![](/screenshots/6a19873a-d2c2-4e77-8219-4e5090ba0842.png)
santonderespana.wpdevcloud.com
Open in
urlscan Pro
2607:1b00:93b2:e42c::33f
Malicious Activity!
Public Scan
Effective URL: http://santonderespana.wpdevcloud.com/cli/add/sms.html
Submission: On April 14 via manual from NO
Summary
This is the only time santonderespana.wpdevcloud.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nordea (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2607:1b00:93b... 2607:1b00:93b2:e42c::33f | 54456 (CLOUDACCE...) (CLOUDACCESS-NETWORK) | |
18 | 158.233.249.2 158.233.249.2 | 201271 (NORDEA-AS) (NORDEA-AS) | |
1 | 2606:4700::68... 2606:4700::6810:85e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 23.135.144.200 23.135.144.200 | 14102 (GTVR) (GTVR) | |
1 | 2a00:1450:400... 2a00:1450:4001:814::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:84e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:820::2003 | 15169 (GOOGLE) (GOOGLE) | |
33 | 12 |
ASN54456 (CLOUDACCESS-NETWORK, US)
santonderespana.wpdevcloud.com |
ASN14102 (GTVR, CA)
PTR: 23.135.144.200.static.penseweb.com
www.lavictoiredelamour.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
nordea.no
nettbanken.nordea.no |
888 KB |
2 |
gstatic.com
fonts.gstatic.com |
18 KB |
2 |
googleapis.com
fonts.googleapis.com |
2 KB |
2 |
bootstrapcdn.com
netdna.bootstrapcdn.com |
14 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com |
8 KB |
2 |
wpdevcloud.com
santonderespana.wpdevcloud.com |
7 KB |
1 |
lavictoiredelamour.org
www.lavictoiredelamour.org |
2 KB |
33 | 7 |
Domain | Requested by | |
---|---|---|
18 | nettbanken.nordea.no |
santonderespana.wpdevcloud.com
nettbanken.nordea.no |
2 | fonts.gstatic.com |
santonderespana.wpdevcloud.com
|
2 | fonts.googleapis.com |
santonderespana.wpdevcloud.com
|
2 | netdna.bootstrapcdn.com |
santonderespana.wpdevcloud.com
|
2 | cdnjs.cloudflare.com |
santonderespana.wpdevcloud.com
|
2 | santonderespana.wpdevcloud.com |
nettbanken.nordea.no
santonderespana.wpdevcloud.com |
1 | www.lavictoiredelamour.org |
santonderespana.wpdevcloud.com
|
33 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.nordea.no |
Subject Issuer | Validity | Valid | |
---|---|---|---|
nettbanken.nordea.no Entrust Certification Authority - L1M |
2019-09-12 - 2020-09-12 |
a year | crt.sh |
cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2019-09-14 - 2020-10-13 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-03-24 - 2020-06-16 |
3 months | crt.sh |
lavictoiredelamour.org Let's Encrypt Authority X3 |
2020-03-09 - 2020-06-07 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-03-24 - 2020-06-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://santonderespana.wpdevcloud.com/cli/add/sms.html
Frame ID: E7A7E56CD0E86F00124FACF434D77681
Requests: 33 HTTP requests in this frame
Screenshot
![](/screenshots/6a19873a-d2c2-4e77-8219-4e5090ba0842.png)
Page URL History Show full URLs
- http://santonderespana.wpdevcloud.com/cli/add/loading.html Page URL
- http://santonderespana.wpdevcloud.com/cli/add/sms.html Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
animate.css (Web Frameworks) Expand
Detected patterns
- html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
![](/vendor/wappa/icons/RequireJS.png)
Detected patterns
- script /require.*\.js/i
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Sådan får du BankID på mobil
Search URL Search Domain Scan URL
Title: Tilmeld dig
Search URL Search Domain Scan URL
Title: Hjælp
Search URL Search Domain Scan URL
Title: Kontakt
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://santonderespana.wpdevcloud.com/cli/add/loading.html Page URL
- http://santonderespana.wpdevcloud.com/cli/add/sms.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
loading.html
santonderespana.wpdevcloud.com/cli/add/ |
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
nettbanken.nordea.no/login/assets/javascripts-min/ |
615 KB 195 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
nettbanken.nordea.no/login/assets/stylesheets/libs/bootstrap/ |
98 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/2.0/ |
47 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
netdna.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 779 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.min.css
nettbanken.nordea.no/login/assets/stylesheets/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
require.js
nettbanken.nordea.no/login/assets/javascripts/ |
14 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
perf_stats.js
