urlscan.io logo urlscan.io
SecurityTrails logo

20.203.169.150 Open in urlscan Pro
20.203.169.150  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://20.203.169.150/nordea_no/login.php
Submission: On February 08 via manual from NO — Scanned from NO
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 3 countries across 3 domains to perform 23 HTTP transactions. The main IP is 20.203.169.150, located in Zurich, Switzerland and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is 20.203.169.150.
This is the only time 20.203.169.150 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

IP Address AS Autonomous System
12 20.203.169.150 8075 (MICROSOFT...)
1 104.22.74.171 13335 (CLOUDFLAR...)
2 141.101.120.11 13335 (CLOUDFLAR...)
1 172.67.8.141 13335 (CLOUDFLAR...)
1 172.64.151.83 13335 (CLOUDFLAR...)
5 67.202.105.34 32748 (STEADFAST)
1 67.202.105.32 32748 (STEADFAST)
23 8
12    20.203.169.150 (Zurich, Switzerland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
20.203.169.150
1    104.22.74.171 (None, )

ASN13335 (CLOUDFLARENET, US)
widgets.amung.us
2    141.101.120.11 (None, )

ASN13335 (CLOUDFLARENET, US)
t.dtscout.com
1    172.67.8.141 (United States)

ASN13335 (CLOUDFLARENET, US)
whos.amung.us
1    172.64.151.83 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.tynt.com
5    67.202.105.34 (Palos Park, United States)

ASN32748 (STEADFAST, US)
PTR: ip34.67-202-105.static.steadfastdns.net
ic.tynt.com
1    67.202.105.32 (Palos Park, United States)

ASN32748 (STEADFAST, US)
PTR: ip32.67-202-105.static.steadfastdns.net
de.tynt.com
Apex Domain
Subdomains		 Transfer
7 tynt.com
cdn.tynt.com — Cisco Umbrella Rank: 10164
ic.tynt.com — Cisco Umbrella Rank: 6443
de.tynt.com — Cisco Umbrella Rank: 1448
8 KB
2 dtscout.com
t.dtscout.com — Cisco Umbrella Rank: 15760
2 KB
2 amung.us
widgets.amung.us — Cisco Umbrella Rank: 15031
whos.amung.us — Cisco Umbrella Rank: 15937
4 KB
23 3
Domain Requested by
5 ic.tynt.com 20.203.169.150
2 t.dtscout.com widgets.amung.us
t.dtscout.com
1 de.tynt.com cdn.tynt.com
1 cdn.tynt.com widgets.amung.us
1 whos.amung.us widgets.amung.us
1 widgets.amung.us 20.203.169.150
23 6

This site contains links to these domains. Also see Links.

Domain
www.nordea.no
nettbanken.nordea.no
nordea.no
Subject Issuer Validity Valid
*.amung.us
Sectigo RSA Domain Validation Secure Server CA		 2022-05-18 -
2023-06-17		 a year crt.sh
*.dtscout.com
GTS CA 1P5		 2023-01-29 -
2023-04-29		 3 months crt.sh
*.tynt.com
Sectigo RSA Domain Validation Secure Server CA		 2022-09-07 -
2023-09-30		 a year crt.sh

This page contains 1 frames:

Primary Page: http://20.203.169.150/nordea_no/login.php
Frame ID: D94217F281276296B1C6EE9EBBDCEF5F
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Nordea - Norway

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

23
Requests

43 %
HTTPS

0 %
IPv6

3
Domains

6
Subdomains

8
IPs

3
Countries

99 kB
Transfer

110 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
20.203.169.150/nordea_no/ 		25 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://20.203.169.150/nordea_no/login.php
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
8ac6a924f61f48a6ce0ff43052532f3e76281f5d02342ea0be89dfa2fc886363

