![](/screenshots/2d4b28e6-f8c1-4593-a33b-c959e28f9774.png)
nptg0r9dku.onrocket.site
Open in
urlscan Pro
104.16.151.108
Malicious Activity!
Public Scan
Effective URL: https://nptg0r9dku.onrocket.site/se/bankid/
Submission: On July 10 via manual from NO — Scanned from AT
Summary
TLS certificate: Issued by E1 on May 26th 2024. Valid for: 3 months.
This is the only time nptg0r9dku.onrocket.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BankID (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 109.71.253.25 109.71.253.25 | 44486 (SYNLINQ s...) (SYNLINQ synlinq.de) | |
1 1 | 172.67.153.179 172.67.153.179 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 11 | 104.16.151.108 104.16.151.108 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 159.89.102.253 159.89.102.253 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
11 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
onrocket.site
1 redirects
nptg0r9dku.onrocket.site |
144 KB |
1 |
geolocation-db.com
geolocation-db.com — Cisco Umbrella Rank: 35416 |
263 B |
1 |
redirectapps.com
1 redirects
redirectapps.com |
464 B |
1 |
oyn.at
1 redirects
oyn.at |
285 B |
11 | 4 |
Domain | Requested by | |
---|---|---|
11 | nptg0r9dku.onrocket.site |
1 redirects
nptg0r9dku.onrocket.site
|
1 | geolocation-db.com |
nptg0r9dku.onrocket.site
|
1 | redirectapps.com | 1 redirects |
1 | oyn.at | 1 redirects |
11 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
onrocket.site E1 |
2024-05-26 - 2024-08-24 |
3 months | crt.sh |
geolocation-db.com R11 |
2024-06-10 - 2024-09-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://nptg0r9dku.onrocket.site/se/bankid/
Frame ID: 7E727B60F25888909C3C55AAD041385B
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/2d4b28e6-f8c1-4593-a33b-c959e28f9774.png)
Page Title
LoadingPage URL History Show full URLs
-
http://oyn.at/98ck
HTTP 307
https://oyn.at/98ck HTTP 302
https://redirectapps.com/id/ HTTP 302
https://nptg0r9dku.onrocket.site/se/bankid/ Page URL
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://oyn.at/98ck
HTTP 307
https://oyn.at/98ck HTTP 302
https://redirectapps.com/id/ HTTP 302
https://nptg0r9dku.onrocket.site/se/bankid/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- https://nptg0r9dku.onrocket.site/favicon.ico HTTP 302
- https://nptg0r9dku.onrocket.site/wp-includes/images/w-logo-blue-white-bg.png
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
nptg0r9dku.onrocket.site/se/bankid/ Redirect Chain
|
414 B 468 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
186.js
nptg0r9dku.onrocket.site/se/bankid/app-assets/js/ |
262 KB 89 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
nptg0r9dku.onrocket.site/se/bankid/app-assets/js/ |
12 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
121.js
nptg0r9dku.onrocket.site/se/bankid/app-assets/js/ |
23 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
w-logo-blue-white-bg.png
nptg0r9dku.onrocket.site/wp-includes/images/ Redirect Chain
|
3 KB 4 KB |
Other
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
487.js
nptg0r9dku.onrocket.site/se/bankid/app-assets/js/ |
89 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
169.js
nptg0r9dku.onrocket.site/se/bankid/app-assets/js/ |
80 KB 9 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bankid-logo.svg
nptg0r9dku.onrocket.site/se/bankid/app-assets/image/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
geolocation-db.com/json/ |
153 B 263 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
main.php
nptg0r9dku.onrocket.site/se/bankid/app-assets/php/ |
0 189 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
main.php
nptg0r9dku.onrocket.site/se/bankid/app-assets/php/ |
7 B 215 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BankID (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| webpackChunkbankid0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
geolocation-db.com
nptg0r9dku.onrocket.site
oyn.at
redirectapps.com
104.16.151.108
109.71.253.25
159.89.102.253
172.67.153.179
1ef4322c48d73c35393b1afdbb8678bc263132a24505ce349df4bd59666fee23
2388c1f69c5c5e4d8d0700661b67f1ec9a22357eb0b351d07059289a0ac3e0e9
42d5fc23b2a4be6ce87f8acdfe0dad32aa9cfc68700fb708cd248efa09ea8f65
44fa4547d1bb726e3ca6bcf1e092bb41242422c113d70c8f6507e7d9e5489d6b
484e8282229f40d3e277f96ca4584b7d6c863f4270f5294bc52c365f5e6473fc
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
bf8e29c6b5e6e8e674e63db944b4cfa672366868849c5b15c125afecfb4cfbbd
c33c2a78e4b6bd1e21dfb6dcb585d71eb3ec7d4ad3eac14fe5a9a11805bec058
c42305713ff61e9ba978509903bf2209daa171245c2b82a20d5f6d4e031887c4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ffc310a0d5c943072ff5c5d0a6556b9fc58dd107a4d0c8488ef9b58f89e597ea