urlscan.io logo urlscan.io
SecurityTrails logo

gapd.ge Open in urlscan Pro
78.46.79.94  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://bit.do/nb38yh
Effective URL: https://gapd.ge/lum/KVK22/
Submission: On October 06 via manual from SG — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 78.46.79.94, located in Germany and belongs to HETZNER-AS, DE. The main domain is gapd.ge.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 9th 2022. Valid for: 3 months.
This is the only time gapd.ge was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Kamer van Koophandel (Government) NL Government (Government)

Domain & IP information

IP Address AS Autonomous System
1 1 23.21.31.78 14618 (AMAZON-AES)
1 104.244.42.133 13414 (TWITTER)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 144.91.97.152 51167 (CONTABO)
1 9 78.46.79.94 24940 (HETZNER-AS)
11 4
1    23.21.31.78 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-21-31-78.compute-1.amazonaws.com
bit.do
1    104.244.42.133 (United States)

ASN13414 (TWITTER, US)
t.co
1    2606:4700:3032::ac43:a24d (United States)

ASN13335 (CLOUDFLARENET, US)
www.vellybellyclub.com
1    144.91.97.152 (Nuremberg, Germany)

ASN51167 (CONTABO, DE)
PTR: vp3001.cloudhostingpk.com
engineeringenterprises.com.pk
9    78.46.79.94 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: s13.proserv.ge
gapd.ge
Apex Domain
Subdomains		 Transfer
9 gapd.ge
gapd.ge
135 KB
1 engineeringenterprises.com.pk
engineeringenterprises.com.pk
349 B
1 vellybellyclub.com
www.vellybellyclub.com
606 B
1 t.co
t.co — Cisco Umbrella Rank: 550
569 B
1 bit.do
bit.do — Cisco Umbrella Rank: 209297
260 B
11 5
Domain Requested by
9 gapd.ge 1 redirects gapd.ge
1 engineeringenterprises.com.pk
1 www.vellybellyclub.com t.co
1 t.co
1 bit.do 1 redirects
11 5

This site contains no links.

Subject Issuer Validity Valid
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-11 -
2023-06-11		 a year crt.sh
www.novostinenanedelke5.engineeringenterprises.com.pk
R3		 2022-10-02 -
2022-12-31		 3 months crt.sh
gapd.ge
cPanel, Inc. Certification Authority		 2022-08-09 -
2022-11-07		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://gapd.ge/lum/KVK22/
Frame ID: A18629947B8BC92132C6A27B1DB09FB6
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

InloggenKVKKVK Werkt voor ondernemers

Page URL History Show full URLs

  1. http://bit.do/nb38yh HTTP 301
    https://t.co/rpga5u4Xub Page URL
  2. https://www.vellybellyclub.com/css/fonts/kvk.php Page URL
  3. https://engineeringenterprises.com.pk/veloair/kvk.php Page URL
  4. https://gapd.ge/lum/KVK22 HTTP 301
    https://gapd.ge/lum/KVK22/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

136 kB
Transfer

413 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://bit.do/nb38yh HTTP 301
    https://t.co/rpga5u4Xub Page URL
  2. https://www.vellybellyclub.com/css/fonts/kvk.php Page URL
  3. https://engineeringenterprises.com.pk/veloair/kvk.php Page URL
  4. https://gapd.ge/lum/KVK22 HTTP 301
    https://gapd.ge/lum/KVK22/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://bit.do/nb38yh HTTP 301
  • https://t.co/rpga5u4Xub

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
rpga5u4Xub
t.co/
Redirect Chain
  • http://bit.do/nb38yh
  • https://t.co/rpga5u4Xub
301 B
569 B 		Document
General
Check archive.org
Download Go to
Full URL
https://t.co/rpga5u4Xub
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private,max-age=300
content-encoding
gzip
content-length
196
content-type
text/html; charset=utf-8
date
Thu, 06 Oct 2022 07:25:53 GMT
expires
Thu, 06 Oct 2022 07:30:54 GMT
perf
7626143928
server
tsa_o
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
be0d7a7136b1c1c97c4afb428b4afb38163665381c91ba6a4963a4b8ae860d4e
x-response-time
109
x-transaction-id
699f5c197538d20b
x-xss-protection
0