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
no-NO,no;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Wed, 08 Feb 2023 07:21:18 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
20.203.169.150/nordea_no/image/ 		36 KB
36 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://20.203.169.150/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
5b0d3bf71a9ae36d04599f18a1ab6656ec0b39e12d1415a61a0612e33771421a

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Feb 2023 07:21:18 GMT
Last-Modified
Mon, 14 Nov 2022 14:33:20 GMT
Server
Apache
Content-Type
text/css
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
36842
Expires
0
bankidno-4ea331ae4c5bc3a12e6cf8340862d4c0.svg
20.203.169.150/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://20.203.169.150/nordea_no/image/bankidno-4ea331ae4c5bc3a12e6cf8340862d4c0.svg
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
8e983af3546212ed1e62b9c26c00f0f3a4c6fa7c17c9b852cd2910f8b425f8d3

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Feb 2023 07:21:18 GMT
Last-Modified
Mon, 14 Nov 2022 14:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2837
Expires
0
technical-error-91ca9eec9eed6ed945355d650bb10d41.svg
20.203.169.150/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://20.203.169.150/nordea_no/image/technical-error-91ca9eec9eed6ed945355d650bb10d41.svg
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Feb 2023 07:21:18 GMT
Last-Modified
Mon, 14 Nov 2022 14:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2846
Expires
0
something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg
20.203.169.150/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://20.203.169.150/nordea_no/image/something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Feb 2023 07:21:18 GMT
Last-Modified
Mon, 14 Nov 2022 14:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3104
Expires
0
cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg
20.203.169.150/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://20.203.169.150/nordea_no/image/cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Feb 2023 07:21:18 GMT
Last-Modified
Mon, 14 Nov 2022 14:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3097
Expires
0
no-connection-83f79e2367a313b468986e12a237c346.svg
20.203.169.150/nordea_no/image/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://20.203.169.150/nordea_no/image/no-connection-83f79e2367a313b468986e12a237c346.svg
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Feb 2023 07:21:18 GMT
Last-Modified
Mon, 14 Nov 2022 14:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
4974
Expires
0
empty-3857ebe69f653487f8c9d99adde4657f.svg
20.203.169.150/nordea_no/image/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://20.203.169.150/nordea_no/image/empty-3857ebe69f653487f8c9d99adde4657f.svg
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Feb 2023 07:21:18 GMT
Last-Modified
Mon, 14 Nov 2022 14:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1642
Expires
0
service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg
20.203.169.150/nordea_no/image/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://20.203.169.150/nordea_no/image/service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Feb 2023 07:21:18 GMT
Last-Modified
Mon, 14 Nov 2022 14:33:20 GMT
Server
Apache
Content-Type
image/svg+xml
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2803
Expires
0
small.js
widgets.amung.us/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widgets.amung.us/small.js
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.74.171 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 07:21:19 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 12 Jan 2023 17:19:30 GMT
server
cloudflare
age
1497
etag
W/"63c04122-2170"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400
cf-ray
79629b9859b00a1d-ARN
expires
Thu, 09 Feb 2023 06:56:22 GMT
564d0ff0f3578b7128a4-b7a1feddcbbebce5f93166d4e2765fff.jpg
20.203.169.150/assets/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://20.203.169.150/assets/564d0ff0f3578b7128a4-b7a1feddcbbebce5f93166d4e2765fff.jpg
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Wed, 08 Feb 2023 07:21:19 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
20.203.169.150/assets/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://20.203.169.150/assets/aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
http://20.203.169.150/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Origin
http://20.203.169.150
accept-language
no-NO,no;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Wed, 08 Feb 2023 07:21:19 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
20.203.169.150/assets/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://20.203.169.150/assets/b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Protocol
HTTP/1.1
Server
20.203.169.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
http://20.203.169.150/nordea_no/image/styles-8c6738c3c6c5b3bad3f9a4e729acc38c.css
Origin
http://20.203.169.150
accept-language
no-NO,no;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Wed, 08 Feb 2023 07:21:19 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
/
t.dtscout.com/i/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t.dtscout.com/i/?l=http%3A%2F%2F20.203.169.150%2Fnordea_no%2Flogin.php&j=
Requested by
Host: widgets.amung.us
URL: https://widgets.amung.us/small.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.101.120.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e9c8e5dcf3cbff9e1b7211551a31fe388f1b8e607fd78a0a34855be65da721c

