logon.e-boks.dk - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 104.111.238.84, located in Netherlands and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is logon.e-boks.dk.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on September 10th 2018. Valid for: 2 years.

This is the only time logon.e-boks.dk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Danske Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 6	104.111.238.84 104.111.238.84	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	95.100.68.245 95.100.68.245	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
5	2

6 104.111.238.84 (Netherlands) 2 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-238-84.deploy.static.akamaitechnologies.com

www.e-boks.dk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
logon.e-boks.dk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.100.68.245 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-68-245.deploy.static.akamaitechnologies.com

applet.danid.dk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	e-boks.dk 2 redirects www.e-boks.dk logon.e-boks.dk	32 KB
1	danid.dk applet.danid.dk
5	2

	Domain	Requested by
5	logon.e-boks.dk	1 redirects logon.e-boks.dk
1	applet.danid.dk	logon.e-boks.dk
1	www.e-boks.dk	1 redirects
5	3

This site contains links to these domains. Also see Links.

Domain
www.e-boks.dk
www.nemid.nu

Subject Issuer	Validity	Valid
www.e-boks.dk DigiCert SHA2 Extended Validation Server CA	`2018-09-10` - `2020-09-09`	2 years	crt.sh
applet.danid.dk GlobalSign Organization Validation CA - SHA256 - G2	`2017-05-16` - `2020-07-06`	3 years	crt.sh

This page contains 2 frames:

Primary Page: https://logon.e-boks.dk/nemid/logon?siteid=21
Frame ID: ABEBE7F617E30F74E7C2E1D1DF023D0E
Requests: 4 HTTP requests in this frame

Frame: https://applet.danid.dk/launcher/std/637131778095698790
Frame ID: 318A6FB9DEC06F194643C1825E51C6E6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.e-boks.dk/privat/ HTTP 302
https://logon.e-boks.dk/handler/logontologonprovider.aspx?siteid=21&ReturnUrl=%2fprivat%2f HTTP 302
https://logon.e-boks.dk/nemid/logon?siteid=21 Page URL

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

30 kB
Transfer

45 kB
Size

4
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: http://www.e-boks.dk/

Search URL Search Domain Scan URL

URL: https://www.nemid.nu/dk-da/support/
Title: Problemer med at logge på med NemID

Search URL Search Domain Scan URL

URL: https://www.nemid.nu/dk-da/faa_hjaelp_til_dit_nemid/certifikat_udloebet/
Title: Certifikat/Signatur er udløbet

Search URL Search Domain Scan URL

URL: https://www.nemid.nu/
Title: Bestil NemID

Search URL Search Domain Scan URL

URL: http://www.nemid.nu/app
Title: Download NemID Nøgleapp

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.e-boks.dk/privat/ HTTP 302
https://logon.e-boks.dk/handler/logontologonprovider.aspx?siteid=21&ReturnUrl=%2fprivat%2f HTTP 302
https://logon.e-boks.dk/nemid/logon?siteid=21 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request logon Show response
logon.e-boks.dk/nemid/
Redirect Chain

https://www.e-boks.dk/privat/
https://logon.e-boks.dk/handler/logontologonprovider.aspx?siteid=21&ReturnUrl=%2fprivat%2f
https://logon.e-boks.dk/nemid/logon?siteid=21

9 KB
4 KB

97ms
96ms

Document
text/html

104.111.238.84
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://logon.e-boks.dk/nemid/logon?siteid=21
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.238.84 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-238-84.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 742f9fbae2066e0bf6e5d36be0fe08c4870eee99467516dce5ac77b505e4d0b1

Request headers

Host: logon.e-boks.dk
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Accept-Encoding: gzip, deflate, br
Cookie: ASP.NET_SessionId=vqecwabuabq30bd3mvks1vhc; BIGipServer~e-boks_prod~e-boks_prod_pool_external_combined-1_default-pool=rd5001o00000000000000000000ffff0aff1205o80; TS01516053=017d9aa4c04358732b7e9a48b69dabaac353ad8238a1ea4655bb3c3a6e5ae3ef688712ad9409a862c2ef4f88d0f488f9e18dc0680d205797cf50a370f59ac6cc89e6b0bc2079ebb4b289a64a64730c287867c79345
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

