![](/screenshots/80efef23-ac7e-4a7c-8692-26c41dd43c6e.png)
shop.rodselect.com
Open in
urlscan Pro
148.72.30.30
Malicious Activity!
Public Scan
Effective URL: https://shop.rodselect.com/lfap/ingnl/clients/AzESRg.php?verification
Submission: On December 20 via manual from IE — Scanned from FR
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 18th 2021. Valid for: 3 months.
This is the only time shop.rodselect.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 13.36.152.171 13.36.152.171 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 97.79.236.50 97.79.236.50 | 11427 (TWC-11427...) (TWC-11427-TEXAS) | |
1 7 | 148.72.30.30 148.72.30.30 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
2 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:82a::2003 | 15169 (GOOGLE) (GOOGLE) | |
15 | 6 |
ASN16509 (AMAZON-02, US)
PTR: ec2-13-36-152-171.eu-west-3.compute.amazonaws.com
vinci.commander1.com |
ASN11427 (TWC-11427-TEXAS, US)
PTR: gvo23650.gvodatacenter.com
faresbless.com |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-148-72-30-30.ip.secureserver.net
shop.rodselect.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
rodselect.com
1 redirects
shop.rodselect.com |
22 KB |
3 |
gstatic.com
fonts.gstatic.com |
92 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com |
358 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net |
47 KB |
2 |
commander1.com
2 redirects
vinci.commander1.com |
2 KB |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
faresbless.com
1 redirects
faresbless.com |
113 B |
15 | 8 |
Domain | Requested by | |
---|---|---|
7 | shop.rodselect.com |
1 redirects
shop.rodselect.com
|
3 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | cdnjs.cloudflare.com |
shop.rodselect.com
|
2 | cdn.jsdelivr.net |
shop.rodselect.com
|
2 | vinci.commander1.com | 2 redirects |
1 | fonts.googleapis.com |
shop.rodselect.com
|
1 | code.jquery.com |
shop.rodselect.com
|
1 | faresbless.com | 1 redirects |
15 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
shop.rodselect.com cPanel, Inc. Certification Authority |
2021-12-18 - 2022-03-18 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-03 - 2022-07-02 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://shop.rodselect.com/lfap/ingnl/clients/AzESRg.php?verification
Frame ID: C2887A70F38ED9ECC020A50D2D7E9480
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/80efef23-ac7e-4a7c-8692-26c41dd43c6e.png)
Page Title
Log in bij Mijn INGPage URL History Show full URLs
-
https://vinci.commander1.com/c3/?tcs=4278&chn=email&src=digitalisme&cmp=multiprogrammes_idf_relance&med=&...
HTTP 302
https://vinci.commander1.com/c3/?firsttime=1&tcs=4278&chn=email&src=digitalisme&cmp=multiprogrammes_idf_r... HTTP 302
https://faresbless.com/rte/ HTTP 302
https://shop.rodselect.com/lfap/ingnl/?pwd=ing HTTP 302
https://shop.rodselect.com/lfap/ingnl/clients/AzESRg.php?verification Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://vinci.commander1.com/c3/?tcs=4278&chn=email&src=digitalisme&cmp=multiprogrammes_idf_relance&med=&pub=&crtive=&vson=desktop_mobile&fmt=&adgrp=&aff_id=&aff_name=MEC_RP_INV&url=https%3A%2F%2Ffaresbless.com%2Frte%2F
HTTP 302
https://vinci.commander1.com/c3/?firsttime=1&tcs=4278&chn=email&src=digitalisme&cmp=multiprogrammes_idf_relance&med=&pub=&crtive=&vson=desktop_mobile&fmt=&adgrp=&aff_id=&aff_name=MEC_RP_INV&url=https%3A%2F%2Ffaresbless.com%2Frte%2F HTTP 302
https://faresbless.com/rte/ HTTP 302
https://shop.rodselect.com/lfap/ingnl/?pwd=ing HTTP 302
https://shop.rodselect.com/lfap/ingnl/clients/AzESRg.php?verification Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
AzESRg.php
shop.rodselect.com/lfap/ingnl/clients/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ |
157 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.css
shop.rodselect.com/lfap/ingnl/assets/css/ |
41 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
shop.rodselect.com/lfap/ingnl/assets/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
shop.rodselect.com/lfap/ingnl/assets/imgs/ |
11 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-right.png
shop.rodselect.com/lfap/ingnl/assets/imgs/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/ |
82 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/js/ |
1 MB 355 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.payment.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.payment/3.0.0/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
shop.rodselect.com/lfap/ingnl/assets/js/ |
2 KB 730 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4iCv6KVjbNBYlgoCjC3jsGyN.woff2
fonts.gstatic.com/s/ubuntu/v15/ |
29 KB 30 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4iCs6KVjbNBYlgoKfw72.woff2
fonts.gstatic.com/s/ubuntu/v15/ |
33 KB 34 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4iCv6KVjbNBYlgoCxCvjsGyN.woff2
fonts.gstatic.com/s/ubuntu/v15/ |
28 KB 28 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome boolean| isShift string| seperator string| space string| dash function| pasnummer function| ValidateDateFormat function| date7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.vinci.commander1.com/ | Name: tc_cj_v2 Value: %20%28%7B%24%27ZZZ~%24%22%24%2F%7B%27%24.%28%20ZZZKPNJJJQSMKJJJZZZ%5Dfc%5De |
|
.vinci.commander1.com/ | Name: tc_cj_v2_cmp Value: %280%27%2F%24%2B-%2A%22-%7B%28%28%20.y%24~%21y-%20%27%7B%29%7D%20 |
|
.commander1.com/ | Name: TCID Value: 202112201445316624142987 |
|
.vinci.commander1.com/ | Name: TCSESSION Value: 202112201445312283472664 |
|
.vinci.commander1.com/ | Name: TCREDIRECT Value: 1 |
|
.vinci.commander1.com/ | Name: TCREDIRECT_DEDUP Value: 1 |
|
shop.rodselect.com/ | Name: PHPSESSID Value: ab189d47c75499763aafdc198af1786d |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
faresbless.com
fonts.googleapis.com
fonts.gstatic.com
shop.rodselect.com
vinci.commander1.com
13.36.152.171
148.72.30.30
2001:4de0:ac18::1:a:3b
2606:4700::6810:135e
2606:4700::6810:5814
2a00:1450:4001:827::200a
2a00:1450:4001:82a::2003
97.79.236.50
045469f2d577c2ad73219bbd713640bcb4a4f9a46cecc6c0df0e66338646b27f
0ba0cb79860de62017722d524674c9443dc04f82fa668eefc1cb223f621129af
20a3ef6979bbe5e4de1afaecc703e1d34cbc5e3ceab36d378539506327692d72
4f4524f7e1a87079bc50a64681f880ccf3e6f5db1ec5fc27949377532a3881da
61dc7482beb9a3f7d24f8c1f362e1e12f7b940ea8e4ea1563fe8112edb615341
6c4ba1c662b440b3aefe5e5147ea2df72f80e510e4979c65485a7b0fff894e37
8439d6ffd7fc019e697dc969e9b374775a15e4acff6df57ee0f6de75087774d2
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
97d812da07c2319e0e64c4137b33a5d3ccfb4c06fa5ab4444f522959e27a9ed0
a0292a8c09e1fce610b74d6781bd7246a98781117dff45376a56c88af5766482
af62f396aa28ee283736cb82218c4369957c5d285a89f51178072abf0285db63
ddf6cf2cec2105ac8d61de4d9477ad53354b764cfa3e99b9f51c5cc9c5984a25
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765