certificate.20-117-185-181.cprapid.com Open in urlscan Pro
20.117.185.181  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://buc2013.se/dk.html?4049 Page URL
2. https://certificate.20-117-185-181.cprapid.com/nordeea/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	dk.html buc2013.se/	219 B 461 B	179ms 52ms	Document text/html	172.104.155.151 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://buc2013.se/dk.html?4049 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.104.155.151 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS malmo.pixeltokig.se Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 accept-language se-SE,se;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 219 Content-Type text/html Date Wed, 05 Oct 2022 06:47:00 GMT Keep-Alive timeout=5, max=100 Last-Modified Tue, 04 Oct 2022 15:28:34 GMT Server Apache
GET H/1.1	200 OK	Primary Request / Show response certificate.20-117-185-181.cprapid.com/nordeea/	186 KB 187 KB	1566ms 720ms	Document text/html	20.117.185.181 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://certificate.20-117-185-181.cprapid.com/nordeea/ Requested by Host: buc2013.se URL: https://buc2013.se/dk.html?4049 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.117.185.181 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash e86d75f0a6667f4d8b2cde098978f9f7690ff66455b8992c418e5cb474a7e748 Request headers Referer https://buc2013.se/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 accept-language se-SE,se;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 05 Oct 2022 06:47:02 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	header.png certificate.20-117-185-181.cprapid.com/nordeea/	6 KB 6 KB	54ms 54ms	Image image/png	20.117.185.181 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://certificate.20-117-185-181.cprapid.com/nordeea/header.png Requested by Host: certificate.20-117-185-181.cprapid.com URL: https://certificate.20-117-185-181.cprapid.com/nordeea/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.117.185.181 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash 22719b20cf37255859aedb4e793edeb5c62a70ea121cfb1fff313102a31ed3ae Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/nordeea/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Pragma no-cache Date Wed, 05 Oct 2022 06:47:03 GMT Last-Modified Sat, 16 Jul 2022 14:45:34 GMT Server Apache Content-Type image/png Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 5985 Expires 0
GET H2	200	small.js Show response widgets.amung.us/	8 KB 4 KB	118ms 40ms	Script application/x-javascript	104.22.74.171 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://widgets.amung.us/small.js Requested by Host: certificate.20-117-185-181.cprapid.com URL: https://certificate.20-117-185-181.cprapid.com/nordeea/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.22.74.171 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eee6ef188662ab76c29c720cab899af19bad8153a9c86d548d90b3fa46886fc9 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers date Wed, 05 Oct 2022 06:47:03 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 29 Aug 2022 18:12:41 GMT server cloudflare age 1472 etag W/"630d0199-2142" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=86400 cf-ray 755434261e1595de-ARN expires Thu, 06 Oct 2022 06:22:31 GMT
GET H/1.1	200 OK	/ Show response t.dtscout.com/i/	2 KB 3 KB	541ms 135ms	Script application/javascript	158.69.139.230 OVH
General Check archive.org Show headers Download Go to Full URL https://t.dtscout.com/i/?l=https%3A%2F%2Fcertificate.20-117-185-181.cprapid.com%2Fnordeea%2F&j=https%3A%2F%2Fbuc2013.se%2F Requested by Host: widgets.amung.us URL: https://widgets.amung.us/small.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.69.139.230 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip230.ip-158-69-139.net Software nginx/1.14.0 (Ubuntu) / Resource Hash 553ae9f6fa1fed96156833a4901b54678c0dd7812b6eb0a969f5e95f0033e009 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Wed, 05 Oct 2022 06:47:03 GMT X-T 0.916 Server nginx/1.14.0 (Ubuntu) Transfer-Encoding chunked Content-Type application/javascript Cache-Control no-cache Connection close X-S mtl3 Expires Wed, 05 Oct 2022 06:47:02 GMT
GET H2	200	/ Show response whos.amung.us/pingjs/	25 B 126 B	169ms 155ms	Script text/javascript	104.22.74.171 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://whos.amung.us/pingjs/?k=nordeea&t=185.147.213.73%20-%20185-147-213-73.arn.as54203.net%20-%20Index&c=s&x=https%3A%2F%2Fcertificate.20-117-185-181.cprapid.com%2Fnordeea%2F&y=https%3A%2F%2Fbuc2013.se%2F&a=0&d=1.796&v=27&r=3750 Requested by Host: widgets.amung.us URL: https://widgets.amung.us/small.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.22.74.171 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7b05f944388b50fb6c4b2526ee070c5808df62abad3614a7f8ad9e901594682 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers date Wed, 05 Oct 2022 06:47:03 GMT content-encoding gzip cf-cache-status DYNAMIC server cloudflare cf-ray 755434268ebd95de-ARN content-type text/javascript;charset=UTF-8
GET H2	200	tc.js Show response cdn.tynt.com/	17 KB 7 KB	410ms 41ms	Script application/javascript	104.18.36.173 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.tynt.com/tc.js Requested by Host: widgets.amung.us URL: https://widgets.amung.us/small.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.36.173 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 937458495c30f567aeafe715f0164bfe061ab17aee4a34aabbf191f69a6d32ae Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers date Wed, 05 Oct 2022 06:47:03 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 21 Jul 2022 14:57:21 GMT server cloudflare age 56938 etag W/"62d96951-4599" vary Accept-Encoding content-type application/javascript cache-control public, max-age=259200 cf-ray 75543429ef4ef156-ARN expires Sat, 08 Oct 2022 06:47:03 GMT
GET DATA	200 OK	truncated /	439 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac Request headers accept-language se-SE,se;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Content-Type image/gif
GET H/1.1	200 OK	/ Show response t.dtscout.com/pv/	51 B 319 B	227ms 135ms	Script application/javascript	158.69.139.230 OVH
General Check archive.org Show headers Download Go to Full URL https://t.dtscout.com/pv/?_a=v&_h=certificate.20-117-185-181.cprapid.com&_ss=487r0bvagn&_pv=1&_ls=0&_u1=1&_u3=1&_cc=se&_pl=d&_cbid=2r4c&_cb=_dtspv.c Requested by Host: t.dtscout.com URL: https://t.dtscout.com/i/?l=https%3A%2F%2Fcertificate.20-117-185-181.cprapid.com%2Fnordeea%2F&j=https%3A%2F%2Fbuc2013.se%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.69.139.230 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip230.ip-158-69-139.net Software nginx/1.14.0 (Ubuntu) / Resource Hash c4b52f40385ec3d542fa0de20b1fd3818cdbb8907d331214f8c190db01752829 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers Date Wed, 05 Oct 2022 06:47:04 GMT X-T 0.158 Server nginx/1.14.0 (Ubuntu) Transfer-Encoding chunked X-C 0 Content-Type application/javascript Cache-Control no-cache Connection close Expires Wed, 05 Oct 2022 06:47:03 GMT
GET H2	204	p ic.tynt.com/b/	0 227 B	451ms 143ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!nordeea&lm=0&ts=1664952424079&dn=TC&iso=0&r=https%3A%2F%2Fbuc2013.se%2F&t=185.147.213.73%20-%20185-147-213-73.arn.as54203.net%20-%20Index Requested by Host: certificate.20-117-185-181.cprapid.com URL: https://certificate.20-117-185-181.cprapid.com/nordeea/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/nordeea/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 05 Oct 2022 06:47:04 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	200	v2 Show response de.tynt.com/deb/	4 B 260 B	457ms 149ms	Script application/javascript	67.202.105.33 STEADFAST
General Check archive.org Show headers Download Go to Full URL https://de.tynt.com/deb/v2?id=w!nordeea&dn=TC&cc=1&r=https%3A%2F%2Fbuc2013.se%2F Requested by Host: cdn.tynt.com URL: https://cdn.tynt.com/tc.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.33 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip33.67-202-105.static.steadfastdns.net Software / Resource Hash d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/nordeea/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" date Wed, 05 Oct 2022 06:47:03 GMT cache-control max-age=86400 content-type application/javascript accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version content-length 4 expires Thu, 06 Oct 2022 06:47:04 GMT
