urlscan.io logo urlscan.io
SecurityTrails logo

www.security.20-90-74-227.cprapid.com Open in urlscan Pro
20.90.74.227  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Submission: On November 21 via manual from NO — Scanned from NO
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 4 domains to perform 25 HTTP transactions. The main IP is 20.90.74.227, located in London, United Kingdom and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is www.security.20-90-74-227.cprapid.com.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on November 16th 2022. Valid for: 3 months.
This is the only time www.security.20-90-74-227.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

IP Address AS Autonomous System
12 20.90.74.227 8075 (MICROSOFT...)
2 104.22.75.171 13335 (CLOUDFLAR...)
2 51.89.99.21 16276 (OVH)
1 172.64.151.83 13335 (CLOUDFLAR...)
7 67.202.105.32 32748 (STEADFAST)
1 67.202.105.31 32748 (STEADFAST)
25 7
12    20.90.74.227 (London, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.security.20-90-74-227.cprapid.com
2    104.22.75.171 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)
widgets.amung.us
whos.amung.us
2    51.89.99.21 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ns3163187.ip-51-89-99.eu
t.dtscout.com
1    172.64.151.83 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.tynt.com
7    67.202.105.32 (Palos Park, United States)

ASN32748 (STEADFAST, US)
PTR: ip32.67-202-105.static.steadfastdns.net
ic.tynt.com
1    67.202.105.31 (Palos Park, United States)

ASN32748 (STEADFAST, US)
PTR: ip31.67-202-105.static.steadfastdns.net
de.tynt.com
Apex Domain
Subdomains		 Transfer
12 cprapid.com
www.security.20-90-74-227.cprapid.com
84 KB
9 tynt.com
cdn.tynt.com — Cisco Umbrella Rank: 10119
ic.tynt.com — Cisco Umbrella Rank: 6453
de.tynt.com — Cisco Umbrella Rank: 1451
9 KB
2 dtscout.com
t.dtscout.com — Cisco Umbrella Rank: 14449
3 KB
2 amung.us
widgets.amung.us — Cisco Umbrella Rank: 25156
whos.amung.us — Cisco Umbrella Rank: 16679
4 KB
25 4
Domain Requested by
12 www.security.20-90-74-227.cprapid.com www.security.20-90-74-227.cprapid.com
7 ic.tynt.com www.security.20-90-74-227.cprapid.com
2 t.dtscout.com widgets.amung.us
t.dtscout.com
1 de.tynt.com cdn.tynt.com
1 cdn.tynt.com widgets.amung.us
1 whos.amung.us widgets.amung.us
1 widgets.amung.us www.security.20-90-74-227.cprapid.com
25 7

This site contains links to these domains. Also see Links.

Domain
www.nordea.no
nettbanken.nordea.no
nordea.no
Subject Issuer Validity Valid
www.security.20-90-74-227.cprapid.com
ZeroSSL RSA Domain Secure Site CA		 2022-11-16 -
2023-02-14		 3 months crt.sh
*.amung.us
Sectigo RSA Domain Validation Secure Server CA		 2022-05-18 -
2023-06-17		 a year crt.sh
*.dtscout.com
Sectigo RSA Domain Validation Secure Server CA		 2021-10-28 -
2022-11-27		 a year crt.sh
*.tynt.com
Sectigo RSA Domain Validation Secure Server CA		 2022-09-07 -
2023-09-30		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Frame ID: 2A267BD74407A2A3AC4DF0AE03956F0A
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

- Phone

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

25
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

7
Subdomains

7
IPs

3
Countries

99 kB
Transfer

109 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request phone.php
www.security.20-90-74-227.cprapid.com/nordea_no/ 		24 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
b73f03fec5b20ff58446c33bd87626b6c0b1c34297957cd718486e3190d3cadc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
no-NO,no;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Mon, 21 Nov 2022 07:17:18 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
www.security.20-90-74-227.cprapid.com/nordea_no/image/ 		36 KB
36 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
5b0d3bf71a9ae36d04599f18a1ab6656ec0b39e12d1415a61a0612e33771421a

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 21 Nov 2022 07:17:19 GMT
Last-Modified
Mon, 14 Nov 2022 12:33:20 GMT
Server
Apache
Content-Type
text/css
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
36842
Expires
0
bankidno-4ea331ae4c5bc3a12e6cf8340862d4c0.svg
www.security.20-90-74-227.cprapid.com/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/bankidno-4ea331ae4c5bc3a12e6cf8340862d4c0.svg
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
8e983af3546212ed1e62b9c26c00f0f3a4c6fa7c17c9b852cd2910f8b425f8d3

