sakerhetnordea.com Open in urlscan Pro
104.244.74.248 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sakerhetnordea.com/
Effective URL:
https://sakerhetnordea.com/login.php
Submission: On April 12 via manual (April 12th 2021, 6:39:54 am UTC) from DK

Summary HTTP 6 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 104.244.74.248, located in Phoenix, United States and belongs to PONYNET, US. The main domain is sakerhetnordea.com.
TLS certificate: Issued by R3 on April 11th 2021. Valid for: 3 months.

This is the only time sakerhetnordea.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	104.244.74.248 104.244.74.248	53667 (PONYNET) (PONYNET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
6	4

4 104.244.74.248 (Phoenix, United States)

ASN53667 (PONYNET, US)
PTR: tesla.bulletproofservers.net

sakerhetnordea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	sakerhetnordea.com sakerhetnordea.com	443 KB
1	googleapis.com fonts.googleapis.com	649 B
1	jquery.com code.jquery.com	30 KB
6	3

	Domain	Requested by
4	sakerhetnordea.com	sakerhetnordea.com
1	fonts.googleapis.com	sakerhetnordea.com
1	code.jquery.com	sakerhetnordea.com
6	3

This site contains links to these domains. Also see Links.

Domain
www.nordea.se

Subject Issuer	Validity	Valid
sakerhetnordea.com R3	`2021-04-11` - `2021-07-10`	3 months	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sakerhetnordea.com/login.php
Frame ID: C274F77A64A7DE610539783A8E1A7751
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://sakerhetnordea.com/ Page URL
https://sakerhetnordea.com/login.php Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

529 kB
Transfer

957 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nordea.se/privat/produkter/mobilbank-internetbank/mobilt-bankid.html
Title: Mobilt BankID

Search URL Search Domain Scan URL

URL: https://www.nordea.se/privat/produkter/mobilbank-internetbank/bank-id.html
Title: BankID på kort och fil (Företagsanvändning)

Search URL Search Domain Scan URL

URL: https://www.nordea.se/privat/kundservice/qr-lasare.html
Title: www.nordea.se/qrläsare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sakerhetnordea.com/ Page URL
https://sakerhetnordea.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
15 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
sakerhetnordea.com/ 53 B
425 B 697ms
581ms Document
text/html 104.244.74.248
PONYNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sakerhetnordea.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.74.248 Phoenix, United States, ASN53667 (PONYNET, US),
Reverse DNS: tesla.bulletproofservers.net
Software: LiteSpeed / PHP/7.4.16
Resource Hash: 1eb225faab324e03b5780502bfce371f58ca4ac452201afaa85dbb7b2c7b3597

Request headers

:method: GET
:authority: sakerhetnordea.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

x-powered-by: PHP/7.4.16
set-cookie: PHPSESSID=550603a119c0182c7c1e089ddb5e0796; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 50
content-encoding: br
vary: Accept-Encoding
date: Mon, 12 Apr 2021 06:39:35 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000

GET
H3-Q050 200 Primary Request login.php Show response
sakerhetnordea.com/ 674 KB
440 KB 134ms
76ms Document
text/html 104.244.74.248
PONYNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sakerhetnordea.com/login.php
Requested by: Host: sakerhetnordea.com
URL: https://sakerhetnordea.com/
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 104.244.74.248 Phoenix, United States, ASN53667 (PONYNET, US),
Reverse DNS: tesla.bulletproofservers.net
Software: LiteSpeed / PHP/7.4.16
Resource Hash: f3443aa149ae8374259b35ee8415994d161036912cf8de5a0f2561083bcbe609

Request headers

:method: GET
:authority: sakerhetnordea.com
:scheme: https
:path: /login.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://sakerhetnordea.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=550603a119c0182c7c1e089ddb5e0796
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1
Referer: https://sakerhetnordea.com/

Response headers

x-powered-by: PHP/7.4.16
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-encoding: br
vary: Accept-Encoding
date: Mon, 12 Apr 2021 06:39:35 GMT
server: LiteSpeed

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ce22eb0c405b78a4247ec19eba5816e03a01a3c065e84a2bc58a23875cd1efc7

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 891 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b34c9039b5f92575e57676734ec42dd908ef1877fe59a4d55b4277db69663830

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 556 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ece7471dc4c8af2f310af1a97a9147c72602165e5d9542536b3bd51535027515

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 642 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b76503946c6f19f7150b0950f704eac5cb94842b7698ea8eb9b0d4372b1bd05

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 67 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9dd630e7cbf1a068b89a5a134e248ff63f2d452081bf86684aeb4b7f73712b76

Request headers

Origin: https://sakerhetnordea.com
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: application/font-woff2

GET
DATA 200
OK truncated
/ 26 KB
26 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03

Request headers

Origin: https://sakerhetnordea.com
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: application/font-woff2

GET
DATA 200
OK truncated
/ 26 KB
26 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff

Request headers

Origin: https://sakerhetnordea.com
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: application/font-woff2

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 27ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: sakerhetnordea.com
URL: https://sakerhetnordea.com/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Origin: https://sakerhetnordea.com
Referer: https://sakerhetnordea.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 12 Apr 2021 06:39:36 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 23:02:39 GMT
server: nginx
etag: W/"5eb09f0f-15d84"
vary: Accept-Encoding
x-hw: 1618209576.dop225.fr8.t,1618209576.cds260.fr8.hn,1618209576.cds142.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30879

GET
H3-Q050 200 jquery.loadingModal.min.js Show response
sakerhetnordea.com/assets/js/ 7 KB
1 KB 61ms
59ms Script
application/javascript 104.244.74.248
PONYNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sakerhetnordea.com/assets/js/jquery.loadingModal.min.js
Requested by: Host: sakerhetnordea.com
URL: https://sakerhetnordea.com/login.php
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 104.244.74.248 Phoenix, United States, ASN53667 (PONYNET, US),
Reverse DNS: tesla.bulletproofservers.net
Software: LiteSpeed /
Resource Hash: 43ba19a87cfa987a34f01807aa0588a4491cbeb46d67a7cd7277b8baac4eb08d

Request headers

Referer: https://sakerhetnordea.com/login.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 12 Apr 2021 06:39:36 GMT
content-encoding: br
last-modified: Sat, 09 Jan 2021 23:21:12 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1372
expires: Mon, 19 Apr 2021 06:39:36 GMT

GET
H3-Q050 200 jquery.loadingModal.min.css
sakerhetnordea.com/assets/css/ 16 KB
2 KB 61ms
60ms Stylesheet
text/css 104.244.74.248
PONYNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sakerhetnordea.com/assets/css/jquery.loadingModal.min.css
Requested by: Host: sakerhetnordea.com
URL: https://sakerhetnordea.com/login.php
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 104.244.74.248 Phoenix, United States, ASN53667 (PONYNET, US),
Reverse DNS: tesla.bulletproofservers.net
Software: LiteSpeed /
Resource Hash: 267d912e0f06afd6d687237d658cdb12737185b9730493e66a5637307a6a5011

Request headers

Referer: https://sakerhetnordea.com/login.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 12 Apr 2021 06:39:36 GMT
content-encoding: br
last-modified: Sat, 09 Jan 2021 23:20:58 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1920
expires: Mon, 19 Apr 2021 06:39:36 GMT

GET
DATA 200
OK truncated
/ 26 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8eb48d905562a6a100dd41183a7782d8505478c21728b69f73fdf2b2a6f76ab

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/jpeg

GET
H2 200 css
fonts.googleapis.com/ 2 KB
649 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans

Requested by

Host: sakerhetnordea.com
URL: https://sakerhetnordea.com/assets/css/jquery.loadingModal.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cf7a2b3976c3af63dc2bca70cc5625a26341f19b1ccd484feddf076df895ed58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://sakerhetnordea.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
date: Mon, 12 Apr 2021 06:39:36 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 12 Apr 2021 06:39:36 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sakerhetnordea.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 550603a119c0182c7c1e089ddb5e0796

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fonts.googleapis.com
sakerhetnordea.com
104.244.74.248
2001:4de0:ac18::1:a:3a
2a00:1450:4001:800::200a
037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf
0b76503946c6f19f7150b0950f704eac5cb94842b7698ea8eb9b0d4372b1bd05
1eb225faab324e03b5780502bfce371f58ca4ac452201afaa85dbb7b2c7b3597
267d912e0f06afd6d687237d658cdb12737185b9730493e66a5637307a6a5011
3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72
43ba19a87cfa987a34f01807aa0588a4491cbeb46d67a7cd7277b8baac4eb08d
443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03
4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1
9dd630e7cbf1a068b89a5a134e248ff63f2d452081bf86684aeb4b7f73712b76
a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7
a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff
b34c9039b5f92575e57676734ec42dd908ef1877fe59a4d55b4277db69663830
ce22eb0c405b78a4247ec19eba5816e03a01a3c065e84a2bc58a23875cd1efc7
cf7a2b3976c3af63dc2bca70cc5625a26341f19b1ccd484feddf076df895ed58
d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0
e8eb48d905562a6a100dd41183a7782d8505478c21728b69f73fdf2b2a6f76ab
ece7471dc4c8af2f310af1a97a9147c72602165e5d9542536b3bd51535027515
f3443aa149ae8374259b35ee8415994d161036912cf8de5a0f2561083bcbe609
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

sakerhetnordea.com Open in urlscan Pro 104.244.74.248 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

529 kBTransfer

957 kBSize

1 Cookies

3 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 15 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

sakerhetnordea.com Open in urlscan Pro
104.244.74.248 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

529 kB
Transfer

957 kB
Size

1
Cookies

6 HTTP transactions
15 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!