www.kvdrv.nl Open in urlscan Pro
185.27.142.86 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://captainprice-brunofernandes289041.codeanyapp.com/
Effective URL:
https://www.kvdrv.nl/wp-content/languages/home/
Submission: On January 30 via manual (January 30th 2023, 6:46:01 am UTC) from AE — Scanned from DE

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 20 HTTP transactions. The main IP is 185.27.142.86, located in Netherlands and belongs to CLDIN-NL TWS, NL. The main domain is www.kvdrv.nl.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 3rd 2022. Valid for: a year.

This is the only time www.kvdrv.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Emirates Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	198.199.109.95 198.199.109.95	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
16	185.27.142.86 185.27.142.86	48635 (CLDIN-NL TWS) (CLDIN-NL TWS)
4	2606:4700:e2:... 2606:4700:e2::ac40:850f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
20	2

1 198.199.109.95 (San Francisco, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: codeanyproxy.com

captainprice-brunofernandes289041.codeanyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 185.27.142.86 (Netherlands)

ASN48635 (CLDIN-NL TWS, NL)
PTR: srv20286.flexwebhosting.nl

www.kvdrv.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:e2::ac40:850f (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	kvdrv.nl www.kvdrv.nl	200 KB
4	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 850	88 KB
1	codeanyapp.com 1 redirects captainprice-brunofernandes289041.codeanyapp.com	220 B
20	3

	Domain	Requested by
16	www.kvdrv.nl	www.kvdrv.nl
4	use.fontawesome.com	www.kvdrv.nl use.fontawesome.com
1	captainprice-brunofernandes289041.codeanyapp.com	1 redirects
20	3

This site contains no links.

Subject Issuer	Validity	Valid
www.kvdrv.nl Sectigo RSA Domain Validation Secure Server CA	`2022-04-03` - `2023-03-31`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-06` - `2023-06-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.kvdrv.nl/wp-content/languages/home/
Frame ID: 0531DFE3A737925D061AED3A99598AF5
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PayTabs - Simple & Trusted Payments

Page URL History Show full URLs

http://captainprice-brunofernandes289041.codeanyapp.com/ HTTP 302
https://www.kvdrv.nl/wp-content/languages/home/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