Redirect headers

Connection
Keep-Alive
Content-Length
303
Content-Type
text/html; charset=iso-8859-1
Date
Thu, 06 Oct 2022 07:25:54 GMT
Keep-Alive
timeout=5, max=100
Location
https://t.co/rpga5u4Xub
Server
Apache/2.4.52 (Ubuntu)
kvk.php
www.vellybellyclub.com/css/fonts/ 		146 B
606 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.vellybellyclub.com/css/fonts/kvk.php
Requested by
Host: t.co
URL: https://t.co/rpga5u4Xub
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:a24d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb1bd044b7c312ad3d29f02e8edf60c77a549871af17b7f357fe125efd7c1913

Request headers

Referer
https://t.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
755caa71dbae90c4-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 06 Oct 2022 07:25:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rn%2F8l6CFt0lCwoZJJ1FpZYetuFGoEqKMTf5LdW8wXu%2BrUxe9bVtBPvPfeDGiUzAKIKWXQY400fr4%2FZIbUDH4tBf1GvdyxPqq2syAI7EP7%2FMTX3MyDbGtDTzjJaEnIVy5yoWKrhV6kEdjtE1S9BglMjo%2FqRez"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,User-Agent
kvk.php
engineeringenterprises.com.pk/veloair/ 		126 B
349 B 		Document
General
Check archive.org
Download Go to
Full URL
https://engineeringenterprises.com.pk/veloair/kvk.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
144.91.97.152 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vp3001.cloudhostingpk.com
Software
LiteSpeed /
Resource Hash

Request headers

Referer
https://www.vellybellyclub.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
106
content-type
text/html; charset=UTF-8
date
Sun, 26 Jun 2022 02:15:01 GMT
server
LiteSpeed
vary
Accept-Encoding
Primary Request /
gapd.ge/lum/KVK22/
Redirect Chain
  • https://gapd.ge/lum/KVK22
  • https://gapd.ge/lum/KVK22/
23 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gapd.ge/lum/KVK22/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
78.46.79.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
s13.proserv.ge
Software
LiteSpeed /
Resource Hash
0a3313917935349a03e5da44c475763a8918d537c203fbcb9e5b07e156a28ea2

Request headers

Referer
https://engineeringenterprises.com.pk/veloair/kvk.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 06 Oct 2022 07:25:58 GMT
server
LiteSpeed
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
707
content-type
text/html
date
Thu, 06 Oct 2022 07:25:57 GMT
location
https://gapd.ge/lum/KVK22/
server
LiteSpeed
main.css
gapd.ge/lum/KVK22/kvk_assetz/css/ 		213 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gapd.ge/lum/KVK22/kvk_assetz/css/main.css
Requested by
Host: gapd.ge
URL: https://gapd.ge/lum/KVK22/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
78.46.79.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
s13.proserv.ge
Software
LiteSpeed /
Resource Hash
7a4b921b2cbe79e46447628543b813097b8e29735d05f3f3daba94a23249ca7e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gapd.ge/lum/KVK22/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 06 Oct 2022 07:25:58 GMT
content-encoding
br
last-modified
Tue, 12 Jul 2022 14:16:28 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
15991
expires
Thu, 13 Oct 2022 07:25:58 GMT
jquery.js
gapd.ge/lum/KVK22/kvk_assetz/js/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gapd.ge/lum/KVK22/kvk_assetz/js/jquery.js
Requested by
Host: gapd.ge
URL: https://gapd.ge/lum/KVK22/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
78.46.79.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
s13.proserv.ge
Software
LiteSpeed /
Resource Hash
7067bf1e1eefc8074780e6ba8c8cddd42a1279eecd53b96c2b58532a8106a9f3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gapd.ge/lum/KVK22/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 06 Oct 2022 07:25:58 GMT
content-encoding
br
last-modified
Tue, 12 Jul 2022 14:16:34 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
30274
expires
Thu, 13 Oct 2022 07:25:58 GMT
misc.js
gapd.ge/lum/KVK22/kvk_assetz/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gapd.ge/lum/KVK22/kvk_assetz/js/misc.js
Requested by
Host: gapd.ge
URL: https://gapd.ge/lum/KVK22/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
78.46.79.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
s13.proserv.ge
Software
LiteSpeed /
Resource Hash
9e412fb77c7c0212a351fe440474eceebf51d3f98733759b31ac6557aeae9db9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gapd.ge/lum/KVK22/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 06 Oct 2022 07:25:58 GMT
content-encoding
br
last-modified
Tue, 12 Jul 2022 14:16:34 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
3336
expires
Thu, 13 Oct 2022 07:25:58 GMT
CiutadellaRounded-SmBd.woff2
gapd.ge/lum/KVK22/kvk_assetz/fonts/ 		35 KB
35 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gapd.ge/lum/KVK22/kvk_assetz/fonts/CiutadellaRounded-SmBd.woff2
Requested by
Host: gapd.ge
URL: https://gapd.ge/lum/KVK22/kvk_assetz/css/main.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
78.46.79.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
s13.proserv.ge
Software
LiteSpeed /
Resource Hash
2ee14c678486082c694e73bbd1553ed2c6198800bb5ca2ef348305dda8f2861c

Request headers

Referer
https://gapd.ge/lum/KVK22/kvk_assetz/css/main.css
Origin
https://gapd.ge
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 06 Oct 2022 07:25:58 GMT
last-modified
Tue, 12 Jul 2022 14:16:32 GMT
server
LiteSpeed
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
36288
expires
Thu, 13 Oct 2022 07:25:58 GMT
roboto-v18-latin-regular.woff2
gapd.ge/lum/KVK22/kvk_assetz/fonts/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gapd.ge/lum/KVK22/kvk_assetz/fonts/roboto-v18-latin-regular.woff2
Requested by
Host: gapd.ge
URL: https://gapd.ge/lum/KVK22/kvk_assetz/css/main.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
78.46.79.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
s13.proserv.ge
Software
LiteSpeed /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Request headers

Referer
https://gapd.ge/lum/KVK22/kvk_assetz/css/main.css
Origin
https://gapd.ge
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 06 Oct 2022 07:25:58 GMT
last-modified
Tue, 12 Jul 2022 14:16:30 GMT
server
LiteSpeed
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
15344
expires
Thu, 13 Oct 2022 07:25:58 GMT
roboto-v18-latin-500.woff2
gapd.ge/lum/KVK22/kvk_assetz/fonts/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gapd.ge/lum/KVK22/kvk_assetz/fonts/roboto-v18-latin-500.woff2
Requested by
Host: gapd.ge
URL: https://gapd.ge/lum/KVK22/kvk_assetz/css/main.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
78.46.79.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
s13.proserv.ge
Software
LiteSpeed /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Request headers

Referer
https://gapd.ge/lum/KVK22/kvk_assetz/css/main.css
Origin
https://gapd.ge
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 06 Oct 2022 07:25:58 GMT
last-modified
Tue, 12 Jul 2022 14:16:30 GMT
server
LiteSpeed
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
15552
expires
Thu, 13 Oct 2022 07:25:58 GMT
roboto-v18-latin-300.woff2
gapd.ge/lum/KVK22/kvk_assetz/fonts/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gapd.ge/lum/KVK22/kvk_assetz/fonts/roboto-v18-latin-300.woff2
Requested by
Host: gapd.ge
URL: https://gapd.ge/lum/KVK22/kvk_assetz/css/main.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
78.46.79.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
s13.proserv.ge
Software
LiteSpeed /
Resource Hash
eca8ffa764a66cd084800e2e71c4176ef089ebd805515664a6cb8d4fb3b598bf

Request headers

Referer
https://gapd.ge/lum/KVK22/kvk_assetz/css/main.css
Origin
https://gapd.ge
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 06 Oct 2022 07:25:58 GMT
last-modified
Tue, 12 Jul 2022 14:16:30 GMT
server
LiteSpeed
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
15440
expires
Thu, 13 Oct 2022 07:25:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Kamer van Koophandel (Government) NL Government (Government)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| $jscomp

1 Cookies

Domain/Path Name / Value
.t.co/ Name: muc
Value: db9a56e0-c75b-4b3b-8eb0-f0155b453881

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0