nordeanorge.wpengine.com
Open in
urlscan Pro
35.185.22.192
Malicious Activity!
Public Scan
Effective URL: https://nordeanorge.wpengine.com/bank-id/bank-id/betale/
Submission: On April 29 via manual from NO — Scanned from NO
Summary
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on August 3rd 2021. Valid for: a year.
This is the only time nordeanorge.wpengine.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nordea (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.21.26.98 104.21.26.98 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 35.185.22.192 35.185.22.192 | 15169 (GOOGLE) (GOOGLE) | |
7 | 1 |
ASN15169 (GOOGLE, US)
PTR: 192.22.185.35.bc.googleusercontent.com
nordeanorge.wpengine.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
wpengine.com
nordeanorge.wpengine.com |
13 KB |
1 |
t.ly
1 redirects
t.ly — Cisco Umbrella Rank: 217781 |
1 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
7 | nordeanorge.wpengine.com |
nordeanorge.wpengine.com
|
1 | t.ly | 1 redirects |
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.wpengine.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-08-03 - 2022-09-03 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://nordeanorge.wpengine.com/bank-id/bank-id/betale/
Frame ID: 8C3C655893F5A75C7DA166173F7680DB
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Nordea - IdentifiseringPage URL History Show full URLs
-
https://t.ly/Kn32
HTTP 301
https://nordeanorge.wpengine.com/bank-id/bank-id/betale/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://t.ly/Kn32
HTTP 301
https://nordeanorge.wpengine.com/bank-id/bank-id/betale/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
nordeanorge.wpengine.com/bank-id/bank-id/betale/ Redirect Chain
|
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
nordeanorge.wpengine.com/bank-id/bank-id/betale/Nordea%20-%20Identifisering_files/ |
42 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bankidno.svg
nordeanorge.wpengine.com/bank-id/bank-id/betale/Nordea%20-%20Identifisering_files/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
nordeanorge.wpengine.com/bank-id/bank-id/betale/Nordea%20-%20Identifisering_files/ |
1 KB 934 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
564d0ff0f3578b7128a4-b7a1feddcbbebce5f93166d4e2765fff.jpg
nordeanorge.wpengine.com/assets/ |
548 B 548 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
nordeanorge.wpengine.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
nordeanorge.wpengine.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nordea (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
t.ly/ | Name: XSRF-TOKEN Value: eyJpdiI6ImlpOHJPTGVzNWp0bHJqSzE4enE4VGc9PSIsInZhbHVlIjoia3VJbENUZTYvaUJyenNSSVNrQnBGUGtxa2hQTXhScXpId09KVVYzbGZyTmRJYmUyVGFtUFN3dVhiK2ZsdHBHbVk4bDNzU1p6QWFmUElQQVB4cmU5NDRlVjIvYmY4ckRUUklkVTdmWGdHZWlSQVNrYmZrQ3YzcjVkaUVPcWozbWMiLCJtYWMiOiI2MDdlNWJiY2ExYzJjOWExMDU0MWY3MDg5YjVlZTU0Zjg5ZjQwNmE5ODA5Nzc2N2NlZmJjZmFmM2Y2NGUxM2ZlIiwidGFnIjoiIn0%3D |
|
t.ly/ | Name: tly_session Value: eyJpdiI6Ilozb0dBK3lDNUVBb2duRm44eGd5T0E9PSIsInZhbHVlIjoiNHpsSHQvcHJDcEpyUG4yOGZVQzcvaWp5ams3b2M3eXMvZEFMQUZydVZoS2FvTG1FaXhhd1JpSmU2R3hua3F0ZVJvM2FlMjczVFRGUVZSMit1ckl3b3VyKzhkZFNtQVQ3S1RnelZyNk5IL2Q2UHRocU1oSTN3MVpBZGdCMkJDSzMiLCJtYWMiOiJjNmJjYjNjMDQ0Mzc5YjI5YjIzMjFlOGM1ZDIwOTMwNmMwNGYwMDMyOTA0Yjg5ODQ1M2EzYTU3YjljMGRjMTliIiwidGFnIjoiIn0%3D |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nordeanorge.wpengine.com
t.ly
104.21.26.98
35.185.22.192
14e9f5f6924db918e377823d0400baee88b90754dc4cf51de508dfe2d1c88631
7c5ae8847476fcfc9a76babd10425ffbedfe505a5064cab2c0bbb24215b5717b
8e983af3546212ed1e62b9c26c00f0f3a4c6fa7c17c9b852cd2910f8b425f8d3
b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090