knab-online-omgeving.ml Open in urlscan Pro
89.203.249.195 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://x.co/Knabonline
Effective URL:
https://knab-online-omgeving.ml/84Rncs/
Submission: On March 15 via manual (March 15th 2019, 1:59:31 pm UTC) from EU

Summary HTTP 4 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 89.203.249.195, located in Czech Republic and belongs to CDT-AS The Czech Republic, CZ. The main domain is knab-online-omgeving.ml.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 14th 2019. Valid for: 3 months.

This is the only time knab-online-omgeving.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Knab (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	45.40.140.1 45.40.140.1	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
1 2	89.203.249.195 89.203.249.195	25512 (CDT-AS Th...) (CDT-AS The Czech Republic)
1	212.113.71.41 212.113.71.41	9166 (CEGEKA-HA...) (CEGEKA-HASSELT)
1		() ()
4	4

2 45.40.140.1 (Scottsdale, United States) 2 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-140-1.ip.secureserver.net

x.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 89.203.249.195 (Czech Republic) 1 redirects

ASN25512 (CDT-AS The Czech Republic, CZ)
PTR: 195-249-203-89.hicoria.com

knab-online-omgeving.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.113.71.41 (European Union)

ASN9166 (CEGEKA-HASSELT, BE)

persoonlijk.knab.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 (None, )

ASN- ()

knab-online-omgeving.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	knab-online-omgeving.ml 1 redirects knab-online-omgeving.ml	423 KB
2	x.co 2 redirects x.co	297 B
1	knab.nl persoonlijk.knab.nl	4 KB
4	3

	Domain	Requested by
3	knab-online-omgeving.ml	1 redirects knab-online-omgeving.ml
2	x.co	2 redirects
1	persoonlijk.knab.nl	knab-online-omgeving.ml
4	3

This site contains links to these domains. Also see Links.

Domain
www.knab.nl
persoonlijk.knab.nl
crowdfunding.knab.nl
mijn-hypotheek.knab.nl
community.knab.nl

Subject Issuer	Validity	Valid
knab-online-omgeving.ml Let's Encrypt Authority X3	`2019-03-14` - `2019-06-12`	3 months	crt.sh
persoonlijk.knab.nl DigiCert SHA2 Extended Validation Server CA	`2018-12-06` - `2019-12-11`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://knab-online-omgeving.ml/84Rncs/
Frame ID: FF9D25846A78CAB8AA3300C828926675
Requests: 10 HTTP requests in this frame

Frame: data://truncated
Frame ID: 0681072FC30320E8ACE5A118B0D2F35B
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://x.co/Knabonline HTTP 301
https://x.co/Knabonline HTTP 302
https://knab-online-omgeving.ml/84Rncs HTTP 301
https://knab-online-omgeving.ml/84Rncs/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

426 kB
Transfer

1152 kB
Size

1
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://www.knab.nl/cookies
Title: Lees meer over Knab Cookies

Search URL Search Domain Scan URL

URL: https://www.knab.nl/

Search URL Search Domain Scan URL

URL: https://persoonlijk.knab.nl/inloggen
Title: Bankieren

Search URL Search Domain Scan URL

URL: https://crowdfunding.knab.nl/
Title: Crowdfunding

Search URL Search Domain Scan URL

URL: https://mijn-hypotheek.knab.nl/login
Title: Hypotheken

Search URL Search Domain Scan URL

URL: https://www.knab.nl/knab-lab/inloggen-met-qr
Title: Meer weten?

Search URL Search Domain Scan URL

URL: https://persoonlijk.knab.nl/problemen-met-inloggen?s=0
Title: Gebruikersnaam vergeten?

Search URL Search Domain Scan URL

URL: https://persoonlijk.knab.nl/problemen-met-inloggen?s=1
Title: Wachtwoord vergeten?

Search URL Search Domain Scan URL

URL: https://www.knab.nl/pakketten
Title: Klant worden

Search URL Search Domain Scan URL

URL: https://community.knab.nl/
Title: Ga naar Community

Search URL Search Domain Scan URL

URL: https://persoonlijk.knab.nl/
Title: https://persoonlijk.knab.nl

Search URL Search Domain Scan URL

URL: https://www.knab.nl/hypotheken/login
Title: https://www.knab.nl/hypotheken/login

