nordvpn.legal
127.0.0.1  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
URL:
https://nordvpn.legal/ 7mo old
Submission: On December 12 via manual (December 12th 2025, 7:19:14 am UTC) from BE — Scanned from UN
Summary HTTP 15 Redirects Links 27  Behaviour Indicators
Similar DOM Content API
Verdicts 1

Summary

This website contacted 2 IPs in 0 countries across 2 domains to perform 15 HTTP transactions. The main IP is 127.0.0.1, located in and belongs to . The main domain is nordvpn.legal. 7mo old
TLS certificate: Issued by WE1 on December 11th 2025. Valid for: 3mo.
This is the only time nordvpn.legal was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
15 127.0.0.1 127.0.0.1 () ()
15 2
Apex Domain
Subdomains		 Transfer
12 nordvpn.legal
nordvpn.legal 7mo old
37 MB
3 nordcdn.com
ic.nordcdn.com — Cisco Umbrella Rank: 489228 3yr old
sb.nordcdn.com — Cisco Umbrella Rank: 211895 2yr old
171 KB
15 2
Domain Requested by
12 nordvpn.legal nordvpn.legal
2 ic.nordcdn.com nordvpn.legal
1 sb.nordcdn.com nordvpn.legal
15 3
Subject Issuer Validity Valid
nordvpn.legal
WE1		 2025-12-11 -
2026-03-11		 3mo crt.sh
*.nordcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2025-03-21 -
2026-04-20		 1yr crt.sh

This page contains 1 frames:

Primary Page: https://nordvpn.legal/
Frame ID: 8D8DA772F26715E1B229CDF130D1F69A
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Лучший VPN-сервис для выхода в свободный открытый Интернет | NordVPN

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

0
Countries

38461 kB
Transfer

94873 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
15 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H2 		200
 Primary Request /
nordvpn.legal/ 		14 MB
6 MB 		2370ms
1083ms 		Document
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
9acb73d7b85d271b-AMS
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 12 Dec 2025 07:19:16 GMT
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=sASqCAfpRm4gJGiebvjIGNuvsAqC8F7VQHRl9e%2FJqKw805AglCHDn9vRk5mcff7t1XEgA8qhkg4emU7ucHwRxm9GaNgpQMmpyuPK6%2BE%3D"}]}
server
cloudflare
vary
accept-encoding
x-content-type-options
nosniff
GET
H2 		200
 sendEvent.hGbqZlcJ.js Show response
nordvpn.legal/ 		14 MB
6 MB 		446ms
445ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/sendEvent.hGbqZlcJ.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
140e63f7751ad451a62a646fcb318030dda2955430e918000c8b1080e5b81ca5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XJPybIKI%2BMt0ZlWznRXflm3Xv7X3wUFAW%2BZJO8V85IuP84Fgi97lyEqb%2BO1OZtOB5f8XQfqSqqdXeqRl93Ca8t1Ncr5MT3d5nLNrfsc%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dc69cf271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
H2 		200
 countdown.DbWkrb_l.js Show response
nordvpn.legal/ 		14 MB
6 MB 		446ms
445ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/countdown.DbWkrb_l.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
140e63f7751ad451a62a646fcb318030dda2955430e918000c8b1080e5b81ca5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tCwDrcpwSPm1MoVvTmJjSJcuusXuboDw3SDMMSDy5Zf0nE5wBWk3pkrTg9v%2FRKyXEEqlKWqtYqD%2BDnCKYS7tXB%2B%2BAqBqNxfeGbY5E4U%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dc69d0271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
H2 		200
 getCookieValue.BAKycxQw.js Show response
nordvpn.legal/ 		14 MB
6 MB 		445ms
445ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/getCookieValue.BAKycxQw.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
140e63f7751ad451a62a646fcb318030dda2955430e918000c8b1080e5b81ca5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4c99m%2FpBr0v9KrheVFusuEQnqOFDjd9fgIZt8dpoMQHtLLwVkWMbrp%2BJh46na6c0sSMQX3Nsp6BE8OvvEJYfHcaLORp5RetDG0dscW0%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dc69d2271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
H2 		200
 extractGAExtraParams.RnrmQpu1.js Show response
nordvpn.legal/ 		14 MB
6 MB 		450ms
450ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/extractGAExtraParams.RnrmQpu1.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
140e63f7751ad451a62a646fcb318030dda2955430e918000c8b1080e5b81ca5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QINdqtvWjjvlbPNjeyayCzqghva5dyYrlwqEcZ0OLf3aVgLnMgLTKGJZp8f014Soh8ue%2ButdfypLlrDO2XiaYzTzD40%2F2yUQy0KV"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dc69d3271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
H2 		200
 getSectionInfo.CLG3Ul3K.js Show response
nordvpn.legal/ 		14 MB
6 MB 		467ms
467ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/getSectionInfo.CLG3Ul3K.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
140e63f7751ad451a62a646fcb318030dda2955430e918000c8b1080e5b81ca5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cKBm7z%2F55pysX6b8r2diuAe3A1Mf%2BH%2F6FOsDtEgeSrwI0XCfFdgn4wxPH2AJFqMHjV%2B7AT7MD1MAdGRwMEYFos6N2X8PtP5g83DG4tY%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dc69d6271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
DATA 		200
OK 		truncated
/ 		35 KB
35 KB 		Font
font/woff2
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6250ca680d25b93eed3874f28a5461554864837a0cb4064f474345c726e4940d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer

