Submitted URL: https://webmail.zyza-workshops.nl/
Effective URL: https://mail.doelbewust.nl/appsuite/
Submission Tags: phishingrod
Submission: On October 26 via api from DE — Scanned from NL

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 5.61.248.167, located in Lelystad, Netherlands and belongs to NL-BIT BIT BV, NL. The main domain is mail.doelbewust.nl.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on August 3rd 2022. Valid for: a year.
This is the only time mail.doelbewust.nl was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2001:1af8:470... 60781 (LEASEWEB-...)
11 5.61.248.167 12859 (NL-BIT BI...)
12 3
Apex Domain
Subdomains
Transfer
11 doelbewust.nl
mail.doelbewust.nl
479 KB
1 zyza-workshops.nl
webmail.zyza-workshops.nl
396 B
12 2
Domain Requested by
11 mail.doelbewust.nl mail.doelbewust.nl
1 webmail.zyza-workshops.nl
12 2

This site contains links to these domains. Also see Links.

Domain
www.open-xchange.com
Subject Issuer Validity Valid
webmail.zyza-workshops.nl
R3
2022-08-26 -
2022-11-24
3 months crt.sh
mail.doelbewust.nl
Sectigo RSA Organization Validation Secure Server CA
2022-08-03 -
2023-08-31
a year crt.sh

This page contains 1 frames:

Primary Page: https://mail.doelbewust.nl/appsuite/
Frame ID: 44826B20358FA98848F75CA21AF33A9D
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

Sign in - OX App Suite

Page URL History Show full URLs

  1. https://webmail.zyza-workshops.nl/ Page URL
  2. https://mail.doelbewust.nl/appsuite/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • backbone.*\.js

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

480 kB
Transfer

1509 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://webmail.zyza-workshops.nl/ Page URL
  2. https://mail.doelbewust.nl/appsuite/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
webmail.zyza-workshops.nl/
207 B
396 B
Document
General
Full URL
https://webmail.zyza-workshops.nl/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:1af8:4700:a121:6::1 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
Apache /
Resource Hash
74a60e04f620399c2c55113148317cd9c8a1c46555141b25956b65ba3ea770e9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
Keep-Alive
Content-Length
207
Content-Type
text/html; charset=UTF-8
Date
Wed, 26 Oct 2022 00:02:58 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Primary Request /
mail.doelbewust.nl/appsuite/
11 KB
4 KB
Document
General
Full URL
https://mail.doelbewust.nl/appsuite/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
464155d054873052594866701defe9d6ec73fb63b87e4294610a626d1f36d192
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://webmail.zyza-workshops.nl/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=0
content-encoding
gzip
content-length
3775
content-type
text/html
date
Wed, 26 Oct 2022 00:02:58 GMT
etag
"2b22-5e5562d72ce00-gzip"
expires
Wed, 26 Oct 2022 00:02:58 GMT
last-modified
Wed, 03 Aug 2022 13:26:16 GMT
server
Apache/2
vary
Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
login.css
mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/apps/themes/login/
45 KB
10 KB
Stylesheet
General
Full URL
https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/apps/themes/login/login.css
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
40cde2b23cf6de36838e0778ab5c9a1d7304e7ceca6db02174329783d0b6f6b1
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://mail.doelbewust.nl/appsuite/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
x-frame-options
SAMEORIGIN
vary
User-Agent
content-type
text/css
cache-control
max-age=15552000, private
accept-ranges
bytes
content-length
9625
expires
Mon, 24 Apr 2023 00:02:58 GMT
boot.js
mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/
700 KB
194 KB
Script
General
Full URL
https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/boot.js
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
f6f31fb2a3b627a0d57cb065d2b1c50da68c1de506dac93699bfe59fdab95722
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://mail.doelbewust.nl/appsuite/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
x-frame-options
SAMEORIGIN
vary
User-Agent
content-type
application/javascript
cache-control
max-age=15552000, private
accept-ranges
bytes
expires
Mon, 24 Apr 2023 00:02:58 GMT
precore.js
mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/
638 KB
184 KB
Script
General
Full URL
https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/precore.js
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
1be89945178afb2a1d5d5189ac1ea182a9d254c73c65db86943e21e71f83b2f9
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://mail.doelbewust.nl/appsuite/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
x-frame-options
SAMEORIGIN
vary
User-Agent
content-type
application/javascript
cache-control
max-age=15552000, private
accept-ranges
bytes
expires
Mon, 24 Apr 2023 00:02:58 GMT
fontawesome-webfont.woff2
mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/apps/3rd.party/font-awesome/fonts/
75 KB
76 KB
Font
General
Full URL
https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/apps/3rd.party/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/apps/themes/login/login.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/apps/themes/login/login.css
Origin
https://mail.doelbewust.nl
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
x-frame-options
SAMEORIGIN
vary
User-Agent
cache-control
max-age=15552000, private
accept-ranges
bytes
expires
Mon, 24 Apr 2023 00:02:58 GMT
dropdown.js
mail.doelbewust.nl/appsuite/api/apps/load/7.10.6-16.20220803.010615,io.ox/backbone/mini-views/
9 KB
3 KB
XHR
General
Full URL
https://mail.doelbewust.nl/appsuite/api/apps/load/7.10.6-16.20220803.010615,io.ox/backbone/mini-views/dropdown.js
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/boot.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
525a183cea5f32a00dc31c53184b519f1516f5088b04fd9cb90e5d0b3aad6188