GET H2	204	p ic.tynt.com/b/	0 227 B	144ms 143ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!nordeea&lm=0&ts=1664952424079&dn=TC&iso=0&r=https%3A%2F%2Fbuc2013.se%2F&t=185.147.213.73%20-%20185-147-213-73.arn.as54203.net%20-%20Index Requested by Host: certificate.20-117-185-181.cprapid.com URL: https://certificate.20-117-185-181.cprapid.com/nordeea/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/nordeea/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 05 Oct 2022 06:47:04 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	143ms 143ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!nordeea&lm=0&ts=1664952424079&dn=TC&iso=0&r=https%3A%2F%2Fbuc2013.se%2F&t=185.147.213.73%20-%20185-147-213-73.arn.as54203.net%20-%20Index Requested by Host: certificate.20-117-185-181.cprapid.com URL: https://certificate.20-117-185-181.cprapid.com/nordeea/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/nordeea/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 05 Oct 2022 06:47:04 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	144ms 143ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!nordeea&lm=0&ts=1664952424079&dn=TC&iso=0&r=https%3A%2F%2Fbuc2013.se%2F Requested by Host: certificate.20-117-185-181.cprapid.com URL: https://certificate.20-117-185-181.cprapid.com/nordeea/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/nordeea/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 05 Oct 2022 06:47:04 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	144ms 143ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!nordeea&lm=0&ts=1664952424079&dn=TC&iso=0 Requested by Host: certificate.20-117-185-181.cprapid.com URL: https://certificate.20-117-185-181.cprapid.com/nordeea/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/nordeea/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 05 Oct 2022 06:47:05 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	144ms 143ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!nordeea&lm=0&ts=1664952424079&dn=TC&iso=0 Requested by Host: certificate.20-117-185-181.cprapid.com URL: https://certificate.20-117-185-181.cprapid.com/nordeea/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/nordeea/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 05 Oct 2022 06:47:05 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	144ms 143ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!nordeea&lm=0&ts=1664952424079&dn=TC&iso=0 Requested by Host: certificate.20-117-185-181.cprapid.com URL: https://certificate.20-117-185-181.cprapid.com/nordeea/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language se-SE,se;q=0.9 Referer https://certificate.20-117-185-181.cprapid.com/nordeea/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 05 Oct 2022 06:47:05 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| _wau object| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x2 object| Tynt object| _dtspv object| _33Across function| __uspapi

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			certificate.20-117-185-181.cprapid.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 36076a5e58ed5bef62f4e57afa019398
			.dtscout.com/	1970-01-20 06:29:17	Name: m Value: 1
			.dtscout.com/	1970-01-20 06:29:30	Name: b Value: 1
			.dtscout.com/	1970-01-20 06:29:26	Name: oa Value: 1
			.dtscout.com/	1970-01-20 08:53:12	Name: df Value: 1664952423

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

buc2013.se
cdn.tynt.com
certificate.20-117-185-181.cprapid.com
de.tynt.com
ic.tynt.com
t.dtscout.com
whos.amung.us
widgets.amung.us
104.18.36.173
104.22.74.171
158.69.139.230
172.104.155.151
20.117.185.181
67.202.105.33
67.202.105.34
22719b20cf37255859aedb4e793edeb5c62a70ea121cfb1fff313102a31ed3ae
553ae9f6fa1fed96156833a4901b54678c0dd7812b6eb0a969f5e95f0033e009
937458495c30f567aeafe715f0164bfe061ab17aee4a34aabbf191f69a6d32ae
c4b52f40385ec3d542fa0de20b1fd3818cdbb8907d331214f8c190db01752829
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e86d75f0a6667f4d8b2cde098978f9f7690ff66455b8992c418e5cb474a7e748
eee6ef188662ab76c29c720cab899af19bad8153a9c86d548d90b3fa46886fc9
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac
f7b05f944388b50fb6c4b2526ee070c5808df62abad3614a7f8ad9e901594682