Response headers

Content-Type
font/woff2
GET
DATA 		200
OK 		truncated
/ 		47 KB
47 KB 		Font
font/woff2
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bfa3b1d8b0510f07632687a860506525e182a125202d91267c259b41c97387fc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer

Response headers

Content-Type
font/woff2
GET
DATA 		200
OK 		truncated
/ 		46 KB
46 KB 		Font
font/woff2
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a0d4014da01587c20fa3e21856c7be931f3cfed9bc9c6c1b80ce840e8478c29f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer

Response headers

Content-Type
font/woff2
GET
DATA 		200
OK 		truncated
/ 		81 B
0 		Image
image/png
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5e89879184510e91e477d41c61bd86a0e9209e9ecc17909a7b0ee20427950cbc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
H2 		200
 hero-phone-mockup-country-protected-xs-ru
ic.nordcdn.com/v1/fr_auto/https://sb.nordcdn.com/transform/92942723-fa3e-4f01-9b3b-795148f8565a/ 		20 KB
21 KB 		535ms
230ms 		Image
image/avif		 127.0.0.1
General
Check archive.org
Download Go to Show image
Full URL
https://ic.nordcdn.com/v1/fr_auto/https://sb.nordcdn.com/transform/92942723-fa3e-4f01-9b3b-795148f8565a/hero-phone-mockup-country-protected-xs-ru?X-Nord-Credential=T4PcHqfACi8Naxvulzf4IE8XT4oypRTi0blOOGwbK2A8L4fcPw52k3qkvbkYH&X-Nord-Signature=Xlu4uPcdHeUW2iN65DHiXItIMdaoXGVV7mTnmAm2rm4%3D
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
a634e5cfbcd8579ffac79c02e1361a7cc9c60a7810f7703248a64ced014aeccc
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer
https://nordvpn.legal/

