www.sikkerhet-bank-id.com

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 92.87.6.114, located in Buhusi, Romania and belongs to RTD Bucharest, Romania, RO. The main domain is www.sikkerhet-bank-id.com.
TLS certificate: Issued by R3 on October 9th 2023. Valid for: 3 months.

This is the only time www.sikkerhet-bank-id.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Skatteetaten (Government)

Domain & IP information

	IP Address		AS Autonomous System
1 7	92.87.6.114 92.87.6.114		9050 (RTD Bucha...) (RTD Bucharest)
6	1

7 92.87.6.114 (Buhusi, Romania) 1 redirects

ASN9050 (RTD Bucharest, Romania, RO)

www.sikkerhet-bank-id.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	sikkerhet-bank-id.com 1 redirects www.sikkerhet-bank-id.com	201 KB
6	1

	Domain	Requested by
7	www.sikkerhet-bank-id.com	1 redirects www.sikkerhet-bank-id.com
6	1

This site contains no links.

Subject Issuer	Validity	Valid
sikkerhet-bank-id.com R3	`2023-10-09` - `2024-01-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.sikkerhet-bank-id.com/skatteetaten.php
Frame ID: 1202834574D59B71B90A69DAEE87C409
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Person - Skatteetaten

Page URL History Show full URLs

https://www.sikkerhet-bank-id.com/ HTTP 302
https://www.sikkerhet-bank-id.com/skatteetaten.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

