6625hag882665.is-leet.com
Open in
urlscan Pro
69.57.163.46
Malicious Activity!
Public Scan
Submission: On December 13 via manual from NO — Scanned from NO
Summary
TLS certificate: Issued by R3 on December 12th 2022. Valid for: 3 months.
This is the only time 6625hag882665.is-leet.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BankID (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 69.57.163.46 69.57.163.46 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 142.250.186.106 142.250.186.106 | 15169 (GOOGLE) (GOOGLE) | |
2 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 4 |
ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f10.1e100.net
translate.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
is-leet.com
6625hag882665.is-leet.com |
9 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 211 |
35 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 750 |
14 KB |
1 |
googleapis.com
translate.googleapis.com — Cisco Umbrella Rank: 814 |
4 KB |
7 | 4 |
Domain | Requested by | |
---|---|---|
3 | 6625hag882665.is-leet.com |
6625hag882665.is-leet.com
|
2 | cdnjs.cloudflare.com |
6625hag882665.is-leet.com
|
1 | maxcdn.bootstrapcdn.com |
6625hag882665.is-leet.com
|
1 | translate.googleapis.com |
6625hag882665.is-leet.com
|
7 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
6625hag882665.is-leet.com R3 |
2022-12-12 - 2023-03-12 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-11-07 - 2023-01-30 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://6625hag882665.is-leet.com/no/login/index.php
Frame ID: BF36E7BC5CD287D35C79F330F78DBEE5
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
BankIDDetected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
6625hag882665.is-leet.com/no/login/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authorization.css
6625hag882665.is-leet.com/no/login/assets/ |
14 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translateelement.css
translate.googleapis.com/translate_static/css/ |
18 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bankid-logo.28f35de5.svg
6625hag882665.is-leet.com/no/login/assets/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/1.6.1/ |
89 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.16.0/ |
23 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BankID (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| $ function| jQuery object| bootstrap1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
6625hag882665.is-leet.com/ | Name: PHPSESSID Value: 87t2jeu8kus60ptll6srlqukqb |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
6625hag882665.is-leet.com
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
translate.googleapis.com
104.17.24.14
104.18.11.207
142.250.186.106
69.57.163.46
484e8282229f40d3e277f96ca4584b7d6c863f4270f5294bc52c365f5e6473fc
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898
939400928b7e464e4b467b2059bcbce04cdb83c7dcdf81c1c413b496a25bb7c5
c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
d39ee51a9c2d61184a78111c731cce4b32488c99bcc9b1f8c236705d06145166
e326fddc54314243d8985a5f93afffd8ed90cc229a25f61c9514e23cd69c6dd5
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b