nettbanken.nordea.no/login/assets/javascripts/stats/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading_bleu.gif
www.lavictoiredelamour.org/c/vda/img/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app-store-badge.svg
nettbanken.nordea.no/login/assets/images/ |
10 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google-play-store-badge.svg
nettbanken.nordea.no/login/assets/images/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile-app-qr-code.png
nettbanken.nordea.no/login/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
nettbanken.nordea.no/login/assets/javascripts-min/ |
615 KB 195 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
stats
santonderespana.wpdevcloud.com/login/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
stats
santonderespana.wpdevcloud.com/login/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
stats
santonderespana.wpdevcloud.com/login/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
sms.html
santonderespana.wpdevcloud.com/cli/add/ |
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
nettbanken.nordea.no/login/assets/javascripts-min/ |
615 KB 195 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
nettbanken.nordea.no/login/assets/stylesheets/libs/bootstrap/ |
98 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/2.0/ |
47 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
netdna.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.min.css
nettbanken.nordea.no/login/assets/stylesheets/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
require.js
nettbanken.nordea.no/login/assets/javascripts/ |
14 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
perf_stats.js
nettbanken.nordea.no/login/assets/javascripts/stats/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app-store-badge.svg
nettbanken.nordea.no/login/assets/images/ |
10 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google-play-store-badge.svg
nettbanken.nordea.no/login/assets/images/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile-app-qr-code.png
nettbanken.nordea.no/login/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
nettbanken.nordea.no/login/assets/javascripts-min/ |
615 KB 195 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
stats
santonderespana.wpdevcloud.com/login/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- santonderespana.wpdevcloud.com
- URL
- http://santonderespana.wpdevcloud.com/login/stats
- Domain
- santonderespana.wpdevcloud.com
- URL
- http://santonderespana.wpdevcloud.com/login/stats
- Domain
- santonderespana.wpdevcloud.com
- URL
- http://santonderespana.wpdevcloud.com/login/stats
- Domain
- santonderespana.wpdevcloud.com
- URL
- http://santonderespana.wpdevcloud.com/login/stats
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nordea (Banking)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| requirejs function| require function| define function| SendData function| peStat function| pStat function| $ function| jQuery object| angular object| jQuery111107682562931872414 function| _ object| Placeholders object| jQuery11110432954237510400741 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
santonderespana.wpdevcloud.com/ | Name: IV_JCT Value: %2Flogin |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
netdna.bootstrapcdn.com
nettbanken.nordea.no
santonderespana.wpdevcloud.com
www.lavictoiredelamour.org
santonderespana.wpdevcloud.com
158.233.249.2
2001:4de0:ac19::1:b:2a
2001:4de0:ac19::1:b:3a
23.135.144.200
2606:4700::6810:84e5
2606:4700::6810:85e5
2607:1b00:93b2:e42c::33f
2a00:1450:4001:808::200a
2a00:1450:4001:814::2003
2a00:1450:4001:820::2003
2a00:1450:4001:821::200a
0f60979b728ce4cf2de33e6a9765c7adc5df57246d00478d0d1b5ef026754a76
18521983a3ed5e76f27be85023b93bb7e21301750cbbfb163e8d7bbe7e8fd2ef
377e90233074716e2b6fa4bb1c30baacbc1ebd0ac402475410c1a5d635116088
4f42f4e66299f2e67d7890f435901468dc9c7e7824c5eb1896774ab32a80cf79
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5a413ebf7a43a7e00d4fdeb7eab02f263db68be30ae07039ba6bde500934ed32
5f723ba49e0092e8a5d90472fff6844ec4c1fb97ac11c7169793d970c9f9985c
6b3648990f69d85b2f75198a36fc0f238a2937a38c617eab439c85cfc4159633
769638ff7c0df5973591a3aedf0f62deded02cb3adf7943f1e43d2789db770f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7cd8d471eec190c74051c0bee16aff8f0d8c814b12c71a872857b1b77872f97b
9ef80ad0ac199461f5c4b943cfc68af17b9d4cf3683757480f97b2ad7a7d92a7
bfa21901e87e44f386b8208764bc596acaaaa085e560bf989d40982eb0e5a7c8
e9503448692b738dd260fbd7f7cabf2e11f09b600fa97e6eb3a56eba5b1a7e9b
fa61f9a7c2e4aaa831b61058a814316ebc4cedcf82325869d4ddaade239066c8