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 07:21:20 GMT
x-t
0.617
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SWTF8wICvWBdqslRY6D0yxcWSvUPdS%2BXvnkO0uwrAT0Uhw%2Bm1iCPOAzv%2BTTOjlxZB%2BOqGNAkFS5MsofPQGry3pzTBzpRMSz7N185nmVm3LaTPykc2%2BvuElEq%2B7B7Qd4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
no-cache
x-s
mtl3
cf-ray
79629b9b5ea62d6b-ARN
expires
Wed, 08 Feb 2023 07:21:19 GMT
/
whos.amung.us/pingjs/ 		24 B
308 B 		Script
General
Check archive.org
Download Go to
Full URL
http://whos.amung.us/pingjs/?k=canno&t=Nordea%20-%20Norway&c=s&x=http%3A%2F%2F20.203.169.150%2Fnordea_no%2Flogin.php&y=&a=0&d=0.494&v=27&r=8673
Requested by
Host: widgets.amung.us
URL: https://widgets.amung.us/small.js
Protocol
HTTP/1.1
Server
172.67.8.141 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0b23871644ce54d318bcb878cb6cd44e543a50ce5029b078d87c9706509f286

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Wed, 08 Feb 2023 07:21:19 GMT
content-encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/javascript;charset=UTF-8
Connection
keep-alive
CF-RAY
79629b9afed7b4ed-OSL
tc.js
cdn.tynt.com/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.tynt.com/tc.js
Requested by
Host: widgets.amung.us
URL: https://widgets.amung.us/small.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.151.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9dab070ee75ce06cf5e8bb6ab989f0130e40f216a1a717d6a0538a57f5143fec

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 07:21:20 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 10 Jan 2023 20:39:00 GMT
server
cloudflare
age
180881
etag
W/"63bdcce4-4571"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
79629b9cad50b50c-OSL
expires
Sat, 11 Feb 2023 07:21:20 GMT
truncated
/ 		439 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type
image/gif
/
t.dtscout.com/pv/ 		51 B
331 B 		Script
General
Check archive.org
Download Go to
Full URL
https://t.dtscout.com/pv/?_a=v&_h=20.203.169.150&_ss=2u16qxozj0&_pv=1&_ls=0&_u1=1&_u3=1&_cc=no&_pl=d&_cbid=17dl&_cb=_dtspv.c
Requested by
Host: t.dtscout.com
URL: https://t.dtscout.com/i/?l=http%3A%2F%2F20.203.169.150%2Fnordea_no%2Flogin.php&j=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.101.120.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
865b21d6f4be7dfa3c29b8ee9cdde937b80ac1005835c8193a441f8f177739bf