200 kB
Transfer

623 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.sikkerhet-bank-id.com/ HTTP 302
https://www.sikkerhet-bank-id.com/skatteetaten.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request skatteetaten.php Show response www.sikkerhet-bank-id.com/ Redirect Chain https://www.sikkerhet-bank-id.com/ https://www.sikkerhet-bank-id.com/skatteetaten.php	59 KB 11 KB	44ms 43ms	Document text/html	92.87.6.114 RTD Bucharest
General Check archive.org Show headers Download Go to Full URL https://www.sikkerhet-bank-id.com/skatteetaten.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 92.87.6.114 Buhusi, Romania, ASN9050 (RTD Bucharest, Romania, RO), Reverse DNS Software Apache / Resource Hash `940c993f4cfc0d3f4c7b5933edc1e1955ec3040e9e3bae87dcc0833d27fcf08e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-length 11079 content-type text/html; charset=UTF-8 date Mon, 09 Oct 2023 18:03:45 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Accept-Encoding Redirect headers cache-control no-store, no-cache, must-revalidate content-encoding br content-length 1 content-type text/html; charset=UTF-8 date Mon, 09 Oct 2023 18:03:45 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location skatteetaten.php pragma no-cache server Apache vary Accept-Encoding
GET H2	200	main.0c96be81c1cb1acf5102.css www.sikkerhet-bank-id.com/bid_filez/css/	302 KB 44 KB	79ms 78ms	Stylesheet text/css	92.87.6.114 RTD Bucharest
General Check archive.org Show headers Download Go to Full URL https://www.sikkerhet-bank-id.com/bid_filez/css/main.0c96be81c1cb1acf5102.css Requested by Host: www.sikkerhet-bank-id.com URL: https://www.sikkerhet-bank-id.com/skatteetaten.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 92.87.6.114 Buhusi, Romania, ASN9050 (RTD Bucharest, Romania, RO), Reverse DNS Software Apache / Resource Hash `67cacc89c79c5f2083cb6504018c05b39947b13e16db7a4a4bf0b3209fe47c5b` Request headers accept-language de-DE,de;q=0.9 Referer https://www.sikkerhet-bank-id.com/skatteetaten.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 18:03:45 GMT content-encoding br last-modified Sun, 06 Aug 2023 19:12:00 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 45402
GET H2	200	index.css www.sikkerhet-bank-id.com/bid_filez/css/	132 KB 15 KB	47ms 46ms	Stylesheet text/css	92.87.6.114 RTD Bucharest
General Check archive.org Show headers Download Go to Full URL https://www.sikkerhet-bank-id.com/bid_filez/css/index.css Requested by Host: www.sikkerhet-bank-id.com URL: https://www.sikkerhet-bank-id.com/skatteetaten.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 92.87.6.114 Buhusi, Romania, ASN9050 (RTD Bucharest, Romania, RO), Reverse DNS Software Apache / Resource Hash `bc7a869ca0a185763b08ef8a3709c1dacc0c56058cadbbfc03bc613b74b42169` Request headers accept-language de-DE,de;q=0.9 Referer https://www.sikkerhet-bank-id.com/skatteetaten.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 18:03:45 GMT content-encoding br last-modified Sun, 06 Aug 2023 18:57:18 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 15396
GET H2	200	penger.png www.sikkerhet-bank-id.com/bid_filez/img/	121 KB 121 KB	36ms 35ms	Image image/png	92.87.6.114 RTD Bucharest
General Check archive.org Show headers Download Go to Show image Full URL https://www.sikkerhet-bank-id.com/bid_filez/img/penger.png?h=500 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 92.87.6.114 Buhusi, Romania, ASN9050 (RTD Bucharest, Romania, RO), Reverse DNS Software Apache / Resource Hash `677c0c7120a9eeeb0521dd26caf0c9d0e5c81d340298b3b61a311ef59bbd5863` Request headers accept-language de-DE,de;q=0.9 Referer https://www.sikkerhet-bank-id.com/skatteetaten.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 18:03:45 GMT last-modified Sun, 06 Aug 2023 19:15:24 GMT server Apache accept-ranges bytes content-length 123794 content-type image/png
GET H2	404	arrowUp.png www.sikkerhet-bank-id.com/static/img/footer/	315 B 315 B	35ms 34ms	Image text/html	92.87.6.114 RTD Bucharest
General Check archive.org Show headers Download Go to Show image Full URL https://www.sikkerhet-bank-id.com/static/img/footer/arrowUp.png Requested by Host: www.sikkerhet-bank-id.com URL: https://www.sikkerhet-bank-id.com/bid_filez/css/main.0c96be81c1cb1acf5102.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 92.87.6.114 Buhusi, Romania, ASN9050 (RTD Bucharest, Romania, RO), Reverse DNS Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers accept-language de-DE,de;q=0.9 Referer https://www.sikkerhet-bank-id.com/bid_filez/css/main.0c96be81c1cb1acf5102.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 18:03:45 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET H2	200	materialdesignicons-webfont.woff2 www.sikkerhet-bank-id.com/bid_filez/css/	9 KB 9 KB	67ms 66ms	Font font/woff2	92.87.6.114 RTD Bucharest
General Check archive.org Show headers Download Go to Full URL https://www.sikkerhet-bank-id.com/bid_filez/css/materialdesignicons-webfont.woff2?v=5.9.55 Requested by Host: www.sikkerhet-bank-id.com URL: https://www.sikkerhet-bank-id.com/bid_filez/css/main.0c96be81c1cb1acf5102.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 92.87.6.114 Buhusi, Romania, ASN9050 (RTD Bucharest, Romania, RO), Reverse DNS Software Apache / Resource Hash `2141107b5d993a50855370c8b4f6323e3a364de7b8b10a4343db7d511705a390` Request headers Referer https://www.sikkerhet-bank-id.com/bid_filez/css/main.0c96be81c1cb1acf5102.css Origin https://www.sikkerhet-bank-id.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 09 Oct 2023 18:03:45 GMT content-encoding br last-modified Sun, 06 Aug 2023 19:09:52 GMT server Apache vary Accept-Encoding content-type font/woff2 accept-ranges bytes content-length 8823

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Skatteetaten (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.sikkerhet-bank-id.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 43b0fa35f95de75d3b3428140e65af0b

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.sikkerhet-bank-id.com/static/img/footer/arrowUp.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.sikkerhet-bank-id.com
92.87.6.114
2141107b5d993a50855370c8b4f6323e3a364de7b8b10a4343db7d511705a390
677c0c7120a9eeeb0521dd26caf0c9d0e5c81d340298b3b61a311ef59bbd5863
67cacc89c79c5f2083cb6504018c05b39947b13e16db7a4a4bf0b3209fe47c5b
940c993f4cfc0d3f4c7b5933edc1e1955ec3040e9e3bae87dcc0833d27fcf08e
bc7a869ca0a185763b08ef8a3709c1dacc0c56058cadbbfc03bc613b74b42169
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

www.sikkerhet-bank-id.com Open in urlscan Pro 92.87.6.114 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

200 kBTransfer

623 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

www.sikkerhet-bank-id.com Open in urlscan Pro
92.87.6.114 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

200 kB
Transfer

623 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!