web06.whitelabeldomein.nl Open in urlscan Pro
2a09:8b00:300:10::10 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sal30.com/UCdIpm
Effective URL:
http://web06.whitelabeldomein.nl/~meteorau/quotas/
Submission Tags: phishing malicious Search All
Submission: On December 14 via api (December 14th 2021, 9:11:14 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 2a09:8b00:300:10::10, located in Alkmaar, Netherlands and belongs to INFRABLOCKS, NL. The main domain is web06.whitelabeldomein.nl.

This is the only time web06.whitelabeldomein.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
2 2	171.22.27.11 171.22.27.11	60631 (PARVASYSTEM) (PARVASYSTEM)
1 10	2a09:8b00:300... 2a09:8b00:300:10::10	38913 (INFRABLOCKS) (INFRABLOCKS)
9	1

2 171.22.27.11 (Iran, Islamic Republic Of) 2 redirects

ASN60631 (PARVASYSTEM, IR)
PTR: s204.bitcommand.com

sal30.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a09:8b00:300:10::10 (Alkmaar, Netherlands) 1 redirects

ASN38913 (INFRABLOCKS, NL)

web06.whitelabeldomein.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	whitelabeldomein.nl 1 redirects web06.whitelabeldomein.nl	81 KB
2	sal30.com 2 redirects sal30.com	247 B
9	2

	Domain	Requested by
10	web06.whitelabeldomein.nl	1 redirects web06.whitelabeldomein.nl
2	sal30.com	2 redirects
9	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://web06.whitelabeldomein.nl/~meteorau/quotas/
Frame ID: 6B1C6D9717F5F92CB45B6C92ACD42A26
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in to your PayPal account

Page URL History Show full URLs

https://sal30.com/UCdIpm HTTP 301
https://sal30.com/UCdIpm/ HTTP 302
https://web06.whitelabeldomein.nl/~meteorau/quotas HTTP 301
http://web06.whitelabeldomein.nl/~meteorau/quotas/ Page URL