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 21 Nov 2022 07:17:19 GMT
Last-Modified
Mon, 14 Nov 2022 12:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
2837
Expires
0
technical-error-91ca9eec9eed6ed945355d650bb10d41.svg
www.security.20-90-74-227.cprapid.com/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/technical-error-91ca9eec9eed6ed945355d650bb10d41.svg
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 21 Nov 2022 07:17:19 GMT
Last-Modified
Mon, 14 Nov 2022 12:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
2846
Expires
0
something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg
www.security.20-90-74-227.cprapid.com/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 21 Nov 2022 07:17:19 GMT
Last-Modified
Mon, 14 Nov 2022 12:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
3104
Expires
0
cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg
www.security.20-90-74-227.cprapid.com/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 21 Nov 2022 07:17:19 GMT
Last-Modified
Mon, 14 Nov 2022 12:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
3097
Expires
0
no-connection-83f79e2367a313b468986e12a237c346.svg
www.security.20-90-74-227.cprapid.com/nordea_no/image/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/no-connection-83f79e2367a313b468986e12a237c346.svg
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 21 Nov 2022 07:17:19 GMT
Last-Modified
Mon, 14 Nov 2022 12:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=91
Content-Length
4974
Expires
0
empty-3857ebe69f653487f8c9d99adde4657f.svg
www.security.20-90-74-227.cprapid.com/nordea_no/image/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/empty-3857ebe69f653487f8c9d99adde4657f.svg
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 21 Nov 2022 07:17:19 GMT
Last-Modified
Mon, 14 Nov 2022 12:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=90
Content-Length
1642
Expires
0
service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg
www.security.20-90-74-227.cprapid.com/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 21 Nov 2022 07:17:19 GMT
Last-Modified
Mon, 14 Nov 2022 12:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=89
Content-Length
2803
Expires
0
564d0ff0f3578b7128a4-b7a1feddcbbebce5f93166d4e2765fff.jpg
www.security.20-90-74-227.cprapid.com/assets/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.security.20-90-74-227.cprapid.com/assets/564d0ff0f3578b7128a4-b7a1feddcbbebce5f93166d4e2765fff.jpg
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Mon, 21 Nov 2022 07:17:19 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=95
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
www.security.20-90-74-227.cprapid.com/assets/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://www.security.20-90-74-227.cprapid.com/assets/aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Origin
https://www.security.20-90-74-227.cprapid.com
accept-language
no-NO,no;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Mon, 21 Nov 2022 07:17:19 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
www.security.20-90-74-227.cprapid.com/assets/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://www.security.20-90-74-227.cprapid.com/assets/b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
20.90.74.227 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Origin
https://www.security.20-90-74-227.cprapid.com
accept-language
no-NO,no;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Mon, 21 Nov 2022 07:17:19 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
small.js
widgets.amung.us/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widgets.amung.us/small.js
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.75.171 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Mon, 21 Nov 2022 07:17:19 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 11 Nov 2022 22:14:49 GMT
server
cloudflare
age
1851
etag
W/"636ec959-2170"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400
cf-ray
76d7a51d69f309a4-ARN
expires
Tue, 22 Nov 2022 06:46:28 GMT
/
t.dtscout.com/i/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t.dtscout.com/i/?l=https%3A%2F%2Fwww.security.20-90-74-227.cprapid.com%2Fnordea_no%2Fphone.php&j=
Requested by
Host: widgets.amung.us
URL: https://widgets.amung.us/small.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.89.99.21 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ns3163187.ip-51-89-99.eu
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
3e9c8e5dcf3cbff9e1b7211551a31fe388f1b8e607fd78a0a34855be65da721c

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Mon, 21 Nov 2022 07:17:19 GMT
X-T
0.54
Server
nginx/1.14.0 (Ubuntu)
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
no-cache
Connection
close
X-S
ger1
Expires
Mon, 21 Nov 2022 07:17:18 GMT
/
whos.amung.us/pingjs/ 		25 B
126 B 		Script
General
Check archive.org
Download Go to
Full URL
https://whos.amung.us/pingjs/?k=canno&t=-%20Phone&c=s&x=https%3A%2F%2Fwww.security.20-90-74-227.cprapid.com%2Fnordea_no%2Fphone.php&y=&a=0&d=0.96&v=27&r=1742
Requested by
Host: widgets.amung.us
URL: https://widgets.amung.us/small.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.75.171 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec3aa33172b5886aa76b4c1616e5c5b110e745361928b50ecd7dbf4c6218b182

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Mon, 21 Nov 2022 07:17:19 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
76d7a51dea5209a4-ARN
content-type
text/javascript;charset=UTF-8
tc.js
cdn.tynt.com/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.tynt.com/tc.js
Requested by
Host: widgets.amung.us
URL: https://widgets.amung.us/small.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.151.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
937458495c30f567aeafe715f0164bfe061ab17aee4a34aabbf191f69a6d32ae

