logon.e-boks.dk
Open in
urlscan Pro
104.111.238.84
Malicious Activity!
Public Scan
Effective URL: https://logon.e-boks.dk/nemid/logon?siteid=21
Submission: On December 28 via manual from DK
Summary
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on September 10th 2018. Valid for: 2 years.
This is the only time logon.e-boks.dk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Danske Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 6 | 104.111.238.84 104.111.238.84 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 95.100.68.245 95.100.68.245 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
5 | 2 |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-238-84.deploy.static.akamaitechnologies.com
www.e-boks.dk | |
logon.e-boks.dk |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-68-245.deploy.static.akamaitechnologies.com
applet.danid.dk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
e-boks.dk
2 redirects
www.e-boks.dk logon.e-boks.dk |
32 KB |
1 |
danid.dk
applet.danid.dk |
|
5 | 2 |
Domain | Requested by | |
---|---|---|
5 | logon.e-boks.dk |
1 redirects
logon.e-boks.dk
|
1 | applet.danid.dk |
logon.e-boks.dk
|
1 | www.e-boks.dk | 1 redirects |
5 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.e-boks.dk |
www.nemid.nu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.e-boks.dk DigiCert SHA2 Extended Validation Server CA |
2018-09-10 - 2020-09-09 |
2 years | crt.sh |
applet.danid.dk GlobalSign Organization Validation CA - SHA256 - G2 |
2017-05-16 - 2020-07-06 |
3 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://logon.e-boks.dk/nemid/logon?siteid=21
Frame ID: ABEBE7F617E30F74E7C2E1D1DF023D0E
Requests: 4 HTTP requests in this frame
Frame:
https://applet.danid.dk/launcher/std/637131778095698790
Frame ID: 318A6FB9DEC06F194643C1825E51C6E6
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.e-boks.dk/privat/
HTTP 302
https://logon.e-boks.dk/handler/logontologonprovider.aspx?siteid=21&ReturnUrl=%2fprivat%2f HTTP 302
https://logon.e-boks.dk/nemid/logon?siteid=21 Page URL
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Problemer med at logge på med NemID
Search URL Search Domain Scan URL
Title: Certifikat/Signatur er udløbet
Search URL Search Domain Scan URL
Title: Bestil NemID
Search URL Search Domain Scan URL
Title: Download NemID Nøgleapp
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.e-boks.dk/privat/
HTTP 302
https://logon.e-boks.dk/handler/logontologonprovider.aspx?siteid=21&ReturnUrl=%2fprivat%2f HTTP 302
https://logon.e-boks.dk/nemid/logon?siteid=21 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
logon
logon.e-boks.dk/nemid/ Redirect Chain
|
9 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
logon.e-boks.dk/nemid/Content/stylesheet/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
e-boks_dk_invert_304x60.png
logon.e-boks.dk/nemid/Content/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
637131778095698790
applet.danid.dk/launcher/std/ Frame 318A |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nemid_super_croped.png
logon.e-boks.dk/nemid/Content/images/backgrounds/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Danske Bank (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| onNemIDMessage4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
applet.danid.dk/ | Name: JSESSIONID Value: 0000rz5jlpauCjOJpmK1nDoAU0M:D048D30345ACDA01000002D80000003400000048 |
|
logon.e-boks.dk/ | Name: TS01516053 Value: 017d9aa4c04358732b7e9a48b69dabaac353ad8238a1ea4655bb3c3a6e5ae3ef688712ad9409a862c2ef4f88d0f488f9e18dc0680d205797cf50a370f59ac6cc89e6b0bc2079ebb4b289a64a64730c287867c79345 |
|
logon.e-boks.dk/ | Name: BIGipServer~e-boks_prod~e-boks_prod_pool_external_combined-1_default-pool Value: rd5001o00000000000000000000ffff0aff1205o80 |
|
logon.e-boks.dk/ | Name: ASP.NET_SessionId Value: vqecwabuabq30bd3mvks1vhc |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
applet.danid.dk
logon.e-boks.dk
www.e-boks.dk
104.111.238.84
95.100.68.245
3eb52bc81bb2cc13053f13d00e24dc356397a176874772966c0a34107c5ac51f
742f9fbae2066e0bf6e5d36be0fe08c4870eee99467516dce5ac77b505e4d0b1
84924f104696624417468f578a1ccbc37e6e0da1d4dd28d705b914209b710afc
b886a602141dedad0d1cebbba9310bc97a1d2018ff478b1b3d8fce51cf9810ad