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 07:21:20 GMT
x-t
0.16
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ykwmfTzLV8Hb7B5hi1R11W8suaQ6nknlT6fWEkom4GsxtOuI1AYkTAOX9nDV30HCuXXzfcsHlOyAsd%2BzIv%2FER2XinzDyz%2BWPqSjSNqBTLU9UOFv5KUKzHVdFv3iPC%2Bg%3D"}],"group":"cf-nel","max_age":604800}
x-c
0
content-type
application/javascript
cache-control
no-cache
cf-ray
79629b9cf8292d6b-ARN
expires
Wed, 08 Feb 2023 07:21:19 GMT
p
ic.tynt.com/b/ 		0
228 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1675840880147&dn=TC&iso=0&pu=http%3A%2F%2F20.203.169.150%2Fnordea_no%2Flogin.php&t=Nordea%20-%20Norway
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.34 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip34.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Wed, 08 Feb 2023 07:21:20 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
v2
de.tynt.com/deb/ 		4 B
252 B 		Script
General
Check archive.org
Download Go to
Full URL
https://de.tynt.com/deb/v2?id=w!canno&dn=TC&cc=1&r=&pu=http%3A%2F%2F20.203.169.150%2Fnordea_no%2Flogin.php
Requested by
Host: cdn.tynt.com
URL: https://cdn.tynt.com/tc.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
/
Resource Hash
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
date
Wed, 08 Feb 2023 07:21:20 GMT
cache-control
max-age=86400
content-type
application/javascript
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-length
4
expires
Thu, 09 Feb 2023 07:21:20 GMT
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1675840880147&dn=TC&iso=0&pu=http%3A%2F%2F20.203.169.150%2Fnordea_no%2Flogin.php&t=Nordea%20-%20Norway
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.34 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip34.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Wed, 08 Feb 2023 07:21:20 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1675840880147&dn=TC&iso=0&pu=http%3A%2F%2F20.203.169.150%2Fnordea_no%2Flogin.php
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.34 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip34.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Wed, 08 Feb 2023 07:21:20 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1675840880147&dn=TC&iso=0&pu=http%3A%2F%2F20.203.169.150%2Fnordea_no%2Flogin.php
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.34 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip34.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Wed, 08 Feb 2023 07:21:21 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
p
ic.tynt.com/b/ 		0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic.tynt.com/b/p?id=w!canno&lm=0&ts=1675840880147&dn=TC&iso=0&pu=http%3A%2F%2F20.203.169.150%2Fnordea_no%2Flogin.php
Requested by
Host: 20.203.169.150
URL: http://20.203.169.150/nordea_no/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.34 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip34.67-202-105.static.steadfastdns.net
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
no-NO,no;q=0.9
Referer
http://20.203.169.150/nordea_no/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires
"Sat, 26 Jul 1997 05:00:00 GMT"
date
Wed, 08 Feb 2023 07:21:21 GMT
cache-control
"no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
server
nginx/1.16.1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange object| _wau object| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x2 object| Tynt object| _dtspv object| _33Across function| __uspapi

4 Cookies

Domain/Path Name / Value
20.203.169.150/ Name: PHPSESSID
Value: 534a1e7043478b699c5173c3ea9ff521
.dtscout.com/ Name: m
Value: 1
.dtscout.com/ Name: oa
Value: 1
.dtscout.com/ Name: df
Value: 1675840880

3 Console Messages

Source Level URL
Text
network error URL: http://20.203.169.150/assets/564d0ff0f3578b7128a4-b7a1feddcbbebce5f93166d4e2765fff.jpg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://20.203.169.150/assets/aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://20.203.169.150/assets/b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.tynt.com
de.tynt.com
ic.tynt.com
t.dtscout.com
whos.amung.us
widgets.amung.us
104.22.74.171
141.101.120.11
172.64.151.83
172.67.8.141
20.203.169.150
67.202.105.32
67.202.105.34
037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf
2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1
3e9c8e5dcf3cbff9e1b7211551a31fe388f1b8e607fd78a0a34855be65da721c
3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72
4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c
5b0d3bf71a9ae36d04599f18a1ab6656ec0b39e12d1415a61a0612e33771421a
865b21d6f4be7dfa3c29b8ee9cdde937b80ac1005835c8193a441f8f177739bf
8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1
8ac6a924f61f48a6ce0ff43052532f3e76281f5d02342ea0be89dfa2fc886363
8e983af3546212ed1e62b9c26c00f0f3a4c6fa7c17c9b852cd2910f8b425f8d3
9dab070ee75ce06cf5e8bb6ab989f0130e40f216a1a717d6a0538a57f5143fec
a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7
c0b23871644ce54d318bcb878cb6cd44e543a50ce5029b078d87c9706509f286
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac