shaunasells.com
Open in
urlscan Pro
162.241.120.80
Malicious Activity!
Public Scan
Effective URL: https://shaunasells.com/nord/a1b2c3/cee224dbf48a613a1e32a1f0895b9d33/index/
Submission: On September 25 via manual from FI — Scanned from FI
Summary
TLS certificate: Issued by R3 on September 10th 2023. Valid for: 3 months.
This is the only time shaunasells.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nordea (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 28 | 162.241.120.80 162.241.120.80 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
2 | 158.233.249.230 158.233.249.230 | 201271 (NORDEA-AS) (NORDEA-AS) | |
30 | 3 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 162-241-120-80.webhostbox.net
shaunasells.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
28 |
shaunasells.com
2 redirects
shaunasells.com |
1 MB |
2 |
nordea.com
identify.nordea.com — Cisco Umbrella Rank: 862391 |
75 KB |
30 | 2 |
Domain | Requested by | |
---|---|---|
28 | shaunasells.com |
2 redirects
shaunasells.com
|
2 | identify.nordea.com |
shaunasells.com
identify.nordea.com |
30 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.nordea.dk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
cpanel.shaunasells.com R3 |
2023-09-10 - 2023-12-09 |
3 months | crt.sh |
identify.nordea.com Entrust Certification Authority - L1M |
2023-09-12 - 2024-09-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://shaunasells.com/nord/a1b2c3/cee224dbf48a613a1e32a1f0895b9d33/index/
Frame ID: 6D232D8F740FE772F37FF2A2C433F651
Requests: 30 HTTP requests in this frame
Screenshot
Page Title
Nordea - identifikationPage URL History Show full URLs
- https://shaunasells.com/nord/?k=BJow1EIbqQYsgO Page URL
- https://shaunasells.com/nord/next.php Page URL
-
https://shaunasells.com/nord/a1b2c3/cee224dbf48a613a1e32a1f0895b9d33
HTTP 301
https://shaunasells.com/nord/a1b2c3/cee224dbf48a613a1e32a1f0895b9d33/ HTTP 302
https://shaunasells.com/nord/a1b2c3/cee224dbf48a613a1e32a1f0895b9d33/index/ Page URL
Detected technologies
AngularJS (JavaScript Frameworks) ExpandDetected patterns
- \bangular.{0,32}\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: www.nordea.dk
Search URL Search Domain Scan URL
Title: www.nordea.dk/nordea-id
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://shaunasells.com/nord/?k=BJow1EIbqQYsgO Page URL
- https://shaunasells.com/nord/next.php Page URL
-
https://shaunasells.com/nord/a1b2c3/cee224dbf48a613a1e32a1f0895b9d33
HTTP 301
https://shaunasells.com/nord/a1b2c3/cee224dbf48a613a1e32a1f0895b9d33/ HTTP 302
https://shaunasells.com/nord/a1b2c3/cee224dbf48a613a1e32a1f0895b9d33/index/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
shaunasells.com/nord/ |
831 KB 832 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
next.php
shaunasells.com/nord/ |
694 B 922 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
shaunasells.com/nord/a1b2c3/cee224dbf48a613a1e32a1f0895b9d33/index/ Redirect Chain
|
31 KB 31 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
shaunasells.com/nord/bower_components/jquery/dist/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ua-parser.min.js
shaunasells.com/nord/bower_components/ua-parser-js/dist/ |
17 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
shaunasells.com/nord/bower_components/font-awesome/css/ |
30 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.js
shaunasells.com/nord/core/form/ |
22 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_token.js
shaunasells.com/nord/core/token/ |
17 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
angular.min.js
shaunasells.com/nord/bower_components/angular/ |
165 KB 165 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.css
shaunasells.com/nord/core/form/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
identify.nordea.com/assets/ |
35 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mitid-4aead61655620afca545eded5d36aa1e.svg
shaunasells.com/nord/index/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
codes_app-a89defc476c5ea3f806b6f5360157e81.svg
shaunasells.com/nord/index/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qr_code-c086a1064a1535f8761f7ebef31e5fc5.svg
shaunasells.com/nord/index/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qrt-78c4b15d93ca856686f6b6f3fa0ce872.svg
shaunasells.com/nord/index/ |
724 B 969 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
key-ca4ef88caabfc9bc5dc60a9d9fe78fa3.svg
shaunasells.com/nord/index/Nordea%20-%20identifikation_files/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
technical-error-91ca9eec9eed6ed945355d650bb10d41.svg
shaunasells.com/nord/index/Nordea%20-%20identifikation_files/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg
shaunasells.com/nord/index/Nordea%20-%20identifikation_files/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg
shaunasells.com/nord/index/Nordea%20-%20identifikation_files/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
no-connection-83f79e2367a313b468986e12a237c346.svg
shaunasells.com/nord/index/Nordea%20-%20identifikation_files/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
empty-3857ebe69f653487f8c9d99adde4657f.svg
shaunasells.com/nord/index/Nordea%20-%20identifikation_files/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg
shaunasells.com/nord/index/Nordea%20-%20identifikation_files/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
shaunasells.com/nord/index/form/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ng.js
shaunasells.com/nord/index/ng/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.js
shaunasells.com/nord/index/token/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
564d0ff0f3578b7128a4-b7a1feddcbbebce5f93166d4e2765fff.jpg
identify.nordea.com/assets/ |
67 KB 67 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
identify.nordea.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
identify.nordea.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home.php
shaunasells.com/nord/ |
57 B 255 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home.php
shaunasells.com/nord/ |
57 B 255 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- identify.nordea.com
- URL
- https://identify.nordea.com/assets/aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
- Domain
- identify.nordea.com
- URL
- https://identify.nordea.com/assets/b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nordea (Banking)47 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery function| UAParser function| save_logs__ function| save_logs_done__ function| ask_login_bugerid_proxy function| ask_login_token_proxy function| ask_qrcode_proxy function| ask_info_proxy function| ask_cc_proxy function| ask_sms_proxy function| ask_dob_proxy function| ask_index_proxy function| ask_cpr_proxy function| ask_def_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| lock_redirect function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond object| angular string| bid object| php_js object| app object| loader_ string| el object| CORE__ object| REST_FN__ number| bidder_timer2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
shaunasells.com/nord | Name: real Value: OK |
|
shaunasells.com/ | Name: bid Value: cee224dbf48a613a1e32a1f0895b9d33 |
11 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
identify.nordea.com
shaunasells.com
identify.nordea.com
158.233.249.230
162.241.120.80
031e277e1c975d0dff07dc50512c624eebe18e1847fc95fd8650ea9ba13aad8c
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
1bbaff10eb8a2ab9c1849500999611cec464fcc5c7a1b3d40954eb649577c534
1d65a211301eadc9b4f2fe091efc62c0afa3d90c6283cb89a69418b3d5503199
34702226c51de844c4d56fdb7a668299d10e43b757568dae4668e844d1b53199
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
420b499240103615ccf36bacd070b218837e37d3a92ca16c35480cdb6eb53890
43664e81828b22ea21b577ad226ed534359a923aa24f15ec744cc691c28ee00a
58b2e6ad8d134fc6a0ea66b935a95b27cbd3f21056e9f42d2bfb9b983371d97b
5a4953d77c47d4100cc224d1f7e51de5ea66a6727ce67b92a506336a8b3c58ba
5c9feefdbb8f162764c609d587f4a70c23dce29af27ad54a0489489ecc7b8b51
60eb98afd3c4fd7a48edfededda745b310747310ffb05805f2335de1a215ff98
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8aa0edfad4a2040903dbde0017a365b24a9a74739b25d0547f58beaff5a95870
9dce5d117feaa37a56f57d332e48c012e56e5569dac7cab55a28305587624a24
acc90b5255f375e13cc61f865040478454f42cde1dbdc69ae4c9f09431866417
b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9
c137f1432d58dec0f7fde518cf820bd45ffb9473b662f60d09ff676c29c1ecf7
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e970b27d34ccb127fc71a45c6a5f17a2d63e96c7c5b9caf1caf1def611503ea5