quarantainezone-me.info Open in urlscan Pro
109.203.109.244 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://quarantainezone-me.info/
Effective URL:
https://quarantainezone-me.info/portal/deblokkeren/login.html
Submission: On February 18 via manual (February 18th 2020, 8:26:37 am UTC) from NL

Summary HTTP 25 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 25 HTTP transactions. The main IP is 109.203.109.244, located in Eltham, United Kingdom and belongs to NODE4-AS, GB. The main domain is quarantainezone-me.info.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 17th 2020. Valid for: 3 months.

This is the only time quarantainezone-me.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4 25	109.203.109.244 109.203.109.244	31727 (NODE4-AS) (NODE4-AS)
3	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
25	3

25 109.203.109.244 (Eltham, United Kingdom) 4 redirects

ASN31727 (NODE4-AS, GB)
PTR: host34.theukhost.net

quarantainezone-me.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	quarantainezone-me.info 4 redirects quarantainezone-me.info	213 KB
3	google.be www.google.be
1	jquery.com code.jquery.com	81 KB
25	3

	Domain	Requested by
25	quarantainezone-me.info	4 redirects quarantainezone-me.info code.jquery.com
3	www.google.be	quarantainezone-me.info
1	code.jquery.com	quarantainezone-me.info
25	3

This site contains links to these domains. Also see Links.

Domain
inlogcodes.mijn.ing.nl
aanvragen.ing.nl
www.ing.nl

Subject Issuer	Validity	Valid
quarantainezone-me.info cPanel, Inc. Certification Authority	`2020-02-17` - `2020-05-17`	3 months	crt.sh
*.google.be GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://quarantainezone-me.info/portal/deblokkeren/login.html
Frame ID: 56B9B5A206F10EE1CE099EBC1F490226
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://quarantainezone-me.info/ HTTP 302
https://quarantainezone-me.info/portal/deblokkeren/login.html Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

25
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

293 kB
Transfer

479 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://inlogcodes.mijn.ing.nl/particulier/zelf-regelen/instellen/inlogcodes/index.jsp
Title: Wachtwoord en/of gebruikersnaam vergeten?

Search URL Search Domain Scan URL

URL: https://aanvragen.ing.nl/particulier/aanvragen/aanvraagframe.html
Title: Mijn ING Particulier aanvragen

Search URL Search Domain Scan URL

URL: https://www.ing.nl/zakelijk/internetbankieren/internetbankieren/mijn-ing-zakelijk/mijn-ing-zakelijk-aanvragen/index.html
Title: Mijn ING Zakelijk aanvragen

Search URL Search Domain Scan URL

URL: https://www.ing.nl/particulier/klantenservice/index.html
Title: Contact met ING Particulier

Search URL Search Domain Scan URL

URL: https://www.ing.nl/zakelijk/klantenservice/contact/index.html
Title: Contact met ING Zakelijk

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://quarantainezone-me.info/ HTTP 302
https://quarantainezone-me.info/portal/deblokkeren/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://quarantainezone-me.info/login/assets/images/icons/menu-close.svg HTTP 302
https://www.google.be/404

Request Chain 3

https://quarantainezone-me.info/login/assets/images/illustratie_algemenestoring.png HTTP 302
https://www.google.be/404

Request Chain 4

https://quarantainezone-me.info/login/assets/images/icons/arrow-chevron-open-right.svg HTTP 302
https://www.google.be/404

