![](/screenshots/5f32ded7-f922-46d4-98ba-f18a411d38d1.png)
mail.mail-godman.name.ng
Open in
urlscan Pro
94.228.120.207
Malicious Activity!
Public Scan
Submission: On June 29 via manual from DK
Summary
TLS certificate: Issued by R3 on June 28th 2021. Valid for: 3 months.
This is the only time mail.mail-godman.name.ng was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NemID (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 94.228.120.207 94.228.120.207 | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
2 | 23.37.45.60 23.37.45.60 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
5 | 2 |
ASN9123 (TIMEWEB-AS, RU)
PTR: 571851-cb20303.tmweb.ru
mail.mail-godman.name.ng |
ASN16625 (AKAMAI-AS, US)
PTR: a23-37-45-60.deploy.static.akamaitechnologies.com
www.nemid.nu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
mail-godman.name.ng
mail.mail-godman.name.ng |
464 KB |
2 |
nemid.nu
www.nemid.nu |
66 KB |
5 | 2 |
Domain | Requested by | |
---|---|---|
3 | mail.mail-godman.name.ng |
mail.mail-godman.name.ng
|
2 | www.nemid.nu |
mail.mail-godman.name.ng
|
5 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
mail.mail-godman.name.ng R3 |
2021-06-28 - 2021-09-26 |
3 months | crt.sh |
nemid.nu GlobalSign Extended Validation CA - SHA256 - G3 |
2020-04-23 - 2022-07-19 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://mail.mail-godman.name.ng/nemiid/
Frame ID: ECDEF21CDA78842926F637F927185ADB
Requests: 5 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
mail.mail-godman.name.ng/nemiid/ |
71 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Flag_eng.svg
www.nemid.nu/system/modules/dk.nemid.oc/resources/images/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nemid_white.svg
www.nemid.nu//system/modules/dk.nemid.oc/resources/images/ |
63 KB 63 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
keycard-image.png
mail.mail-godman.name.ng/nemiid/ |
450 KB 450 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
speaker.png
mail.mail-godman.name.ng/images/ |
196 B 196 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NemID (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mail.mail-godman.name.ng
www.nemid.nu
23.37.45.60
94.228.120.207
6f1497ada6130f0621c0be65d76d578c5a85b1a72af6e1e8bd4cb93efab8d7ee
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
91913fcb4fbad92ce1eac54d08b86de6c26fe0e148bd02f56826b2cc5f90ca03
a485345a7450fb3ac2dfd0ec0a6c10e62a87161d770121dd42c4a073dc0c884d
d068057066a05d6d8ab5b6e37b96f8f6963ae259c7b748a7214c1a6feacd649e