288 kB
Transfer

617 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://captainprice-brunofernandes289041.codeanyapp.com/ HTTP 302
https://www.kvdrv.nl/wp-content/languages/home/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.kvdrv.nl/wp-content/languages/home/ Redirect Chain http://captainprice-brunofernandes289041.codeanyapp.com/ https://www.kvdrv.nl/wp-content/languages/home/	6 KB 2 KB	782ms 23ms	Document text/html	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Full URL https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `e5e6871b700d00d994573e1161ebb0c8196b7fe11be373a5dbaa6faa8ff8dbdf` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Length 1903 Content-Type text/html; charset=UTF-8 Date Mon, 30 Jan 2023 06:45:56 GMT Keep-Alive timeout=2, max=100 Server Apache/2 Vary Accept-Encoding,User-Agent Redirect headers Connection keep-alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Mon, 30 Jan 2023 06:27:42 GMT Location https://www.kvdrv.nl/wp-content/languages/home/ Server openresty
GET H/1.1	404 Not Found	font-awesome.css www.kvdrv.nl/wp-content/languages/home/css/	0 0	714ms 713ms	Stylesheet text/html	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Full URL https://www.kvdrv.nl/wp-content/languages/home/css/font-awesome.css Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:56 GMT Content-Encoding gzip Server Apache/2 Vary Accept-Encoding,User-Agent Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <https://www.kvdrv.nl/wp-json/>; rel="https://api.w.org/" Content-Length 15895 Keep-Alive timeout=2, max=99 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	200 OK	paytabs-paypage.css www.kvdrv.nl/wp-content/languages/home/css/	172 KB 27 KB	49ms 20ms	Stylesheet text/css	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Full URL https://www.kvdrv.nl/wp-content/languages/home/css/paytabs-paypage.css Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `8b14bb58b3e9fb84121a99234f98b38b48c94231cd38747d782f2dcd992103f1` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:56 GMT Content-Encoding gzip Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "2ae50-5f33147fc78fb-gzip" Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 27261
GET H2	200	cdf3f5cea3.js Show response use.fontawesome.com/	9 KB 4 KB	248ms 210ms	Script text/javascript	2606:4700:e2::ac40:850f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/cdf3f5cea3.js Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:850f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e7296af2e8b453a986b5855210d9f491fafba1fde986b8053df39a5d399da880` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Mon, 30 Jan 2023 06:45:56 GMT content-encoding br cf-cache-status REVALIDATED last-modified Thu, 01 Jul 2021 15:05:17 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-amz-request-id 4HCKBG039T5CP930 etag W/"94fa0abf8f1c00b61487136489be4585" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r0XyrcKJosSBbk8QWHX%2B4y6ORP1R%2BhVuhgSUvIF8DdwareMRX0ZEQsyRFwGfYuDzRyl4IVKxfWzwN8y5%2B5kXn45oSskVZhwsGqTSF06SvNAwyk1Tx%2Bhwh%2FME1C%2FUSQvRxYfSInqDE37Cyti4MHMFmF73"}],"group":"cf-nel","max_age":604800} content-type text/javascript cache-control max-age=1800 cf-ray 79183f645fe4bb80-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-amz-id-2 ocKcYr2XNgJU0h+u1uu8QFMdIF597awni8wJ9J/5084LoG8TIn+V7yj6TLNHFEBlrJ1YvleTxp/gnLtwIQDJRw==
GET H/1.1	404 Not Found	hpp.css www.kvdrv.nl/wp-content/languages/home/css/	0 0	774ms 746ms	Script text/html	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Full URL https://www.kvdrv.nl/wp-content/languages/home/css/hpp.css Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:56 GMT Content-Encoding gzip Server Apache/2 Vary Accept-Encoding,User-Agent Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <https://www.kvdrv.nl/wp-json/>; rel="https://api.w.org/" Content-Length 15895 Keep-Alive timeout=2, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	200 OK	augh.png www.kvdrv.nl/wp-content/languages/home/css/	17 KB 17 KB	53ms 23ms	Image image/png	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Show image Full URL https://www.kvdrv.nl/wp-content/languages/home/css/augh.png Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `2e6c37dce49aa29359da9f8213274dd675646341fb974561dcd467ad50d65beb` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "42c0-5f33147fc6d43" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 17088
GET H/1.1	200 OK	Card-Visa.svg www.kvdrv.nl/wp-content/languages/home/css/	3 KB 2 KB	51ms 21ms	Image image/svg+xml	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Show image Full URL https://www.kvdrv.nl/wp-content/languages/home/css/Card-Visa.svg Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `b17e54ae153bfdc622f3b2b5238f6b3b392fdf163daa432caef7c91c07498bda` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "b66-5f33147fc712b-gzip" Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 1251
GET H/1.1	200 OK	Card-MasterCard.svg www.kvdrv.nl/wp-content/languages/home/css/	12 KB 4 KB	47ms 17ms	Image image/svg+xml	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Show image Full URL https://www.kvdrv.nl/wp-content/languages/home/css/Card-MasterCard.svg Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `d03e686c6a119aa09d7e08dad100fbcf8092bd4ef3a2a4d43b4c2b122b6ae494` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "301a-5f33147fc712b-gzip" Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 3980
GET H/1.1	200 OK	verified-visa.svg www.kvdrv.nl/wp-content/languages/home/css/	4 KB 2 KB	55ms 24ms	Image image/svg+xml	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Show image Full URL https://www.kvdrv.nl/wp-content/languages/home/css/verified-visa.svg Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `5f7192afa468715d41d6dd2a4d6154025142847175fab6a8f026251517fd9bab` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "1033-5f33147fc78fb-gzip" Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=97 Content-Length 1753
GET H/1.1	200 OK	mc-securecode.svg www.kvdrv.nl/wp-content/languages/home/css/	8 KB 3 KB	19ms 19ms	Image image/svg+xml	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Show image Full URL https://www.kvdrv.nl/wp-content/languages/home/css/mc-securecode.svg Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `b445b7bdc8d7ccf4196df546b3f046684a77d9a3b9ffb2c77dfe450d841a6066` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "203d-5f33147fc7513-gzip" Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 2985
GET H/1.1	200 OK	pci-dss.svg www.kvdrv.nl/wp-content/languages/home/css/	9 KB 4 KB	36ms 19ms	Image image/svg+xml	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Show image Full URL https://www.kvdrv.nl/wp-content/languages/home/css/pci-dss.svg Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `4e9d444a1592ee07f6d1b299c1579837184aea5a44db67edc131fc21c321c01a` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "22b5-5f33147fc78fb-gzip" Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=99 Content-Length 3796
GET H/1.1	200 OK	logo-default.png www.kvdrv.nl/wp-content/languages/home/css/	2 KB 2 KB	39ms 19ms	Image image/png	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Show image Full URL https://www.kvdrv.nl/wp-content/languages/home/css/logo-default.png Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `76f32e93b901db2baf2eb6a076e06538993a11f00ccef643b0eef12abcefa652` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "6ec-5f33147fc7513" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=96 Content-Length 1772
