![](/screenshots/60bfc2a7-b3e5-4ded-b8d4-a3fa215537aa.png)
info.at21.altinn.cloud
Open in
urlscan Pro
2606:4700:4400::6812:2bfb
Malicious Activity!
Public Scan
Submission: On December 21 via api from US — Scanned from US
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 21st 2023. Valid for: a year.
This is the only time info.at21.altinn.cloud was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Norwegian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 2606:4700:440... 2606:4700:4400::6812:2bfb | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:440... 2606:4700:4400::ac40:9758 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:2800:11f... 2606:2800:11f:17a5:191a:18d5:537:22f9 | 15133 (EDGECAST) (EDGECAST) | |
2 | 20.42.73.143 20.42.73.143 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
18 | 4 |
ASN15133 (EDGECAST, US)
az416426.vo.msecnd.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
altinn.cloud
info.at21.altinn.cloud |
325 KB |
2 |
visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 786 |
282 B |
1 |
msecnd.net
az416426.vo.msecnd.net — Cisco Umbrella Rank: 2370 |
22 KB |
1 |
episerver.net
dl.episerver.net — Cisco Umbrella Rank: 18386 |
3 KB |
18 | 4 |
Domain | Requested by | |
---|---|---|
14 | info.at21.altinn.cloud |
info.at21.altinn.cloud
|
2 | dc.services.visualstudio.com |
az416426.vo.msecnd.net
|
1 | az416426.vo.msecnd.net |
info.at21.altinn.cloud
|
1 | dl.episerver.net |
info.at21.altinn.cloud
|
18 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
info.at21.altinn.cloud Cloudflare Inc ECC CA-3 |
2023-12-21 - 2024-12-19 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-24 - 2024-04-23 |
a year | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2023-05-05 - 2024-04-28 |
a year | crt.sh |
in.applicationinsights.azure.com Microsoft Azure RSA TLS Issuing CA 04 |
2023-11-17 - 2024-11-11 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://info.at21.altinn.cloud/
Frame ID: 8FA1BB5F898D8123362C85A58D4E7851
Requests: 17 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
info.at21.altinn.cloud/ |
29 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
frontpage.css
info.at21.altinn.cloud/bundles/ |
395 KB 101 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a-logo-blue.svg
info.at21.altinn.cloud/Static/img/ |
9 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
no.svg
info.at21.altinn.cloud/Static/img/ |
309 B 247 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gb.svg
info.at21.altinn.cloud/Static/img/ |
949 B 533 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
illustrasjon_starte_og_drive_sirkel_alt.svg
info.at21.altinn.cloud/Static/img/illustration/ |
36 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
illustrasjon_arbeidsforhold_sirkel.svg
info.at21.altinn.cloud/Static/img/illustration/ |
20 KB 8 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a-logo-black.svg
info.at21.altinn.cloud/Static/img/ |
9 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
frontpage.js
info.at21.altinn.cloud/bundles/ |
237 KB 93 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
find.js
dl.episerver.net/13.5.8/epi-util/ |
6 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
illustrasjon_logginn_alt.svg
info.at21.altinn.cloud/Static/img/illustration/ |
132 KB 28 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dinweb.woff2
info.at21.altinn.cloud/Static/font/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dinweb-medium.woff2
info.at21.altinn.cloud/Static/font/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons.woff2
info.at21.altinn.cloud/Static/icon/icons/ |
7 KB 7 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dinweb-bold.woff2
info.at21.altinn.cloud/Static/font/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ai.0.js