Page Statistics

9
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

81 kB
Transfer

357 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sal30.com/UCdIpm HTTP 301
https://sal30.com/UCdIpm/ HTTP 302
https://web06.whitelabeldomein.nl/~meteorau/quotas HTTP 301
http://web06.whitelabeldomein.nl/~meteorau/quotas/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response web06.whitelabeldomein.nl/~meteorau/quotas/ Redirect Chain https://sal30.com/UCdIpm https://sal30.com/UCdIpm/ https://web06.whitelabeldomein.nl/~meteorau/quotas http://web06.whitelabeldomein.nl/~meteorau/quotas/	2 KB 1 KB	33ms 18ms	Document text/html	2a09:8b00:300:10::10 INFRABLOCKS
General Check archive.org Show headers Download Go to Full URL http://web06.whitelabeldomein.nl/~meteorau/quotas/ Protocol HTTP/1.1 Server 2a09:8b00:300:10::10 Alkmaar, Netherlands, ASN38913 (INFRABLOCKS, NL), Reverse DNS Software nginx / Resource Hash `237f09f4eebe3558881c1cd60d6be39b452edacdd3062756e365248b2dc286b8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server nginx Date Tue, 14 Dec 2021 21:11:09 GMT Content-Type text/html; charset=UTF-8 Content-Length 854 Connection keep-alive Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Upgrade h2,h2c Vary Accept-Encoding,User-Agent Content-Encoding gzip Redirect headers server nginx date Tue, 14 Dec 2021 21:11:09 GMT content-type text/html; charset=iso-8859-1 content-length 258 location http://web06.whitelabeldomein.nl/~meteorau/quotas/
GET H/1.1	200 OK	bootstrap.css web06.whitelabeldomein.nl/~meteorau/quotas/css/	188 KB 25 KB	20ms 19ms	Stylesheet text/css	2a09:8b00:300:10::10 INFRABLOCKS
General Check archive.org Show headers Download Go to Full URL http://web06.whitelabeldomein.nl/~meteorau/quotas/css/bootstrap.css Requested by Host: web06.whitelabeldomein.nl URL: http://web06.whitelabeldomein.nl/~meteorau/quotas/ Protocol HTTP/1.1 Server 2a09:8b00:300:10::10 Alkmaar, Netherlands, ASN38913 (INFRABLOCKS, NL), Reverse DNS Software nginx / Resource Hash `0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334` Request headers Accept-Language de-DE,de;q=0.9 Referer http://web06.whitelabeldomein.nl/~meteorau/quotas/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 21:11:09 GMT Content-Encoding gzip Last-Modified Thu, 09 Dec 2021 09:52:34 GMT Server nginx ETag "2f1f7-5d2b390d4de65-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection keep-alive Accept-Ranges bytes Content-Type text/css Content-Length 24828
GET H/1.1	200 OK	test.css web06.whitelabeldomein.nl/~meteorau/quotas/css/	9 KB 3 KB	31ms 16ms	Stylesheet text/css	2a09:8b00:300:10::10 INFRABLOCKS
General Check archive.org Show headers Download Go to Full URL http://web06.whitelabeldomein.nl/~meteorau/quotas/css/test.css Requested by Host: web06.whitelabeldomein.nl URL: http://web06.whitelabeldomein.nl/~meteorau/quotas/ Protocol HTTP/1.1 Server 2a09:8b00:300:10::10 Alkmaar, Netherlands, ASN38913 (INFRABLOCKS, NL), Reverse DNS Software nginx / Resource Hash `e6602477df053a5024319eb9ea148c1f1e260b1ef0a20961f02fd7f96f9a1217` Request headers Accept-Language de-DE,de;q=0.9 Referer http://web06.whitelabeldomein.nl/~meteorau/quotas/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 21:11:09 GMT Content-Encoding gzip Last-Modified Thu, 09 Dec 2021 09:52:34 GMT Server nginx ETag "25bc-5d2b390d4de65-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection keep-alive Accept-Ranges bytes Content-Type text/css Content-Length 2460
GET H/1.1	200 OK	html5shiv.min.js Show response web06.whitelabeldomein.nl/~meteorau/quotas/js/	3 KB 2 KB	30ms 15ms	Script application/javascript	2a09:8b00:300:10::10 INFRABLOCKS
General Check archive.org Show headers Download Go to Full URL http://web06.whitelabeldomein.nl/~meteorau/quotas/js/html5shiv.min.js Requested by Host: web06.whitelabeldomein.nl URL: http://web06.whitelabeldomein.nl/~meteorau/quotas/ Protocol HTTP/1.1 Server 2a09:8b00:300:10::10 Alkmaar, Netherlands, ASN38913 (INFRABLOCKS, NL), Reverse DNS Software nginx / Resource Hash `dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48` Request headers Accept-Language de-DE,de;q=0.9 Referer http://web06.whitelabeldomein.nl/~meteorau/quotas/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 21:11:09 GMT Content-Encoding gzip Last-Modified Thu, 09 Dec 2021 09:52:34 GMT Server nginx ETag "aaa-5d2b390d4f1ed-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection keep-alive Accept-Ranges bytes Content-Type application/javascript Content-Length 1348
GET H/1.1	200 OK	respond.min.js Show response web06.whitelabeldomein.nl/~meteorau/quotas/js/	4 KB 2 KB	31ms 16ms	Script application/javascript	2a09:8b00:300:10::10 INFRABLOCKS
General Check archive.org Show headers Download Go to Full URL http://web06.whitelabeldomein.nl/~meteorau/quotas/js/respond.min.js Requested by Host: web06.whitelabeldomein.nl URL: http://web06.whitelabeldomein.nl/~meteorau/quotas/ Protocol HTTP/1.1 Server 2a09:8b00:300:10::10 Alkmaar, Netherlands, ASN38913 (INFRABLOCKS, NL), Reverse DNS Software nginx / Resource Hash `1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e` Request headers Accept-Language de-DE,de;q=0.9 Referer http://web06.whitelabeldomein.nl/~meteorau/quotas/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 21:11:09 GMT Content-Encoding gzip Last-Modified Thu, 09 Dec 2021 09:52:34 GMT Server nginx ETag "11f1-5d2b390d4f5d5-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection keep-alive Accept-Ranges bytes Content-Type application/javascript Content-Length 2218
