![](/screenshots/d250a200-2059-4913-a8cc-b151c43837d1.png)
prma.florinamosaics.com
Open in
urlscan Pro
2606:4700:30::681b:b834
Malicious Activity!
Public Scan
Effective URL: https://prma.florinamosaics.com/ac?ab=ZIVwk2xjcmKclbJ5lXKXaIF8YKCDomZmaKZgY34/diane.felicetti%40anz.com
Submission: On December 09 via manual from AU
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 16th 2019. Valid for: a year.
This is the only time prma.florinamosaics.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: KPN (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:30:... 2606:4700:30::6818:7bed | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
10 | 2606:4700:30:... 2606:4700:30::681b:b834 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
3 | 2a00:1450:400... 2a00:1450:4001:825::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2606:4700::68... 2606:4700::6811:4004 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:81b::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 2a00:1450:400... 2a00:1450:4001:818::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
18 | 5 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
trck-earth.hotel-se.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
prma.florinamosaics.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
florinamosaics.com
prma.florinamosaics.com |
547 KB |
4 |
googleapis.com
fonts.googleapis.com ajax.googleapis.com |
31 KB |
3 |
gstatic.com
fonts.gstatic.com |
27 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
6 KB |
1 |
hotel-se.com
1 redirects
trck-earth.hotel-se.com |
274 B |
18 | 5 |
Domain | Requested by | |
---|---|---|
10 | prma.florinamosaics.com |
prma.florinamosaics.com
|
3 | fonts.gstatic.com |
prma.florinamosaics.com
|
3 | fonts.googleapis.com |
prma.florinamosaics.com
|
1 | ajax.googleapis.com |
prma.florinamosaics.com
|
1 | cdnjs.cloudflare.com |
prma.florinamosaics.com
|
1 | trck-earth.hotel-se.com | 1 redirects |
18 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
mtp.capitalrtv.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-11-16 - 2020-10-09 |
a year | crt.sh |
*.googleapis.com GTS CA 1O1 |
2019-11-05 - 2020-01-28 |
3 months | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-12-05 - 2020-06-12 |
6 months | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2019-11-05 - 2020-01-28 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2019-11-05 - 2020-01-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://prma.florinamosaics.com/ac?ab=ZIVwk2xjcmKclbJ5lXKXaIF8YKCDomZmaKZgY34/diane.felicetti%40anz.com
Frame ID: 6DA284F88EE53AF9CBC66BC93F268EFF
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/d250a200-2059-4913-a8cc-b151c43837d1.png)
Page URL History Show full URLs
-
https://trck-earth.hotel-se.com/ga/click/2-16593672-657-6821-13275-13233-42b36c24c5-41a23a1fc6
HTTP 302
https://prma.florinamosaics.com/ac?ab=ZIVwk2xjcmKclbJ5lXKXaIF8YKCDomZmaKZgY34/diane.felicetti%40anz.com Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
animate.css (Web Frameworks) Expand
Detected patterns
- html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i
Detected patterns
- headers server /^cloudflare$/i
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: €1.0095% Verkoop18 op voorraad. Normale prijs: €795Speciale prijs:: €1.00 Klik hier→
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://trck-earth.hotel-se.com/ga/click/2-16593672-657-6821-13275-13233-42b36c24c5-41a23a1fc6
HTTP 302
https://prma.florinamosaics.com/ac?ab=ZIVwk2xjcmKclbJ5lXKXaIF8YKCDomZmaKZgY34/diane.felicetti%40anz.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
ac
prma.florinamosaics.com/ Redirect Chain
|
17 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
prma.florinamosaics.com/allcustomfiles/NL-Kpn-Huawei/ |
147 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/ |
27 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.css
prma.florinamosaics.com/allcustomfiles/NL-Kpn-Huawei/ |
56 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.css
prma.florinamosaics.com/allcustomfiles/NL-Kpn-Huawei/ |
40 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
prma.florinamosaics.com/allcustomfiles/NL-Kpn-Huawei/ |
54 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-kpn.png
prma.florinamosaics.com/allcustomfiles/NL-Kpn-Huawei/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pro2.png
prma.florinamosaics.com/allcustomfiles/NL-Kpn-Huawei/ |
210 KB 211 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logod.png
prma.florinamosaics.com/allcustomfiles/NL-Kpn-Huawei/ |
30 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
secure.png
prma.florinamosaics.com/allcustomfiles/NL-Kpn-Huawei/ |
22 KB 23 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ssdsd.png
prma.florinamosaics.com/allcustomfiles/NL-Kpn-Huawei/ |
232 KB 232 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
24 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: KPN (Telecommunication)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| bootstrap function| chkvali function| partstep function| toSimpleJson function| what function| startTimer1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.florinamosaics.com/ | Name: __cfduid Value: d24aa9b27fb5a36ac660e1a3530826afc1575928496 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
prma.florinamosaics.com
trck-earth.hotel-se.com
2606:4700:30::6818:7bed
2606:4700:30::681b:b834
2606:4700::6811:4004
2a00:1450:4001:818::2003
2a00:1450:4001:81b::200a
2a00:1450:4001:825::200a
0a733c9a259685cf9a9816145434c0087227f35400e16208e7e63e58ccd44538
3f11e0b7103b2cc22803e105a08d47c74aa98356feee908ce4485da393f2c494
4cbc94391087ccc51ebc4609f3aaad484a8f22671ed597f0d3722cc5f5a9e915
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
59a1460df6cb458204ec993345ff4964fa7e1a77da4ab7137e50fce8434c1d6a
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8d6f77ea09a3b11e719a6b67bac0a714a3230259e586460b5dafae2f891ce437
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
aa12b41eecf25f266fec77432d82c44fb1b08b69c047e4e75c6c103afdca76ce
aebf611c1438dc7ec748e9a6364c734066b34bf2a1c7e2fc6511ed784635b50e
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bf6ce3a4c60d008b86d1f9ba3ffa62a3fafe92dc0c8b06126fc528569d8dc18d
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
df3a4f2d89f476c0c7d80ac7ab134a48b75e147cfd5394a0ae75ddcb2e461c32
eb795deda8983fa5310627c9584cf3f3b95d272567113500059018b3941cb267
ec45377469b91a93d9698a569dca5228d8dc62022d27c2695edba9c66be899f6