Response headers

cf-cache-status
HIT
age
36367
x-content-type-options
nosniff
alt-svc
h2="cflarexljc3rw355ysrkrzwapozws6nre6xsy3n4yrj7taye3uiby3ad.onion:443"; ma=86400; persist=1
x-cache
Hit from cloudfront
x-amz-cf-id
mi24Zi793An1OC9DjYNngjmQn5Sm5YzQVjVZ1_F67TVYmHYYZik1FA==
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
image/avif
content-disposition
inline; filename="hero-phone-mockup-country-protected-xs-ru.avif"; filename*=UTF-8''hero-phone-mockup-country-protected-xs-ru.avif
vary
Accept-Encoding
last-modified
Thu, 11 Dec 2025 21:13:10 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-api-correlation-id
eb53f8af-3ac9-ddc2-4767-587b5655e860
cache-control
public, max-age=900, s-maxage=15552000
cross-origin-resource-policy
cross-origin
referrer-policy
strict-origin-when-cross-origin
via
1.1 96e04892ec84a7161914f66c3ba3b5f0.cloudfront.net (CloudFront)
cf-ray
9acb73dfaeba312a-AMS
permissions-policy
camera=(), geolocation=(), microphone=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
20721
x-amz-cf-pop
AMS1-P2
server
cloudflare
GET
H2 		200
 sendTracyEvent.BZv1oxuM.js
nordvpn.legal/ 		5 MB
0 		443ms
442ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/sendTracyEvent.BZv1oxuM.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=7K%2BIMVnmTdcyqBv%2FVZDRHqmVxb1%2Bgia%2FbfToZFu34qNw88biY9569Zswy1xliXDtj5w0vgyqNDm9TtovpYcLuKOWssvSAXITt8zWn9c%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dd9c0d271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
H2 		200
 getExperiments.DVPwXb_5.js
nordvpn.legal/ 		1 MB
0 		863ms
862ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/getExperiments.DVPwXb_5.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XqIJpn%2FSzaIbaDzKwddynsOc4Jp6hZGcM7p0HlSn36mgMFCpaJJ6Q4sDibR2Agba%2BnCueMu3747pmNiydYStdPDFf6MNVZxGH5%2FlKhQ%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dd9c10271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
H2 		200
 constants.CbK-wHoG.js
nordvpn.legal/ 		442 KB
0 		583ms
582ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/constants.CbK-wHoG.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=dyBZOsmr4V0%2FBCd%2FeQiLMC4Kw1StWndWRECiHLLzyvtnk1iScvnBkD9U8X06BcX8YXDSxxTWiKNm5QVBUvXvvjBcjTO8cvTnoeOCpxg%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dd9c11271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
H2 		200
 isFlagAttributeEnabled.DpKWbKea.js
nordvpn.legal/ 		0
0 		646ms
645ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/isFlagAttributeEnabled.DpKWbKea.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=zD1oo%2F6VN8i0X9xDr9cZnwf5b9nQSLYvx7hNQujGIGc4MajY%2BKVnWTLWm%2Fm43X1ZgzlyJLyqF1hxF1gsHbAmASepwzKAInHpLkgHRqk%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dd9c15271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
H2 		200
 throttle.DFVxsWuD.js
nordvpn.legal/ 		0
0 		582ms
582ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/throttle.DFVxsWuD.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=EPTeK%2BjDKYYtjAW4n1DkRWQYUhZqnIN%2BdzGo3NG9NJm4GF7EfFT2fA%2Fikg6siBavJt3j0Jm0ctfsyEoTpi2mBizqvCGnQYHi73WRQtQ%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73dd9c18271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
DATA 		200
OK 		truncated
/ 		36 KB
36 KB 		Font
font/woff2
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cb5f5d326746c11d69cfe75553143d4c8fc16a6fd6a37b8c3512a052d495c6b6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer

Response headers

Content-Type
font/woff2
GET
DATA 		200
OK 		truncated
/ 		48 KB
48 KB 		Font
font/woff2
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b4840e726f8e67c89719e4acbfbc16f451b41d34756f66a53ece93363c24e4eb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer

Response headers

Content-Type
font/woff2
GET
DATA 		200
OK 		truncated
/ 		34 KB
34 KB 		Font
font/woff2
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2c855e062fd1233429c8f27968360cf4881ec4ee5bc0952f116ef4237c8b9078

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer

Response headers

Content-Type
font/woff2
GET
DATA 		200
OK 		truncated
/ 		5 KB
5 KB 		Image
image/svg+xml
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e54401b124c1b99cf035eda772c8296b9fc8008513d0757a1a9e7496e837fe8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA 		200
OK 		truncated
/ 		489 B
489 B 		Image
image/svg+xml
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93880800ff162fdddf69e7b200c893ea722c585ed854904c267207d80496ff22