25 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.html Show response quarantainezone-me.info/portal/deblokkeren/ Redirect Chain https://quarantainezone-me.info/ https://quarantainezone-me.info/portal/deblokkeren/login.html	11 KB 11 KB	43ms 41ms	Document text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2db51e9a091484e01db494aed0096f8af8d91d035c576f5a8c5c5795878e38db` Request headers Host quarantainezone-me.info Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie PHPSESSID=3fodbm07v0uvhc3eug4sugc1h0 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers Date Tue, 18 Feb 2020 08:26:19 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Tue, 18 Feb 2020 08:26:18 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie PHPSESSID=3fodbm07v0uvhc3eug4sugc1h0; path=/ Location /portal/deblokkeren/login.html Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	ing-logo.svg quarantainezone-me.info/public/iznzg/images/svg/	11 KB 12 KB	30ms 29ms	Image image/svg+xml	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Show image Full URL https://quarantainezone-me.info/public/iznzg/images/svg/ing-logo.svg Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `0112b42c9e5b4fd46836aad6ad032bb82cc80af2f4236eaeb39dca8f441e4a87` Request headers Referer https://quarantainezone-me.info/portal/deblokkeren/login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Tue, 18 Feb 2020 08:26:19 GMT Last-Modified Sat, 05 Oct 2019 13:35:51 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 11743
GET H2	404	404 www.google.be/ Redirect Chain https://quarantainezone-me.info/login/assets/images/icons/menu-close.svg https://www.google.be/404	0 0	26ms 5ms	Image text/html	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.be/404 Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://quarantainezone-me.info/portal/deblokkeren/login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:19 GMT Server Apache Content-Type text/html; charset=UTF-8 Location https://www.google.be/404 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	arrow-chevron-open-right.svg quarantainezone-me.info/public/iznzg/images/	366 B 612 B	76ms 26ms	Image image/svg+xml	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Show image Full URL https://quarantainezone-me.info/public/iznzg/images/arrow-chevron-open-right.svg Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `c40c32284db736cf15432a4da1684b391bb82d244589b2001f83a4cbd8e984bb` Request headers Referer https://quarantainezone-me.info/portal/deblokkeren/login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Tue, 18 Feb 2020 08:26:19 GMT Last-Modified Sat, 05 Oct 2019 13:34:53 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 366
GET H2	404	404 www.google.be/ Redirect Chain https://quarantainezone-me.info/login/assets/images/illustratie_algemenestoring.png https://www.google.be/404	0 0	27ms 6ms	Image text/html	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.be/404 Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://quarantainezone-me.info/portal/deblokkeren/login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:19 GMT Server Apache Content-Type text/html; charset=UTF-8 Location https://www.google.be/404 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	404	404 www.google.be/ Redirect Chain https://quarantainezone-me.info/login/assets/images/icons/arrow-chevron-open-right.svg https://www.google.be/404	0 0	26ms 6ms	Image text/html	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.be/404 Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://quarantainezone-me.info/portal/deblokkeren/login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:19 GMT Server Apache Content-Type text/html; charset=UTF-8 Location https://www.google.be/404 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	main.css quarantainezone-me.info/public/iznzg/css/	17 KB 17 KB	58ms 27ms	Stylesheet text/css	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/public/iznzg/css/main.css?rev=0.7.0 Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `705807587659d130661a614c622c2ce3de64412979e83daaaf7ac49a7d913b4a` Request headers Referer https://quarantainezone-me.info/portal/deblokkeren/login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Tue, 18 Feb 2020 08:26:19 GMT Last-Modified Sat, 05 Oct 2019 13:34:50 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 17150
GET H/1.1	200 OK	jquery-3.3.1.min.js Show response quarantainezone-me.info/public/iznzg/js/	85 KB 85 KB	76ms 27ms	Script application/javascript	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/public/iznzg/js/jquery-3.3.1.min.js Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef` Request headers Referer https://quarantainezone-me.info/portal/deblokkeren/login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Tue, 18 Feb 2020 08:26:19 GMT Last-Modified Sat, 05 Oct 2019 13:34:55 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 86927
GET H/1.1	200 OK	jquery-3.4.1.js Show response code.jquery.com/	274 KB 81 KB	36ms 6ms	Script application/javascript	2001:4de0:ac19::1:b:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.js Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55` Request headers Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 18 Feb 2020 08:26:19 GMT Content-Encoding gzip Last-Modified Wed, 01 May 2019 21:14:27 GMT Server nginx ETag W/"5cca0c33-4472c" Vary Accept-Encoding X-HW 1582014379.dop006.fr8.t,1582014379.cds138.fr8.shn,1582014379.cds138.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 82889
GET H/1.1	200 OK	811383197.svg quarantainezone-me.info/public/iznzg/css/css-resources/	21 KB 21 KB	28ms 27ms	Image image/svg+xml	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Show image Full URL https://quarantainezone-me.info/public/iznzg/css/css-resources/811383197.svg Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `3e5c9215408174cff78c491ad0cd933f2cf7c21bdaf61d71abac85e49f901fd2` Request headers Referer https://quarantainezone-me.info/public/iznzg/css/main.css?rev=0.7.0 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Tue, 18 Feb 2020 08:26:19 GMT Last-Modified Sat, 05 Oct 2019 13:35:48 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 21318