az416426.vo.msecnd.net/scripts/a/ |
94 KB 22 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
track
dc.services.visualstudio.com/v2/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
track
dc.services.visualstudio.com/v2/ |
96 B 282 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Norwegian Government (Government)55 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| documentPictureInPicture object| altinn object| appInsights object| AI object| Microsoft function| __extends function| _endsWith function| setupFormValidation function| showPassword function| setVisibility function| menuHandler function| SearchReportee function| LoadReporteeHeader function| SearchReporteeHeader function| debounce function| listenForAttachmentChanges function| handleFocus function| setupTruncateLines function| toggleFilter boolean| wasDark function| action function| toggleInstant function| mobileNavigation function| LoadMoreReportees function| addListExpandHandler function| feedbackToggle function| setupSelectableCheckbox function| setupOnKeypress function| compareTo object| targetNode object| config function| callback object| observer function| setValidatorSettings function| popoverLocalInit undefined| forceFocusTriggerElement function| popoverGlobalInit function| setupExpandContent function| enableIOS11Fix function| disableIOS11Fix function| isAffectedPlatform function| iOS11BugWorkAround function| contactForm function| $ function| jQuery object| bootstrap function| Truncate object| AltinnDropdown object| AltinnLoader object| AltinnModal object| AltinnQuickhelp function| infoportalInit function| FindApi object| api8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.info.at21.altinn.cloud/ | Name: TiPMix Value: 21.49170149032924 |
|
.info.at21.altinn.cloud/ | Name: x-ms-routing-name Value: self |
|
info.at21.altinn.cloud/ | Name: ASP.NET_SessionId Value: e2sw0sc45qawcfl1yydqcxwl |
|
.at21.altinn.cloud/ | Name: altinnPersistentContext Value: UL=1044 |
|
.info.at21.altinn.cloud/ | Name: ARRAffinity Value: 65ab83bcdd222df6ebd889c8a68c84e142123a92ba014dfaf98ddba473888a5b |
|
.info.at21.altinn.cloud/ | Name: ARRAffinitySameSite Value: 65ab83bcdd222df6ebd889c8a68c84e142123a92ba014dfaf98ddba473888a5b |
|
info.at21.altinn.cloud/ | Name: ai_user Value: AAxua|2023-12-21T17:38:06.524Z |
|
info.at21.altinn.cloud/ | Name: ai_session Value: 5gS+6|1703180286727.7|1703180286727.7 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
az416426.vo.msecnd.net
dc.services.visualstudio.com
dl.episerver.net
info.at21.altinn.cloud
20.42.73.143
2606:2800:11f:17a5:191a:18d5:537:22f9
2606:4700:4400::6812:2bfb
2606:4700:4400::ac40:9758
38a42ce77fc4ba90702847f39992aa851bd61417231668eac119cc9f023b1369
47a6929bf5c978c90212c3526557bed88302d121ca1c56b423637b5ed45503b3
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
5e00d3dfb8365a7040c61b675e42ae26889d0a6dfb1061034080e51463b9819d
67004276e5cbe57d0cc96a32bd76d47b1daf4f91f52f807df4d8f9259c69b844
67afbeff709136bcb6d3ce9f76ba000c56cae923c5fc4278f370d597f4831db5
6911eccbb43d2498fa436e27541d68106d026b366e7eb55624caf8ee4a5a4c94
81511b8391ff6527d6fb1ce2ff9f42000c149bb7407e52a312dc42cb173251af
860c1dd90c1e0e8f987c6492d2124f966ec2617130c739e678777f5acf0e0c1a
87974d9d95e134352685515d1a2e7cbe4ef82cd26b50c860169046edbdcb4e6d
98257ae320d87c82ee1cb8af57f6dd9e1e6d3e8864c97f4f63aacea5b19ec440
a8154854a62591c09ba446627d84963440abc4be8142e7a5551af938c3cfe3d3
aac3c1d39a69853bc2c09c5da934382054b1b4017352988781927233410e6047
ac86637ed10127b6c1d6009c189c404154de3dc68a71d57a080edb27dd129a23
bf68520aac93f92ffab4aa33303be1252695f0bf9f407249adce12e7ede80811
d630997a1717be52e5781f19963de85ae750cce5d7c897e34ca4a7821ec17190
fd3be68dca0431ca6c6e922767f808d22c1df1ed6f401abb90d9466dc188985d