)
PTR: a95-101-46-25.deploy.static.akamaitechnologies.com
www.rabobank.be |
ASN15169 (GOOGLE, US)
www.youtube-nocookie.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
rabobank.be
www.rabobank.be |
242 KB |
8 |
inleverpuntrbnk.icu
1 redirects
inleverpuntrbnk.icu |
121 KB |
2 |
youtube-nocookie.com
www.youtube-nocookie.com |
|
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
uwservicern.eu
uwservicern.eu |
228 B |
25 | 5 |
Domain | Requested by | |
---|---|---|
14 | www.rabobank.be |
inleverpuntrbnk.icu
|
8 | inleverpuntrbnk.icu |
1 redirects
inleverpuntrbnk.icu
|
2 | www.youtube-nocookie.com |
inleverpuntrbnk.icu
|
1 | code.jquery.com |
inleverpuntrbnk.icu
|
1 | uwservicern.eu | |
25 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.rabobank.be |
nl-nl.facebook.com |
twitter.com |
www.linkedin.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
uwservicern.eu Encryption Everywhere DV TLS CA - G1 |
2020-03-26 - 2021-03-26 |
a year | crt.sh |
inleverpuntrbnk.icu Let's Encrypt Authority X3 |
2020-03-26 - 2020-06-24 |
3 months | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
www.rabobank.be DigiCert SHA2 Extended Validation Server CA |
2020-02-13 - 2021-02-17 |
a year | crt.sh |
*.google.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW/
Frame ID: AFFFF336CE46E779753549C7196025AE
Requests: 23 HTTP requests in this frame
Frame:
https://www.youtube-nocookie.com/embed/tyxyZhXCkWs?rel=0&controls=1&showinfo=1
Frame ID: FEFB5070EF3283250196A899047E6E48
Requests: 1 HTTP requests in this frame
Frame:
https://www.youtube-nocookie.com/embed/tyxyZhXCkWs?rel=0&controls=1&showinfo=1
Frame ID: 4918BC83749BCEA39610816B64FDD0E0
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/489c1202-7f68-4359-b773-f4b2f351a84f.png)
Page URL History Show full URLs
- https://uwservicern.eu/?tzKyEuIyplIXbrzXa=8ikZpTlXeEQ5KypqvWE Page URL
-
https://inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW
HTTP 301
https://inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW/ Page URL
Detected technologies
![](/vendor/wappa/icons/UNIX.png)
Detected patterns
- headers server /Unix/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
46 Outgoing links
These are links going to different origins than the main page.
Title: Mijn rekeningen
Search URL Search Domain Scan URL
Title: Over ons
Search URL Search Domain Scan URL
Title: Rabo Spaarrekening
Search URL Search Domain Scan URL
Title: Rabo Plus Account
Search URL Search Domain Scan URL
Title: Rabo Junior Account
Search URL Search Domain Scan URL
Title: Rabo Gift Account
Search URL Search Domain Scan URL
Title: Rabo Termijnrekening
Search URL Search Domain Scan URL
Title: Rabo Zichtrekening
Search URL Search Domain Scan URL
Title: Vergelijk spaarrekeningen
Search URL Search Domain Scan URL
Title: Document Center
Search URL Search Domain Scan URL
Title: Veelgestelde vragen
Search URL Search Domain Scan URL
Title: ABC-banktermen
Search URL Search Domain Scan URL
Title: Essentiële spaardersinformatie
Search URL Search Domain Scan URL
Title: Veilig bankieren
Search URL Search Domain Scan URL
Title: Alles over de digipass
Search URL Search Domain Scan URL
Title: Kredietwaardigheid
Search URL Search Domain Scan URL
Title: Contacteer ons
Search URL Search Domain Scan URL
Title: Een klacht?
Search URL Search Domain Scan URL
Title: De spaarrekening van a tot z
Search URL Search Domain Scan URL
Title: Rente onder de loep
Search URL Search Domain Scan URL
Title: Psychologie van de spaarder
Search URL Search Domain Scan URL
Title: Erfeniskwesties
Search URL Search Domain Scan URL
Title: Meld u aan voor onze nieuwsbrief
Search URL Search Domain Scan URL
Title: Frida Deceunynck
Search URL Search Domain Scan URL
Title: Pascal Paepen
Search URL Search Domain Scan URL
Title: Claudia Hammond
Search URL Search Domain Scan URL
Title: Cédric Boitte
Search URL Search Domain Scan URL
Title: #sparen
Search URL Search Domain Scan URL
Title: #psychologie
Search URL Search Domain Scan URL
Title: #wetgeving
Search URL Search Domain Scan URL
Title: #kinderen
Search URL Search Domain Scan URL
Title: #fiscaliteit
Search URL Search Domain Scan URL
Title: #technologie
Search URL Search Domain Scan URL
Title: #erfenis
Search URL Search Domain Scan URL
Title: #veiligheid
Search URL Search Domain Scan URL
Title: #rabobank
Search URL Search Domain Scan URL
Title: #missie
Search URL Search Domain Scan URL
Title: Vraag een nieuwe digipass aan
Search URL Search Domain Scan URL
Title: Bekijk alle veelgestelde vragen over de digipass
Search URL Search Domain Scan URL
Title: Facebook
Search URL Search Domain Scan URL
Title: Twitter
Search URL Search Domain Scan URL
Title: Linkedin
Search URL Search Domain Scan URL
Title: Gebruiksvoorwaarden
Search URL Search Domain Scan URL
Title: Uw privacy
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: Tarievenlijst (PDF)