Content-Type: text/html; charset=utf-8
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
X-Stamp: ID5%5001 Sun Dec 29 00:56:49 CET 2019
Vary: Accept-Encoding
Content-Encoding: gzip
Expires: Sat, 28 Dec 2019 23:56:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 28 Dec 2019 23:56:49 GMT
Content-Length: 3980
Connection: keep-alive

Redirect headers

Content-Type: text/html; charset=utf-8
Location: https://logon.e-boks.dk/nemid/logon?siteid=21
X-AspNet-Version: 4.0.30319
Content-Length: 724
X-Stamp: ID5%5001 Sun Dec 29 00:56:49 CET 2019
Expires: Sat, 28 Dec 2019 23:56:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 28 Dec 2019 23:56:49 GMT
Connection: keep-alive
Set-Cookie: ASP.NET_SessionId=vqecwabuabq30bd3mvks1vhc; path=/; HttpOnly BIGipServer~e-boks_prod~e-boks_prod_pool_external_combined-1_default-pool=rd5001o00000000000000000000ffff0aff1205o80; path=/; Httponly; Secure TS01516053=017d9aa4c04358732b7e9a48b69dabaac353ad8238a1ea4655bb3c3a6e5ae3ef688712ad9409a862c2ef4f88d0f488f9e18dc0680d205797cf50a370f59ac6cc89e6b0bc2079ebb4b289a64a64730c287867c79345; Path=/; Secure

GET
H/1.1 200
OK styles.css
logon.e-boks.dk/nemid/Content/stylesheet/ 14 KB
3 KB 49ms
49ms Stylesheet
text/css 104.111.238.84
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://logon.e-boks.dk/nemid/Content/stylesheet/styles.css
Requested by: Host: logon.e-boks.dk
URL: https://logon.e-boks.dk/nemid/logon?siteid=21
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.238.84 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-238-84.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3eb52bc81bb2cc13053f13d00e24dc356397a176874772966c0a34107c5ac51f

Request headers

Referer: https://logon.e-boks.dk/nemid/logon?siteid=21
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 28 Dec 2019 23:56:49 GMT
Content-Encoding: gzip
Last-Modified: Thu, 25 Apr 2019 11:01:32 GMT
X-Stamp: ID5%5001 Sun Dec 29 00:56:49 CET 2019
ETag: "04e9c3d56fbd41:0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2760
Expires: Sat, 28 Dec 2019 23:56:49 GMT

GET
H/1.1 200
OK e-boks_dk_invert_304x60.png
logon.e-boks.dk/nemid/Content/images/ 4 KB
4 KB 87ms
43ms Image
image/png 104.111.238.84
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logon.e-boks.dk/nemid/Content/images/e-boks_dk_invert_304x60.png
Requested by: Host: logon.e-boks.dk
URL: https://logon.e-boks.dk/nemid/logon?siteid=21
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.238.84 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-238-84.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 84924f104696624417468f578a1ccbc37e6e0da1d4dd28d705b914209b710afc

Request headers

Referer: https://logon.e-boks.dk/nemid/logon?siteid=21
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 28 Dec 2019 23:56:49 GMT
Last-Modified: Thu, 25 Apr 2019 11:01:32 GMT
X-Stamp: ID5%5001 Sun Dec 29 00:56:49 CET 2019
ETag: "04e9c3d56fbd41:0"
Content-Type: image/png
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4187
Expires: Sat, 28 Dec 2019 23:56:49 GMT

GET
H/1.1 200
OK Cookie set 637131778095698790
applet.danid.dk/launcher/std/ Frame 318A 0
0 225ms
122ms Document
text/html 95.100.68.245
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://applet.danid.dk/launcher/std/637131778095698790

Requested by

Host: logon.e-boks.dk
URL: https://logon.e-boks.dk/nemid/logon?siteid=21

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

95.100.68.245 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a95-100-68-245.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob:; connect-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; object-src 'none'
X-Xss-Protection	1; mode=block

Request headers

Host: applet.danid.dk
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://logon.e-boks.dk/nemid/logon?siteid=21
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://logon.e-boks.dk/nemid/logon?siteid=21

Response headers

Last-Modified: Sat, 28 Dec 2019 23:56:49 GMT Sat, 28 Dec 2019 23:56:49 GMT
content-security-policy: default-src 'self' data: blob:; connect-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; object-src 'none'
X-XSS-Protection: 1; mode=block
P3P: CP="This is not a P3P policy!"
X-UA-Compatible: IE=edge
Content-Type: text/html; charset=UTF-8
Vary: * Accept-Encoding
Expires: Fri, 01 Jan 2010 00:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Content-Language: en-US
Cteonnt-Length: 8557
X-NETSSESSION: 0000rz5jlpauCjOJpmK1nDoAU0M:D048D30345ACDA01000002D80000003400000048
Content-Encoding: gzip
Date: Sat, 28 Dec 2019 23:56:49 GMT
Content-Length: 5658
Connection: keep-alive
Set-Cookie: JSESSIONID=0000rz5jlpauCjOJpmK1nDoAU0M:D048D30345ACDA01000002D80000003400000048; Path=/; HttpOnly

GET
H/1.1 200
OK nemid_super_croped.png
logon.e-boks.dk/nemid/Content/images/backgrounds/ 18 KB
18 KB 51ms
50ms Image
image/png 104.111.238.84
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logon.e-boks.dk/nemid/Content/images/backgrounds/nemid_super_croped.png
Requested by: Host: logon.e-boks.dk
URL: https://logon.e-boks.dk/nemid/logon?siteid=21
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.238.84 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-238-84.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b886a602141dedad0d1cebbba9310bc97a1d2018ff478b1b3d8fce51cf9810ad

Request headers

Referer: https://logon.e-boks.dk/nemid/Content/stylesheet/styles.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 28 Dec 2019 23:56:49 GMT
Last-Modified: Thu, 25 Apr 2019 11:01:32 GMT
X-Stamp: ID5%5001 Sun Dec 29 00:56:49 CET 2019
ETag: "04e9c3d56fbd41:0"
Content-Type: image/png
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18542
Expires: Sat, 28 Dec 2019 23:56:49 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Danske Bank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| onNemIDMessage

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
applet.danid.dk/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0000rz5jlpauCjOJpmK1nDoAU0M:D048D30345ACDA01000002D80000003400000048
logon.e-boks.dk/	1969-12-31 23:59:59	Name: TS01516053 Value: 017d9aa4c04358732b7e9a48b69dabaac353ad8238a1ea4655bb3c3a6e5ae3ef688712ad9409a862c2ef4f88d0f488f9e18dc0680d205797cf50a370f59ac6cc89e6b0bc2079ebb4b289a64a64730c287867c79345
logon.e-boks.dk/	1969-12-31 23:59:59	Name: BIGipServer~e-boks_prod~e-boks_prod_pool_external_combined-1_default-pool Value: rd5001o00000000000000000000ffff0aff1205o80
logon.e-boks.dk/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: vqecwabuabq30bd3mvks1vhc

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

applet.danid.dk
logon.e-boks.dk
www.e-boks.dk
104.111.238.84
95.100.68.245
3eb52bc81bb2cc13053f13d00e24dc356397a176874772966c0a34107c5ac51f
742f9fbae2066e0bf6e5d36be0fe08c4870eee99467516dce5ac77b505e4d0b1
84924f104696624417468f578a1ccbc37e6e0da1d4dd28d705b914209b710afc
b886a602141dedad0d1cebbba9310bc97a1d2018ff478b1b3d8fce51cf9810ad

logon.e-boks.dk Open in urlscan Pro 104.111.238.84 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

30 kBTransfer

45 kBSize

4 Cookies

5 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

4 Cookies

Indicators

logon.e-boks.dk Open in urlscan Pro
104.111.238.84 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

30 kB
Transfer

45 kB
Size

4
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!