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://mail.doelbewust.nl/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
text/javascript;charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-robots-tag
none
content-length
3052
expires
Sun, 08 Oct 2023 05:22:58 GMT
a11y.js
mail.doelbewust.nl/appsuite/api/apps/load/7.10.6-16.20220803.010615,io.ox/backbone/mini-views/abstract.js,io.ox/core/
9 KB
3 KB
XHR
General
Full URL
https://mail.doelbewust.nl/appsuite/api/apps/load/7.10.6-16.20220803.010615,io.ox/backbone/mini-views/abstract.js,io.ox/core/a11y.js
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/boot.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
709f1a218cabaf979da2749dfe8a15f4ac9639c400bec8f4ff7e8a2d45da6d7d

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://mail.doelbewust.nl/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
text/javascript;charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-robots-tag
none
content-length
2973
expires
Sun, 08 Oct 2023 05:22:58 GMT
manifests
mail.doelbewust.nl/appsuite/api/apps/
8 KB
2 KB
XHR
General
Full URL
https://mail.doelbewust.nl/appsuite/api/apps/manifests?action=config&version=7.10.6-16.20220803.010615
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/boot.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
17bf6fb4c5a2335ddb8f204cf22d018e65a7e5c94a31a38aff54e8a18b61ae48

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://mail.doelbewust.nl/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
application/json;charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-robots-tag
none
content-length
1709
expires
Sat, 06 May 1995 12:00:00 GMT
tab.js
mail.doelbewust.nl/appsuite/api/apps/load/7.10.6-16.20220803.010615,io.ox/core/api/
2 KB
1 KB
XHR
General
Full URL
https://mail.doelbewust.nl/appsuite/api/apps/load/7.10.6-16.20220803.010615,io.ox/core/api/tab.js
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/boot.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
a271e97e0dda50737cfb538d3f4654e73a966eef2d55c2ad1da2c1cf65a06428

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://mail.doelbewust.nl/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
text/javascript;charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-robots-tag
none
content-length
1003
expires
Sun, 08 Oct 2023 05:22:58 GMT
communication.js
mail.doelbewust.nl/appsuite/api/apps/load/7.10.6-16.20220803.010615,io.ox/core/tab/handling.js,io.ox/core/tab/session.js,io.ox/core/tab/
9 KB
3 KB
XHR
General
Full URL
https://mail.doelbewust.nl/appsuite/api/apps/load/7.10.6-16.20220803.010615,io.ox/core/tab/handling.js,io.ox/core/tab/session.js,io.ox/core/tab/communication.js
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/boot.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
b03def9f0aa9aa325a32f88a67d0c53b8a155e2b31613d3beeb792ff11cc9bad

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://mail.doelbewust.nl/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
text/javascript;charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-robots-tag
none
content-length
2745
expires
Sun, 08 Oct 2023 05:22:58 GMT
login
mail.doelbewust.nl/appsuite/api/
192 B
367 B
XHR
General
Full URL
https://mail.doelbewust.nl/appsuite/api/login?action=autologin&client=open-xchange-appsuite&rampup=true&rampUpFor=open-xchange-appsuite&version=7.10.6-16
Requested by
Host: mail.doelbewust.nl
URL: https://mail.doelbewust.nl/appsuite/v=7.10.6-16.20220803.010620/boot.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.61.248.167 Lelystad, Netherlands, ASN12859 (NL-BIT BIT BV, NL),
Reverse DNS
dlbwstmail.whih.nl
Software
Apache/2 /
Resource Hash
7e3b4e85a3853b074d30142c25ff049b9f6850570d2d88b87215e5e0a03cb006

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://mail.doelbewust.nl/appsuite/
X-Requested-With
XMLHttpRequest
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Wed, 26 Oct 2022 00:02:58 GMT
content-encoding
gzip
server
Apache/2
vary
Accept-Encoding,User-Agent
content-type
application/json;charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-robots-tag
none
content-length
166
expires
Sat, 06 May 1995 12:00:00 GMT
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
42a46f8200c18143e63437a36d14bf8d2c883367ac948ffb3e2f54435f6e2392

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| path object| ox function| staticGt string| root string| oldRoot function| requirejs function| require function| define object| additionalTimezones object| linkedTimezones undefined| vpRule undefined| dependencies function| $ function| jQuery function| _ object| Backbone function| moment function| jwt_decode function| assert object| html5 object| Modernizr function| isBrowserSupported function| isPlatformSupported function| blankshield

2 Cookies

Domain/Path Name / Value
mail.doelbewust.nl/ Name: url.key
Value: 06128874681504115061288746815041150612887468150411506128874681504115
mail.doelbewust.nl/ Name: locale
Value: en_US