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA 		200
OK 		truncated
/ 		534 B
534 B 		Image
image/svg+xml
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
77f61360e030dc0fdd490c7786a2d40197585f9851ae416ed0b8c6f704da2fc6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA 		200
OK 		truncated
/ 		534 B
534 B 		Image
image/svg+xml
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
456ec8305fbcc27c0b6123b3555d8a3e836fc2f761211e973a566d6d484cec5a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA 		200
OK 		truncated
/ 		534 B
534 B 		Image
image/svg+xml
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
012b85f5d4ad9e4c104b92d82276fb341e97db250f6bf44a54e6d6469f1b8a5b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA 		200
OK 		truncated
/ 		489 B
489 B 		Image
image/svg+xml
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24a0d87a2d409f632cc7acfc8fdd0b50d8ae682315207260f6791ba95fd2a540

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA 		200
OK 		truncated
/ 		489 B
489 B 		Image
image/svg+xml
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b9c9ce7cb3b007bf7740c40e7b3e0e215ccdc11b540138ff148306361e08eb2f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA 		200
OK 		truncated
/ 		1 KB
1 KB 		Image
image/svg+xml
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a302a48527fb5724b70c4bf0a8b0459d0da766db821b68eacfdbc5f4793f80a1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
H2 		200
 CardGrid-Flags
ic.nordcdn.com/v1/fr_auto/https://sb.nordcdn.com/transform/07baa1ee-26be-48aa-90fa-d1128ca2cba5/ 		7 KB
7 KB 		326ms
188ms 		Image
image/avif		 127.0.0.1
General
Check archive.org
Download Go to Show image
Full URL
https://ic.nordcdn.com/v1/fr_auto/https://sb.nordcdn.com/transform/07baa1ee-26be-48aa-90fa-d1128ca2cba5/CardGrid-Flags?X-Nord-Credential=T4PcHqfACi8Naxvulzf4IE8XT4oypRTi0blOOGwbK2A8L4fcPw52k3qkvbkYH&X-Nord-Signature=MJu9dRxlJZ2sAzmS178ka%2BOcRDvIhzAX2QXCCAYzzac%3D
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
d54f8f448ed78490f4a13fc40ecee22c1938f6d2c8e9864d2316a4460ad000b3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer
https://nordvpn.legal/

Response headers

cf-cache-status
HIT
age
79573
x-content-type-options
nosniff
alt-svc
h2="cflare2nge4h4yqr3574crrd7k66lil3torzbisz6uciyuzqc2h2ykyd.onion:443"; ma=86400; persist=1
x-cache
Hit from cloudfront
x-amz-cf-id
rpgecSUfErOo2K-D75mYwZvRA-5jXYPyi8675940OUIfdyHE9icS8Q==
date
Fri, 12 Dec 2025 07:19:17 GMT
content-type
image/avif
content-disposition
inline; filename="CardGrid-Flags.avif"; filename*=UTF-8''CardGrid-Flags.avif
vary
Accept-Encoding
last-modified
Thu, 11 Dec 2025 09:13:04 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-api-correlation-id
7e56000a-8169-b034-d2c7-8683ba72c362
cache-control
public, max-age=900, s-maxage=15552000
cross-origin-resource-policy
cross-origin
referrer-policy
strict-origin-when-cross-origin
via
1.1 db3ad39d2b444e5c9e38affc6638a5cc.cloudfront.net (CloudFront)
cf-ray
9acb73dfaec0312a-AMS
permissions-policy
camera=(), geolocation=(), microphone=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
6970
x-amz-cf-pop
AMS1-P2
server
cloudflare
GET
H2 		200
 js.cookie.bUZaaO7_.js
nordvpn.legal/ 		0
0 		566ms
566ms 		Script
text/html		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://nordvpn.legal/js.cookie.bUZaaO7_.js
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Origin
https://nordvpn.legal
Referer
https://nordvpn.legal/