GET H/1.1	200 OK	jquery.js Show response www.kvdrv.nl/wp-content/languages/home/css/	87 KB 31 KB	20ms 20ms	Script application/javascript	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Full URL https://www.kvdrv.nl/wp-content/languages/home/css/jquery.js Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "15d9d-5f33147fc7513-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=99 Content-Length 30902
GET H/1.1	200 OK	bootstrap.js Show response www.kvdrv.nl/wp-content/languages/home/css/	81 KB 22 KB	19ms 18ms	Script application/javascript	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Full URL https://www.kvdrv.nl/wp-content/languages/home/css/bootstrap.js Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `7e02c082fedfc821a8a51fe004dab6896dd928876a21ccac8675142c2e2f7b1f` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "14535-5f33147fc6d43-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=98 Content-Length 22104
GET H/1.1	200 OK	jquery.mask.js Show response www.kvdrv.nl/wp-content/languages/home/css/	23 KB 6 KB	58ms 28ms	Script application/javascript	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Full URL https://www.kvdrv.nl/wp-content/languages/home/css/jquery.mask.js Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Last-Modified Thu, 26 Jan 2023 21:17:50 GMT Server Apache/2 ETag "5a88-5f33147fc7513-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=100 Content-Length 5877
GET H2	200	cdf3f5cea3.css use.fontawesome.com/	1 KB 790 B	214ms 213ms	Stylesheet text/css	2606:4700:e2::ac40:850f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/cdf3f5cea3.css Requested by Host: use.fontawesome.com URL: https://use.fontawesome.com/cdf3f5cea3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:850f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `22a2cf4536052f52cca3b6bb1ffbda538c98611488ad6aafa99fe8ffc5d44ca4` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Mon, 30 Jan 2023 06:45:57 GMT content-encoding br cf-cache-status REVALIDATED last-modified Thu, 01 Jul 2021 15:05:17 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-amz-request-id TT0W3R3AN5FABZDY etag W/"31f9fa0c6b467ea0552433f4657071db" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bH7GJHKjPHEEq%2Bvc6An3ppC3yA61WYsbPjIDDl4A0cxTebf7UtSe1%2F1lgOfiarM3%2FFL908Ea5h3G%2FOa%2BXglFtwGY4HCHV4c%2BPBrI7decYgWZGalzhBcJzdOIMQ3TOBll2KY%2FAOHsl1jmQMX8bDrLFnOc"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=1800 cf-ray 79183f689df9bb80-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-amz-id-2 KnO/BLE2TVVQujUul/MXEcPIw3cqGUiC1mp5O+qpRg+EDNVZFNQEsWXE9YyOQf+XLLpeEdHY0xI=
GET H/1.1	404 Not Found	header.svg www.kvdrv.nl/wp-content/languages/home/images/	39 KB 39 KB	724ms 711ms	Image text/html	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Show image Full URL https://www.kvdrv.nl/wp-content/languages/home/images/header.svg Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/css/paytabs-paypage.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `0b60af67faf116b820265b6e6ed247c8babb6f40a447bbc17326b945bc676ec0` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/css/paytabs-paypage.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Server Apache/2 Vary Accept-Encoding,User-Agent Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <https://www.kvdrv.nl/wp-json/>; rel="https://api.w.org/" Content-Length 15895 Keep-Alive timeout=2, max=99 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	paytabs-logo.svg www.kvdrv.nl/wp-content/languages/home/images/	39 KB 39 KB	726ms 709ms	Image text/html	185.27.142.86 CLDIN-NL TWS
General Check archive.org Show headers Download Go to Show image Full URL https://www.kvdrv.nl/wp-content/languages/home/images/paytabs-logo.svg Requested by Host: www.kvdrv.nl URL: https://www.kvdrv.nl/wp-content/languages/home/css/paytabs-paypage.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.142.86 , Netherlands, ASN48635 (CLDIN-NL TWS, NL), Reverse DNS srv20286.flexwebhosting.nl Software Apache/2 / Resource Hash `0b60af67faf116b820265b6e6ed247c8babb6f40a447bbc17326b945bc676ec0` Request headers accept-language de-DE,de;q=0.9 Referer https://www.kvdrv.nl/wp-content/languages/home/css/paytabs-paypage.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 06:45:57 GMT Content-Encoding gzip Server Apache/2 Vary Accept-Encoding,User-Agent Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <https://www.kvdrv.nl/wp-json/>; rel="https://api.w.org/" Content-Length 15895 Keep-Alive timeout=2, max=99 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H3	200	font-awesome-css.min.css use.fontawesome.com/releases/v4.7.0/css/	30 KB 7 KB	16ms 16ms	Stylesheet text/css	2606:4700:e2::ac40:850f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v4.7.0/css/font-awesome-css.min.css Requested by Host: use.fontawesome.com URL: https://use.fontawesome.com/cdf3f5cea3.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:e2::ac40:850f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350` Request headers accept-language de-DE,de;q=0.9 Referer https://use.fontawesome.com/cdf3f5cea3.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Mon, 30 Jan 2023 06:45:57 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-request-id XR8P559ZYEVRVVKG age 1200623 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-amz-id-2 0pIjxtsYxwyF3r2K2xyIm9aNsx5w0jq9uwnYiZN70ZQymW5HRYiemTCMotwdMtqtyqxzVO3YRAA= last-modified Wed, 30 Jun 2021 15:26:48 GMT server cloudflare etag W/"36082410df2ef7f83932219089dc1443" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pANhI25RNV3ZIGv7vi%2BijTNjt05t5YPB6IPm7bsx5m91WyZC86FjtEVbfoYEZ1WYTh0R0khWSHIojIzgFWG%2Fdq30gWs7wZLzIsP2ky7L2GXqjt8r7bJ%2FwP4dFIwscW%2BvPmzaP0SZU9wxFDuR35oCcLXD"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=31556926 cf-ray 79183f69ed4b8fd0-FRA
GET H3	200	fontawesome-webfont.woff2 use.fontawesome.com/releases/v4.7.0/fonts/	75 KB 76 KB	27ms 16ms	Font application/font-woff2	2606:4700:e2::ac40:850f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v4.7.0/fonts/fontawesome-webfont.woff2 Requested by Host: use.fontawesome.com URL: https://use.fontawesome.com/cdf3f5cea3.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:e2::ac40:850f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe` Request headers Referer https://use.fontawesome.com/cdf3f5cea3.css Origin https://www.kvdrv.nl accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Mon, 30 Jan 2023 06:45:57 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-request-id ARR94CXJVTAXPMEF age 62437 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 77160 x-amz-id-2 8kL8/RiVXJ48LRQVz90vfe2EmXwHeyHwguI5s49FNKIvM/5vC2qyoHGxwiyGxFXxh5Cifa0CCUw= last-modified Wed, 30 Jun 2021 15:26:48 GMT server cloudflare etag "af7ae505a9eed503f8b8e6982036873e" access-control-max-age 3000 access-control-allow-methods GET content-type application/font-woff2 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nTyt8eIc6u5ZvBpx4e%2Fc9kwE2PIbx1wt3KKvy5yqpdzDDrpqz5PeG1n6zV4AfwZEnWlH9Akhtx9MZuAhCJb30ToDre5uykbUmWBx0qjzPwkycMKVu4dDzY0dh66krnEID8CQ4Qq0XaVz9gNyFuu2xtt8"}],"group":"cf-nel","max_age":604800} vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control max-age=31556926 accept-ranges bytes cf-ray 79183f6a1f12696f-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Emirates Post (Transportation)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.kvdrv.nl/wp-content/languages/home/css/font-awesome.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.kvdrv.nl/wp-content/languages/home/css/hpp.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.kvdrv.nl/wp-content/languages/home/images/header.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.kvdrv.nl/wp-content/languages/home/images/paytabs-logo.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