GET H/1.1	200 OK	_388920554.woff2 quarantainezone-me.info/public/iznzg/css/css-resources/	29 KB 29 KB	27ms 27ms	Font font/woff2	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/public/iznzg/css/css-resources/_388920554.woff2 Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155` Request headers Referer https://quarantainezone-me.info/public/iznzg/css/main.css?rev=0.7.0 Origin https://quarantainezone-me.info Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 18 Feb 2020 08:26:19 GMT Last-Modified Sat, 05 Oct 2019 13:35:49 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 29616
GET H/1.1	200 OK	1224525800.woff2 quarantainezone-me.info/public/iznzg/css/css-resources/	30 KB 30 KB	39ms 27ms	Font font/woff2	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/public/iznzg/css/css-resources/1224525800.woff2 Requested by Host: quarantainezone-me.info URL: https://quarantainezone-me.info/portal/deblokkeren/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e` Request headers Referer https://quarantainezone-me.info/public/iznzg/css/main.css?rev=0.7.0 Origin https://quarantainezone-me.info Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 18 Feb 2020 08:26:19 GMT Last-Modified Sat, 05 Oct 2019 13:35:47 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 30456
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	0 323 B	40ms 40ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:20 GMT Server Apache Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	0 323 B	45ms 45ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:21 GMT Server Apache Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	0 323 B	71ms 70ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:22 GMT Server Apache Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 536 B	30ms 30ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:23 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=95 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 536 B	34ms 34ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:24 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=94 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 478 B	30ms 30ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:25 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=93 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 478 B	47ms 47ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:26 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=92 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 478 B	46ms 45ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:27 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=91 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 478 B	31ms 31ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:28 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=90 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 536 B	31ms 30ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:29 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=89 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 536 B	31ms 30ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:30 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=88 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 478 B	31ms 30ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:31 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=87 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	heartbeat Show response quarantainezone-me.info/	135 B 478 B	31ms 31ms	XHR text/html	109.203.109.244 NODE4-AS
General Check archive.org Show headers Download Go to Full URL https://quarantainezone-me.info/heartbeat Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.203.109.244 Eltham, United Kingdom, ASN31727 (NODE4-AS, GB), Reverse DNS host34.theukhost.net Software Apache / Resource Hash `2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://quarantainezone-me.info/portal/deblokkeren/login.html Origin https://quarantainezone-me.info X-Requested-With XMLHttpRequest Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 18 Feb 2020 08:26:32 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=86 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			quarantainezone-me.info/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3fodbm07v0uvhc3eug4sugc1h0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
quarantainezone-me.info
www.google.be
109.203.109.244
2001:4de0:ac19::1:b:2a
2a00:1450:4001:806::2003
0112b42c9e5b4fd46836aad6ad032bb82cc80af2f4236eaeb39dca8f441e4a87
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2532c14a0c16c6b27a84088ad55f88f27c81d812d4e7f1526a8018ed2a5099f5
2db51e9a091484e01db494aed0096f8af8d91d035c576f5a8c5c5795878e38db
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e
3e5c9215408174cff78c491ad0cd933f2cf7c21bdaf61d71abac85e49f901fd2
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
705807587659d130661a614c622c2ce3de64412979e83daaaf7ac49a7d913b4a
c40c32284db736cf15432a4da1684b391bb82d244589b2001f83a4cbd8e984bb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155

quarantainezone-me.info Open in urlscan Pro 109.203.109.244 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

25 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

293 kBTransfer

479 kBSize

1 Cookies

5 Outgoing links

Page URL History

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

quarantainezone-me.info Open in urlscan Pro
109.203.109.244 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

293 kB
Transfer

479 kB
Size

1
Cookies

25 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!