Search URL Search Domain Scan URL

URL: https://www.knab.nl/verzekeren
Title: https://www.knab.nl/verzekeren

Search URL Search Domain Scan URL

URL: https://www.knab.nl/veiligheid/phishing
Title: phishing

Search URL Search Domain Scan URL

URL: https://www.knab.nl/veiligheid
Title: Veiligheid

Search URL Search Domain Scan URL

URL: https://www.knab.nl/privacybeleid
Title: Privacybeleid

Search URL Search Domain Scan URL

URL: https://www.knab.nl/belangenbeleid
Title: Belangenbeleid

Search URL Search Domain Scan URL

URL: https://www.knab.nl/disclaimer
Title: Disclaimer

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://x.co/Knabonline HTTP 301
https://x.co/Knabonline HTTP 302
https://knab-online-omgeving.ml/84Rncs HTTP 301
https://knab-online-omgeving.ml/84Rncs/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response knab-online-omgeving.ml/84Rncs/ Redirect Chain http://x.co/Knabonline https://x.co/Knabonline https://knab-online-omgeving.ml/84Rncs https://knab-online-omgeving.ml/84Rncs/	969 KB 422 KB	115ms 65ms	Document text/html	89.203.249.195 CDT-AS The Czech ...
General Check archive.org Show headers Download Go to Full URL https://knab-online-omgeving.ml/84Rncs/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 89.203.249.195 , Czech Republic, ASN25512 (CDT-AS The Czech Republic, CZ), Reverse DNS 195-249-203-89.hicoria.com Software nginx / PHP/5.6.40 Resource Hash `f67e82411a158e0c0f8c31fb001c189b77d2af0e8736dfc854a8efd268d709ca` Request headers Host knab-online-omgeving.ml Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Server nginx Date Fri, 15 Mar 2019 13:59:12 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 X-Powered-By PHP/5.6.40 Set-Cookie PHPSESSID=3t7agu5e6a3k82vq10lt8jk6s3; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Content-Encoding gzip Redirect headers Server nginx Date Fri, 15 Mar 2019 13:59:12 GMT Content-Type text/html; charset=iso-8859-1 Content-Length 247 Connection keep-alive Keep-Alive timeout=60 Location https://knab-online-omgeving.ml/84Rncs/
GET DATA	200 OK	truncated / Frame 0681	0 0	-1ms 0ms	Document text/html
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5928c97026def18dc5daf9a9543788354c8c13ef4fc9c18adb9d8625cb1dba5d` Request headers Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ac310ba76c3354ed3719a670fd40a9179f94d27ad3b919df3dd4c8aaa34241c6` Request headers Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `147e54f3581b17fcfd41fcc404db23e77af1753d2e3d34eb15312879e226d711` Request headers Response headers Content-Type image/png
GET H/1.1	200 OK	inloggen persoonlijk.knab.nl/	0 4 KB	264ms 114ms	Image text/html	212.113.71.41 CEGEKA-HASSELT
General Check archive.org Show headers Download Go to Show image Full URL https://persoonlijk.knab.nl/inloggen Requested by Host: knab-online-omgeving.ml URL: https://knab-online-omgeving.ml/84Rncs/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.113.71.41 , European Union, ASN9166 (CEGEKA-HASSELT, BE), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://persoonlijk.knab.nl/inloggen User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers
GET DATA	200 OK	truncated /	36 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d8fdc34c97e5bc4bca88fc56f60a770119a523dba93b527de4ce660b71a9218d` Request headers Response headers Content-Type image/png
GET DATA	200 OK	truncated /	69 KB 0		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `cee852a289f91d3aebd04518f90fc53600aa36ffcb771de53a6f0e20d89685a6` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin https://knab-online-omgeving.ml Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	24 KB 0		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4475aa0cb79a663b402f491a265fa958a4746e40289ac536e79d136ffd94a7b3` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin https://knab-online-omgeving.ml Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	20 KB 0		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `27f71debda1c93697ba870a3c534f3c35cd19b7be19ff87d212b0a95fad740b2` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin https://knab-online-omgeving.ml Response headers Content-Type application/font-woff2
GET BLOB	200 OK	9acc2b24-7ecf-4a5a-8f3f-a957c78a6ace https://knab-online-omgeving.ml/	24 KB 0		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL blob:https://knab-online-omgeving.ml/9acc2b24-7ecf-4a5a-8f3f-a957c78a6ace Requested by Host: knab-online-omgeving.ml URL: https://knab-online-omgeving.ml/84Rncs/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash `969df28933cad5c85b94bc2014bfb4228a5e4f6dc46394a179b7f2978a124de7` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin https://knab-online-omgeving.ml Response headers Content-Length 24416 Content-Type application/font-woff2
GET BLOB	200 OK	c13eb676-6b0d-4a77-b8c9-f95672e5b120 Show response https://knab-online-omgeving.ml/ Frame 0681	905 B 0	-1ms 0ms	Document text/html
General Check archive.org Show headers Download Go to Full URL blob:https://knab-online-omgeving.ml/c13eb676-6b0d-4a77-b8c9-f95672e5b120 Requested by Host: knab-online-omgeving.ml URL: https://knab-online-omgeving.ml/84Rncs/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash `e227a0639c01e84c77372aa84095d4e452733af0032bbf0670d624dd3e6d8e2c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Content-Length 905 Content-Type text/html;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Knab (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| savepage_PageLoader

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			knab-online-omgeving.ml/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3t7agu5e6a3k82vq10lt8jk6s3

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

knab-online-omgeving.ml
persoonlijk.knab.nl
x.co

212.113.71.41
45.40.140.1
89.203.249.195
147e54f3581b17fcfd41fcc404db23e77af1753d2e3d34eb15312879e226d711
27f71debda1c93697ba870a3c534f3c35cd19b7be19ff87d212b0a95fad740b2
4475aa0cb79a663b402f491a265fa958a4746e40289ac536e79d136ffd94a7b3
5928c97026def18dc5daf9a9543788354c8c13ef4fc9c18adb9d8625cb1dba5d
969df28933cad5c85b94bc2014bfb4228a5e4f6dc46394a179b7f2978a124de7
ac310ba76c3354ed3719a670fd40a9179f94d27ad3b919df3dd4c8aaa34241c6
cee852a289f91d3aebd04518f90fc53600aa36ffcb771de53a6f0e20d89685a6
d8fdc34c97e5bc4bca88fc56f60a770119a523dba93b527de4ce660b71a9218d
e227a0639c01e84c77372aa84095d4e452733af0032bbf0670d624dd3e6d8e2c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f67e82411a158e0c0f8c31fb001c189b77d2af0e8736dfc854a8efd268d709ca

knab-online-omgeving.ml Open in urlscan Pro 89.203.249.195 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

50 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

426 kBTransfer

1152 kBSize

1 Cookies

18 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

knab-online-omgeving.ml Open in urlscan Pro
89.203.249.195 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

426 kB
Transfer

1152 kB
Size

1
Cookies

4 HTTP transactions
8 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!