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Mon, 21 Nov 2022 07:17:19 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 21 Jul 2022 14:57:29 GMT
server
cloudflare
age
230071
etag
W/"62d96959-4599"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
76d7a51f7bfbb4f7-OSL
expires
Thu, 24 Nov 2022 07:17:19 GMT
truncated
/ 		439 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac

Request headers

accept-language
no-NO,no;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/gif
/
t.dtscout.com/pv/ 		51 B
319 B 		Script
General
Check archive.org
Download Go to
Full URL
https://t.dtscout.com/pv/?_a=v&_h=security.20-90-74-227.cprapid.com&_ss=17500iyaki&_pv=1&_ls=0&_u1=1&_u3=1&_cc=no&_pl=d&_cbid=1xzp&_cb=_dtspv.c
Requested by
Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=https%3A%2F%2Fwww.security.20-90-74-227.cprapid.com%2Fnordea_no%2Fphone.php&j=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.89.99.21 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ns3163187.ip-51-89-99.eu
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
45eb38cf1a5ef664aa7e514dc78fd3210c6f917ab6d4ae994e2f5ff554d3f8c3

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Mon, 21 Nov 2022 07:17:19 GMT
X-T
0.138
Server
nginx/1.14.0 (Ubuntu)
Transfer-Encoding
chunked
X-C
0
Content-Type
application/javascript
Cache-Control
no-cache
Connection
close
Expires
Mon, 21 Nov 2022 07:17:18 GMT
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1669015040023&dn=TC&iso=0&t=-%20Phone
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Mon, 21 Nov 2022 07:17:20 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
v2
de.tynt.com/deb/ 		4 B
260 B 		Script
General
Check archive.org
Download Go to
Full URL
https://de.tynt.com/deb/v2?id=w!canno&dn=TC&cc=1&r=
Requested by
Host: cdn.tynt.com
URL: https://cdn.tynt.com/tc.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.31 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip31.67-202-105.static.steadfastdns.net
Software
/
Resource Hash
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
date
Mon, 21 Nov 2022 07:17:19 GMT
cache-control
max-age=86400
content-type
application/javascript
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-length
4
expires
Tue, 22 Nov 2022 07:17:20 GMT
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1669015040023&dn=TC&iso=0&t=-%20Phone
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Mon, 21 Nov 2022 07:17:20 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1669015040023&dn=TC&iso=0&t=-%20Phone
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Mon, 21 Nov 2022 07:17:20 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1669015040023&dn=TC&iso=0
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Mon, 21 Nov 2022 07:17:20 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1669015040023&dn=TC&iso=0
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Mon, 21 Nov 2022 07:17:20 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1669015040023&dn=TC&iso=0
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Mon, 21 Nov 2022 07:17:21 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1669015040023&dn=TC&iso=0
Requested by
Host: www.security.20-90-74-227.cprapid.com
URL: https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://www.security.20-90-74-227.cprapid.com/nordea_no/phone.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Mon, 21 Nov 2022 07:17:21 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _wau object| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x2 object| Tynt object| _dtspv object| _33Across function| __uspapi

4 Cookies

Domain/Path Name / Value
www.security.20-90-74-227.cprapid.com/ Name: PHPSESSID
Value: 3ea46859d04ff943d5ce4758e4e27fb0
.dtscout.com/ Name: m
Value: 1
.dtscout.com/ Name: oa
Value: 1
.dtscout.com/ Name: df
Value: 1669015039

3 Console Messages

Source Level URL
Text
network error URL: https://www.security.20-90-74-227.cprapid.com/assets/aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://www.security.20-90-74-227.cprapid.com/assets/b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://www.security.20-90-74-227.cprapid.com/assets/564d0ff0f3578b7128a4-b7a1feddcbbebce5f93166d4e2765fff.jpg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.tynt.com
de.tynt.com
ic.tynt.com
t.dtscout.com
whos.amung.us
widgets.amung.us
www.security.20-90-74-227.cprapid.com
104.22.75.171
172.64.151.83
20.90.74.227
51.89.99.21
67.202.105.31
67.202.105.32
037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf
2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1
3e9c8e5dcf3cbff9e1b7211551a31fe388f1b8e607fd78a0a34855be65da721c
3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72
45eb38cf1a5ef664aa7e514dc78fd3210c6f917ab6d4ae994e2f5ff554d3f8c3
4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c
5b0d3bf71a9ae36d04599f18a1ab6656ec0b39e12d1415a61a0612e33771421a
8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1
8e983af3546212ed1e62b9c26c00f0f3a4c6fa7c17c9b852cd2910f8b425f8d3
937458495c30f567aeafe715f0164bfe061ab17aee4a34aabbf191f69a6d32ae
a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7
b73f03fec5b20ff58446c33bd87626b6c0b1c34297957cd718486e3190d3cadc
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec3aa33172b5886aa76b4c1616e5c5b110e745361928b50ecd7dbf4c6218b182
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac