![](/screenshots/6417471a-aaac-4078-9256-7d756359b630.png)
134-209-209-240.cprapid.com
Open in
urlscan Pro
134.209.209.240
Malicious Activity!
Public Scan
Submission: On April 13 via manual from FI — Scanned from NO
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on April 13th 2023. Valid for: 3 months.
This is the only time 134-209-209-240.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nordea (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
15 | 134.209.209.240 134.209.209.240 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
2 | 172.67.8.141 172.67.8.141 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 142.250.186.163 142.250.186.163 | 15169 (GOOGLE) (GOOGLE) | |
2 | 141.101.120.11 141.101.120.11 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.64.151.83 172.64.151.83 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 67.202.105.32 67.202.105.32 | 32748 (STEADFAST) (STEADFAST) | |
27 | 7 |
ASN14061 (DIGITALOCEAN-ASN, US)
134-209-209-240.cprapid.com |
ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net
www.gstatic.com |
ASN32748 (STEADFAST, US)
PTR: ip32.67-202-105.static.steadfastdns.net
ic.tynt.com | |
de.tynt.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
cprapid.com
134-209-209-240.cprapid.com |
145 KB |
7 |
tynt.com
cdn.tynt.com — Cisco Umbrella Rank: 11968 ic.tynt.com — Cisco Umbrella Rank: 7142 de.tynt.com — Cisco Umbrella Rank: 1757 |
8 KB |
2 |
dtscout.com
t.dtscout.com — Cisco Umbrella Rank: 13563 |
2 KB |
2 |
amung.us
widgets.amung.us — Cisco Umbrella Rank: 18927 whos.amung.us — Cisco Umbrella Rank: 13838 |
4 KB |
1 |
gstatic.com
www.gstatic.com |
2 KB |
27 | 5 |
Domain | Requested by | |
---|---|---|
15 | 134-209-209-240.cprapid.com |
134-209-209-240.cprapid.com
|
5 | ic.tynt.com |
134-209-209-240.cprapid.com
|
2 | t.dtscout.com |
widgets.amung.us
t.dtscout.com |
1 | de.tynt.com |
cdn.tynt.com
|
1 | cdn.tynt.com |
widgets.amung.us
|
1 | whos.amung.us |
widgets.amung.us
|
1 | www.gstatic.com |
134-209-209-240.cprapid.com
|
1 | widgets.amung.us |
134-209-209-240.cprapid.com
|
27 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
134-209-209-240.cprapid.com ZeroSSL RSA Domain Secure Site CA |
2023-04-13 - 2023-07-12 |
3 months | crt.sh |
*.amung.us Sectigo RSA Domain Validation Secure Server CA |
2022-05-18 - 2023-06-17 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
*.dtscout.com GTS CA 1P5 |
2023-03-29 - 2023-06-27 |
3 months | crt.sh |
*.tynt.com Sectigo RSA Domain Validation Secure Server CA |
2022-09-07 - 2023-09-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://134-209-209-240.cprapid.com/nordcard/process.php
Frame ID: 2CFF1F58305DF28AE6A8C4A54A67549A
Requests: 28 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
process.php
134-209-209-240.cprapid.com/nordcard/ |
18 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-90d1ba6c2eef1d8f73fc94069cfe444b.css
134-209-209-240.cprapid.com/nordcard/all/ |
45 KB 45 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
translateelement.css
134-209-209-240.cprapid.com/nordcard/all/ |
18 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg
134-209-209-240.cprapid.com/nordcard/all/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nemid-830ab2367a74a48b4e61ce97be19c0bd.svg
134-209-209-240.cprapid.com/nordcard/all/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg
134-209-209-240.cprapid.com/nordcard/all/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg
134-209-209-240.cprapid.com/nordcard/all/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
no-connection-83f79e2367a313b468986e12a237c346.svg
134-209-209-240.cprapid.com/nordcard/all/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
empty-3857ebe69f653487f8c9d99adde4657f.svg
134-209-209-240.cprapid.com/nordcard/all/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
technical-error-91ca9eec9eed6ed945355d650bb10d41.svg
134-209-209-240.cprapid.com/nordcard/all/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scripts-6db7f1f3edd0e72b01f4957bf91c3b91.js.download
134-209-209-240.cprapid.com/nordcard/all/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
translate_24dp.png
134-209-209-240.cprapid.com/nordcard/all/ |
825 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner.png
134-209-209-240.cprapid.com/nordcard/all/ |
39 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
134-209-209-240.cprapid.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
134-209-209-240.cprapid.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
small.js
widgets.amung.us/ |
8 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
t.dtscout.com/i/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
25 B 126 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tc.js
cdn.tynt.com/ |
18 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
439 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 228 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
t.dtscout.com/pv/ |
51 B 328 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v2
de.tynt.com/deb/ |
4 B 327 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nordea (Banking)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| _wau object| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x2 object| Tynt object| _33Across function| __uspapi object| _dtspv4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
134-209-209-240.cprapid.com/ | Name: PHPSESSID Value: 58606154d4dc8ba7b87bb7a0c600945c |
|
.dtscout.com/ | Name: m Value: 1 |
|
.dtscout.com/ | Name: oa Value: 1 |
|
.dtscout.com/ | Name: df Value: 1681393154 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
134-209-209-240.cprapid.com
cdn.tynt.com
de.tynt.com
ic.tynt.com
t.dtscout.com
whos.amung.us
widgets.amung.us
www.gstatic.com
134.209.209.240
141.101.120.11
142.250.186.163
172.64.151.83
172.67.8.141
67.202.105.32
037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf
068ee6c88c6d2629f9a797dac9288490b736f0c944d9a46d566da7cd8f913a1b
1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213
2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1
3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c
5d0a6e3bc914db376bf187c380750b197c317e1bf40fab9ad959ad5facd8f9ed
6bb27299ef7a2f71792920ae936f4f0800cf1a43ff5f8b4c835233fde4c1e387
867e8c0f65910529d214a22ff58f5ad38158e1c104cc1706c94d5f4d3780944c
8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1
8e1e6a423fe4cb2269f135e385e879649a3757d2dea56b782f2f2ff9cce5d8d0
9fc5b5c44107cfc6701be07fa5d5a4d7ab066607dd7ab6e9f396ac709e28424f
a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7
b1804777ba20dafab3f354093af8b20442bec0eb61b2d34ea8a735a3bfefa278
cd97677281045914c276cf2caa2fcbf3d594e3478509346726aa48fc43ca3004
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3f8abf80b9a014a5f3c0f7c2e32545e9d686a677d0db227144af0f967338b28
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac