untiringshoe.htmlpasta.com
Open in
urlscan Pro
5.79.70.123
Malicious Activity!
Public Scan
Submission: On March 06 via manual from NO
Summary
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on February 20th 2018. Valid for: 3 years.
This is the only time untiringshoe.htmlpasta.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nordea (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 5.79.70.123 5.79.70.123 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
9 | 158.233.249.1 158.233.249.1 | 201271 (NORDEA-AS) (NORDEA-AS) | |
1 | 2606:4700::68... 2606:4700::6811:4004 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2a00:1450:400... 2a00:1450:4001:819::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a03:b0c0:3:e... 2a03:b0c0:3:e0::298:6001 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 2 | 2a00:1450:400... 2a00:1450:4001:81a::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a01:7e01::f0... 2a01:7e01::f03c:91ff:fe6b:d177 | 63949 (LINODE-AP...) (LINODE-AP Linode) | |
1 | 2a00:1450:400... 2a00:1450:4001:800::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:400c:c00::9a | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:81f::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::2003 | 15169 (GOOGLE) (GOOGLE) | |
21 | 10 |
ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
untiringshoe.htmlpasta.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN63949 (LINODE-AP Linode, LLC, US)
htmlpasta.goatcounter.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
nordea.no
nettbanken.nordea.no |
444 KB |
4 |
htmlpasta.com
untiringshoe.htmlpasta.com |
20 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com |
18 KB |
1 |
google.de
www.google.de |
109 B |
1 |
google.com
1 redirects
www.google.com |
177 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net |
161 B |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
goatcounter.com
htmlpasta.goatcounter.com |
548 B |
1 |
zgo.at
gc.zgo.at |
2 KB |
1 |
googleapis.com
fonts.googleapis.com |
779 B |
1 |
bootstrapcdn.com
netdna.bootstrapcdn.com |
7 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
4 KB |
21 | 12 |
Domain | Requested by | |
---|---|---|
9 | nettbanken.nordea.no |
untiringshoe.htmlpasta.com
nettbanken.nordea.no |
4 | untiringshoe.htmlpasta.com |
nettbanken.nordea.no
|
2 | www.google-analytics.com |
1 redirects
untiringshoe.htmlpasta.com
|
1 | www.google.de |
untiringshoe.htmlpasta.com
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
1 | fonts.gstatic.com |
untiringshoe.htmlpasta.com
|
1 | htmlpasta.goatcounter.com |
untiringshoe.htmlpasta.com
|
1 | gc.zgo.at |
untiringshoe.htmlpasta.com
|
1 | fonts.googleapis.com |
untiringshoe.htmlpasta.com
|
1 | netdna.bootstrapcdn.com |
untiringshoe.htmlpasta.com
|
1 | cdnjs.cloudflare.com |
untiringshoe.htmlpasta.com
|
21 | 12 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.nordea.no |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.htmlpasta.com COMODO RSA Domain Validation Secure Server CA |
2018-02-20 - 2021-02-19 |
3 years | crt.sh |
nettbanken.nordea.no Entrust Certification Authority - L1M |
2019-09-12 - 2020-09-12 |
a year | crt.sh |
cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2019-09-14 - 2020-10-13 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
gc.zgo.at Let's Encrypt Authority X3 |
2020-01-30 - 2020-04-29 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
goatcounter.com Let's Encrypt Authority X3 |
2020-03-01 - 2020-05-30 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
www.google.de GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://untiringshoe.htmlpasta.com/
Frame ID: EECE290015A27E0DC3B34A2B5EF68226
Requests: 21 HTTP requests in this frame
Screenshot
Detected technologies
Ubuntu (Operating Systems) ExpandDetected patterns
- headers server /Ubuntu/i
Bootstrap (Web Frameworks) Expand
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
animate.css (Web Frameworks) Expand
Detected patterns
- html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i
RequireJS (JavaScript Frameworks) Expand
Detected patterns
- script /require.*\.js/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Sådan får du BankI
Search URL Search Domain Scan URL
Title: Tilmeld dig
Search URL Search Domain Scan URL
Title: Hjælp
Search URL Search Domain Scan URL
Title: Kontakt