GET H/1.1	200 OK	logo.png web06.whitelabeldomein.nl/~meteorau/quotas/image/	2 KB 2 KB	16ms 16ms	Image image/png	2a09:8b00:300:10::10 INFRABLOCKS
General Check archive.org Show headers Download Go to Show image Full URL http://web06.whitelabeldomein.nl/~meteorau/quotas/image/logo.png Requested by Host: web06.whitelabeldomein.nl URL: http://web06.whitelabeldomein.nl/~meteorau/quotas/ Protocol HTTP/1.1 Server 2a09:8b00:300:10::10 Alkmaar, Netherlands, ASN38913 (INFRABLOCKS, NL), Reverse DNS Software nginx / Resource Hash `8ac5189e7fc963521f8e3b891b3f65937c2aedd88a321ba60d89e9e7d40c404a` Request headers Accept-Language de-DE,de;q=0.9 Referer http://web06.whitelabeldomein.nl/~meteorau/quotas/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 21:11:09 GMT Last-Modified Thu, 09 Dec 2021 09:52:34 GMT Server nginx ETag "6be-5d2b390d4ea1d" Upgrade h2,h2c Connection keep-alive Accept-Ranges bytes Content-Type image/png Content-Length 1726
GET H/1.1	200 OK	jquery-3.5.1.min.js Show response web06.whitelabeldomein.nl/~meteorau/quotas/js/	87 KB 31 KB	19ms 19ms	Script application/javascript	2a09:8b00:300:10::10 INFRABLOCKS
General Check archive.org Show headers Download Go to Full URL http://web06.whitelabeldomein.nl/~meteorau/quotas/js/jquery-3.5.1.min.js Requested by Host: web06.whitelabeldomein.nl URL: http://web06.whitelabeldomein.nl/~meteorau/quotas/ Protocol HTTP/1.1 Server 2a09:8b00:300:10::10 Alkmaar, Netherlands, ASN38913 (INFRABLOCKS, NL), Reverse DNS Software nginx / Resource Hash `f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d` Request headers Accept-Language de-DE,de;q=0.9 Referer http://web06.whitelabeldomein.nl/~meteorau/quotas/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 21:11:09 GMT Content-Encoding gzip Last-Modified Thu, 09 Dec 2021 09:52:34 GMT Server nginx ETag "15d84-5d2b390d4f5d5-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection keep-alive Accept-Ranges bytes Content-Type application/javascript Content-Length 30910
GET H/1.1	200 OK	bootstrap.min.js Show response web06.whitelabeldomein.nl/~meteorau/quotas/js/	61 KB 16 KB	17ms 17ms	Script application/javascript	2a09:8b00:300:10::10 INFRABLOCKS
General Check archive.org Show headers Download Go to Full URL http://web06.whitelabeldomein.nl/~meteorau/quotas/js/bootstrap.min.js Requested by Host: web06.whitelabeldomein.nl URL: http://web06.whitelabeldomein.nl/~meteorau/quotas/ Protocol HTTP/1.1 Server 2a09:8b00:300:10::10 Alkmaar, Netherlands, ASN38913 (INFRABLOCKS, NL), Reverse DNS Software nginx / Resource Hash `2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9` Request headers Accept-Language de-DE,de;q=0.9 Referer http://web06.whitelabeldomein.nl/~meteorau/quotas/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 21:11:09 GMT Content-Encoding gzip Last-Modified Thu, 09 Dec 2021 09:52:34 GMT Server nginx ETag "f3cb-5d2b390d4f1ed-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection keep-alive Accept-Ranges bytes Content-Type application/javascript Content-Length 16021
GET H/1.1	200 OK	test.js Show response web06.whitelabeldomein.nl/~meteorau/quotas/js/	0 280 B	15ms 15ms	Script application/javascript	2a09:8b00:300:10::10 INFRABLOCKS
General Check archive.org Show headers Download Go to Full URL http://web06.whitelabeldomein.nl/~meteorau/quotas/js/test.js Requested by Host: web06.whitelabeldomein.nl URL: http://web06.whitelabeldomein.nl/~meteorau/quotas/ Protocol HTTP/1.1 Server 2a09:8b00:300:10::10 Alkmaar, Netherlands, ASN38913 (INFRABLOCKS, NL), Reverse DNS Software nginx / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer http://web06.whitelabeldomein.nl/~meteorau/quotas/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 14 Dec 2021 21:11:09 GMT Last-Modified Thu, 09 Dec 2021 09:52:34 GMT Server nginx ETag "0-5d2b390d4f5d5" Vary User-Agent Upgrade h2,h2c Connection keep-alive Accept-Ranges bytes Content-Type application/javascript Content-Length 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			web06.whitelabeldomein.nl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 5a4a9cee31c6067e1949450052b3f1bd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sal30.com
web06.whitelabeldomein.nl
171.22.27.11
2a09:8b00:300:10::10
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334
1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e
237f09f4eebe3558881c1cd60d6be39b452edacdd3062756e365248b2dc286b8
2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9
8ac5189e7fc963521f8e3b891b3f65937c2aedd88a321ba60d89e9e7d40c404a
dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6602477df053a5024319eb9ea148c1f1e260b1ef0a20961f02fd7f96f9a1217
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

web06.whitelabeldomein.nl Open in urlscan Pro 2a09:8b00:300:10::10 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

0 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

81 kBTransfer

357 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

Indicators

web06.whitelabeldomein.nl Open in urlscan Pro
2a09:8b00:300:10::10 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

81 kB
Transfer

357 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!