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://uwservicern.eu/?tzKyEuIyplIXbrzXa=8ikZpTlXeEQ5KypqvWE Page URL
-
https://inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW
HTTP 301
https://inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
uwservicern.eu/ |
126 B 228 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW/ Redirect Chain
|
87 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arm.css
inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW/ |
260 KB 38 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mxui.css
www.rabobank.be/apps/postlogin-be/mxclientsystem/mxui/ui/ |
97 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
widgets.css
www.rabobank.be//apps/postlogin-be/widgets/ |
111 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lib.css
www.rabobank.be/apps/postlogin-be/resources/ |
111 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
www.rabobank.be/apps/postlogin-be/resources/ |
82 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rabobank-check-white-1.svg
www.rabobank.be/.resources/rabobank-be/webresources/img/common/ |
572 B 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rabobank-search.svg
www.rabobank.be/.resources/rabobank-be/webresources/img/common/ |
766 B 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rabobank-menu.svg
www.rabobank.be/.resources/rabobank-be/webresources/img/common/ |
557 B 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rabobank-logo.svg
www.rabobank.be/dam/jcr:3dd45014-2ce3-468c-b049-9df619452322/ |
20 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Login$digipass9_2.png
www.rabobank.be//apps/postlogin-be/img/ |
67 KB 68 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Login$Login_NavigationLayouts_Draft_BE_DP_Login_White.png
www.rabobank.be//apps/postlogin-be/img/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SandyP.png
www.rabobank.be/dam/jcr:c8e32a02-1f4b-4d9d-bad2-9ed83556e588/ |
31 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
IvyM.png
www.rabobank.be/dam/jcr:d58b9cfd-c29a-4cc3-a0da-32fbfc964a0a/ |
32 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rabobank-cookies-white.svg
www.rabobank.be/.resources/rabobank-be/webresources/img/common/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tyxyZhXCkWs
www.youtube-nocookie.com/embed/ Frame FEFB |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tyxyZhXCkWs
www.youtube-nocookie.com/embed/ Frame 4918 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rabobank-arrow.svg
inleverpuntrbnk.icu/img/common/ |
282 B 282 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rabobank-close.svg
inleverpuntrbnk.icu/img/common/ |
282 B 282 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rabobank-arrow.svg
www.rabobank.be/.resources/rabobank-be/webresources/img/common/ |
498 B 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myriadpro-regular-webfont.woff
inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW/ |
22 KB 22 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myriadpro-bold-webfont.woff
inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW/ |
22 KB 22 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myriadpro-light-webfont.woff
inleverpuntrbnk.icu/LHFFDGPOYUTTCCZCZLKGRTWYIITUETERRRW/ |
22 KB 22 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rabobank (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
inleverpuntrbnk.icu
uwservicern.eu
www.rabobank.be
www.youtube-nocookie.com
2001:4de0:ac19::1:b:1b
2a00:1450:4001:81a::200e
2a01:238:20a:202:1148::
88.214.56.9
95.101.46.25
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
10174089010026c10cdfb17bf848d74e5408abbb3ed0d8d06d361a1858de89cd
271ffa3bae84eee178d662f27daafa41d099c47427f9b449e407982c6518c8e1
37b070b36e2e2acfd3f795f7b77821fd8caaf6918b9ce5037ddaa7b1b52231ad
4397d32e821e8562fa6a208393d1c47d9ee07d333c64b3e84e5ab92ee136c004
4ac5fd9f7108fd5b25abecbb873ef285554d5ab8ae5ba0d9e0cf863a4bee22d5
6342bffe43e2d8c9fab3503e7f2f0eb3b0d5c30a74c2c911a72993dd9e7c45ba
951ab1bb50fe72bd4586ae324af2e6444d8878983bd4b37db2badf1cc0804d78
9618bea1aa0ab34b3f3d9607a2071c920c29151168300f3ec977522c41959457
9b0b7e1ec2e1bde8dbf465142c65c35c2795fd95f5a7edacd091fe2b50aa8c76
a242bd104b336cb5312c363a96cef1e751c7b2c3b9b9de0991361d4afc5fdfa9
a775ab8993c591fc06434cba0ec5a296c9f62c60823cc551ae3db5229f4e334e
b44982e5d6f2f86337752c0217d792422ad4178266c29d02c067dc211bfb4368
b5022987c92f476c489a34d392f8dc8cae6b97971ac0be8dab712b2b75c7764b
b8266d9c9eefffb417e537eea269e2f69dac0a5a72dbf547227fdf6c2ec2e876
be94603a044553ba7d9395bda18a782bc7a3fff58a3ccb4a036c4c79f9b9c1b2
ca2ff25afe9ddd9667730a1b0b9a6cb908ec05436943ca1384402626990af959
e150ec1939230da37fefb50a40d8766b38060db920f0823c387e57c8cceca676
e77cdbd21d8b7329c5261bc13752744951caef0009c1ef36e20ecc43183f7dd2
ed54449cd63ec194c3eaecbc5b634843a61dc32236efbbc24483c2a43a332a85
fb0bccc37a1e1032fb54e1cf8f7d8f3b316c38927388cc24dafceb5bae618336