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 16- https://www.google-analytics.com/r/collect?v=1&_v=j81&a=333398780&t=pageview&_s=1&dl=https%3A%2F%2Funtiringshoe.htmlpasta.com%2F&dp=%2Funtiringshoe.html&ul=en-us&de=UTF-8&dt=Log%20ind%20Nettbank%20Privat%20-%20Nordea&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=65297572&gjid=398734352&cid=611911328.1583499196&tid=UA-75065234-3&_gid=1233221693.1583499196&_r=1&z=32392130 HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-75065234-3&cid=611911328.1583499196&jid=65297572&_gid=1233221693.1583499196&gjid=398734352&_v=j81&z=32392130 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=611911328.1583499196&jid=65297572&_v=j81&z=32392130 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-75065234-3&cid=611911328.1583499196&jid=65297572&_v=j81&z=32392130&slf_rd=1&random=1993018040
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
untiringshoe.htmlpasta.com/ |
15 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
nettbanken.nordea.no/login/assets/javascripts-min/ |
615 KB 195 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
nettbanken.nordea.no/login/assets/stylesheets/libs/bootstrap/ |
98 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/2.0/ |
47 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
netdna.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 779 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.min.css
nettbanken.nordea.no/login/assets/stylesheets/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
require.js
nettbanken.nordea.no/login/assets/javascripts/ |
14 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
perf_stats.js
nettbanken.nordea.no/login/assets/javascripts/stats/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
count.js
gc.zgo.at/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app-store-badge.svg
nettbanken.nordea.no/login/assets/images/ |
10 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google-play-store-badge.svg
nettbanken.nordea.no/login/assets/images/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile-app-qr-code.png
nettbanken.nordea.no/login/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
nettbanken.nordea.no/login/assets/javascripts-min/ |
615 KB 195 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
44 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
count
htmlpasta.goatcounter.com/ |
43 B 548 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 109 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
stats
untiringshoe.htmlpasta.com/login/ |
19 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
stats
untiringshoe.htmlpasta.com/login/ |
19 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
stats
untiringshoe.htmlpasta.com/login/ |
19 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nordea (Banking)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| requirejs function| require function| define string| GoogleAnalyticsObject function| ga object| goatcounter function| SendData function| peStat function| pStat object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| $ function| jQuery object| angular object| jQuery111107857928133625101 function| _ object| Placeholders object| jQuery11110150562495071307154 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.htmlpasta.com/ | Name: _gat Value: 1 |
|
.htmlpasta.com/ | Name: _gid Value: GA1.2.1233221693.1583499196 |
|
.htmlpasta.com/ | Name: _ga Value: GA1.2.611911328.1583499196 |
|
untiringshoe.htmlpasta.com/ | Name: IV_JCT Value: %2Flogin |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
gc.zgo.at
htmlpasta.goatcounter.com
netdna.bootstrapcdn.com
nettbanken.nordea.no
stats.g.doubleclick.net
untiringshoe.htmlpasta.com
www.google-analytics.com
www.google.com
www.google.de
158.233.249.1
2001:4de0:ac19::1:b:2a
2606:4700::6811:4004
2a00:1450:4001:800::2003
2a00:1450:4001:819::200a
2a00:1450:4001:81a::200e
2a00:1450:4001:81f::2003
2a00:1450:4001:81f::2004
2a00:1450:400c:c00::9a
2a01:7e01::f03c:91ff:fe6b:d177
2a03:b0c0:3:e0::298:6001
5.79.70.123
0f60979b728ce4cf2de33e6a9765c7adc5df57246d00478d0d1b5ef026754a76
18521983a3ed5e76f27be85023b93bb7e21301750cbbfb163e8d7bbe7e8fd2ef
2559cc3396d5e31688fe8080020c8b10296230c6c700c8c1a48191a7b98e40ca
32ea0753779d16a8bf3ce1b88f5058c44960e5cf57ea778522e254e323cc56e9
377e90233074716e2b6fa4bb1c30baacbc1ebd0ac402475410c1a5d635116088
42cb846e07917f6731406e500f24aeb2e88c42cda124eaa59e08c5331cad8bcb
4f42f4e66299f2e67d7890f435901468dc9c7e7824c5eb1896774ab32a80cf79
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5a413ebf7a43a7e00d4fdeb7eab02f263db68be30ae07039ba6bde500934ed32
769638ff7c0df5973591a3aedf0f62deded02cb3adf7943f1e43d2789db770f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7cd8d471eec190c74051c0bee16aff8f0d8c814b12c71a872857b1b77872f97b
bfa21901e87e44f386b8208764bc596acaaaa085e560bf989d40982eb0e5a7c8
c77ca201000b94a3b1a02f413d9f2e2524f0da43a03a583b390f25f41fb5fece
e9503448692b738dd260fbd7f7cabf2e11f09b600fa97e6eb3a56eba5b1a7e9b
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fa61f9a7c2e4aaa831b61058a814316ebc4cedcf82325869d4ddaade239066c8