captainprice-brunofernandes289041.codeanyapp.com
use.fontawesome.com
www.kvdrv.nl
185.27.142.86
198.199.109.95
2606:4700:e2::ac40:850f
0b60af67faf116b820265b6e6ed247c8babb6f40a447bbc17326b945bc676ec0
22a2cf4536052f52cca3b6bb1ffbda538c98611488ad6aafa99fe8ffc5d44ca4
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2e6c37dce49aa29359da9f8213274dd675646341fb974561dcd467ad50d65beb
4e9d444a1592ee07f6d1b299c1579837184aea5a44db67edc131fc21c321c01a
5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350
5f7192afa468715d41d6dd2a4d6154025142847175fab6a8f026251517fd9bab
76f32e93b901db2baf2eb6a076e06538993a11f00ccef643b0eef12abcefa652
7e02c082fedfc821a8a51fe004dab6896dd928876a21ccac8675142c2e2f7b1f
8b14bb58b3e9fb84121a99234f98b38b48c94231cd38747d782f2dcd992103f1
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
b17e54ae153bfdc622f3b2b5238f6b3b392fdf163daa432caef7c91c07498bda
b445b7bdc8d7ccf4196df546b3f046684a77d9a3b9ffb2c77dfe450d841a6066
d03e686c6a119aa09d7e08dad100fbcf8092bd4ef3a2a4d43b4c2b122b6ae494
e5e6871b700d00d994573e1161ebb0c8196b7fe11be373a5dbaa6faa8ff8dbdf
e7296af2e8b453a986b5855210d9f491fafba1fde986b8053df39a5d399da880
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.kvdrv.nl Open in urlscan Pro 185.27.142.86 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

288 kBTransfer

617 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

www.kvdrv.nl Open in urlscan Pro
185.27.142.86 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

288 kB
Transfer

617 kB
Size

0
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!