Response headers

link
<https://s1.nordcdn.com/>; rel="preconnect", <https://ic.nordcdn.com/>; rel="preconnect"
cache-control
public, max-age=14400, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
cf-cache-status
MISS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=t1Zmw%2Bgf8xcJ8UWGgjd78U2%2FckTcszqzwkKdPL%2BVqSMqgJLNjC%2FgfmeJGfXi8ttoERowPFHNJCtlPgacx1dQaMMs8VINXQX513BZgMo%3D"}]}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
9acb73f02b06271b-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 12 Dec 2025 07:19:20 GMT
content-type
text/html; charset=utf-8
vary
accept-encoding
server
cloudflare
GET
H2 		200
 en-woff2 Show response
sb.nordcdn.com/m/4a802a49d4592056/original/ 		188 KB
143 KB 		443ms
107ms 		XHR
text/plain		 127.0.0.1
General
Check archive.org
Download Go to
Full URL
https://sb.nordcdn.com/m/4a802a49d4592056/original/en-woff2
Requested by
Host: nordvpn.legal
URL: https://nordvpn.legal/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
127.0.0.1 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
e8b5a4392d9fbfe8ff6f036b321cdd6db4cff8d577f92185e6462b93b92cabc6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referer
https://nordvpn.legal/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
age
33309
x-content-type-options
nosniff
alt-svc
h2="cflarexljc3rw355ysrkrzwapozws6nre6xsy3n4yrj7taye3uiby3ad.onion:443"; ma=86400; persist=1
x-cache
Hit from cloudfront
x-amz-cf-id
yvBObKLYubIiB3MBDd2TZkujMVws1UMd2azy8fClEvEJtZ1EcIUwgw==
date
Fri, 12 Dec 2025 07:19:22 GMT
content-type
text/plain; charset=UTF-8
content-disposition
inline; filename="en-woff2.css"; filename*=UTF-8''en-woff2.css
vary
accept-encoding
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-api-correlation-id
bb5e84bc-ef36-0acc-be56-118e66853853
cache-control
public, max-age=900, s-maxage=86400, stale-while-revalidate=600, stale-if-error=3600
cross-origin-resource-policy
cross-origin
referrer-policy
strict-origin-when-cross-origin
via
1.1 8f4bc83dd77c2931f6260310f57dde66.cloudfront.net (CloudFront)
cf-ray
9acb73fb8f8a9deb-AMS
permissions-policy
camera=(), geolocation=(), microphone=()
access-control-allow-origin
*
x-amz-cf-pop
AMS1-P2
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Malicious page.url
Submitted on December 12th 2025, 7:21:12 am UTC — From Belgium

Threats: Malware Phishing
Comment: This site is a phishing for the brand of NordVPN and also delivers Malware application

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

19 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| __nord_domainList string| __nord_collectorUrl string| __nord_country object| tcQueue function| tcSendEvent object| tcConfig object| __nord_utils boolean| __nord_enableCookieConsentEvents boolean| __nord_isCookieConsentGA4TrackingEnabled object| consent object| Astro object| _$HY object| google_tag_manager object| google_tag_data object| dataLayer function| __nord_util_getCookieDomain object| __cfBeacon object| _sentryDebugIds string| _sentryDebugIdIdentifier

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
.nordvpn.legal/ 1970-01-21
10:35:28 		Name: font-css-en
Value: true

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
javascript error URL: https://nordvpn.legal/sendEvent.hGbqZlcJ.js
Message:
Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "text/html". Strict MIME type checking is enforced for module scripts per HTML spec.
javascript error URL: https://nordvpn.legal/countdown.DbWkrb_l.js
Message:
Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "text/html". Strict MIME type checking is enforced for module scripts per HTML spec.
javascript error URL: https://nordvpn.legal/getCookieValue.BAKycxQw.js
Message:
Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "text/html". Strict MIME type checking is enforced for module scripts per HTML spec.
javascript error URL: https://nordvpn.legal/extractGAExtraParams.RnrmQpu1.js
Message:
Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "text/html". Strict MIME type checking is enforced for module scripts per HTML spec.
javascript error URL: https://nordvpn.legal/getSectionInfo.CLG3Ul3K.js
Message:
Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "text/html". Strict MIME type checking is enforced for module scripts per HTML spec.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff