logon.e-boks.dk
Open in
urlscan Pro
104.111.238.84
Malicious Activity!
Public Scan
Effective URL: https://logon.e-boks.dk/nemid/logon?siteid=21
Submission: On December 06 via api from CZ
Summary
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on September 10th 2018. Valid for: 2 years.
This is the only time logon.e-boks.dk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Danske Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 6 | 104.111.238.84 104.111.238.84 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 95.100.68.245 95.100.68.245 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
5 | 2 |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-238-84.deploy.static.akamaitechnologies.com
www.e-boks.dk | |
logon.e-boks.dk |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-68-245.deploy.static.akamaitechnologies.com
applet.danid.dk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
e-boks.dk
2 redirects
www.e-boks.dk logon.e-boks.dk |
32 KB |
1 |
danid.dk
applet.danid.dk |
|
5 | 2 |
Domain | Requested by | |
---|---|---|
5 | logon.e-boks.dk |
1 redirects
logon.e-boks.dk
|
1 | applet.danid.dk |
logon.e-boks.dk
|
1 | www.e-boks.dk | 1 redirects |
5 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.e-boks.dk |
www.nemid.nu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.e-boks.dk DigiCert SHA2 Extended Validation Server CA |
2018-09-10 - 2020-09-09 |
2 years | crt.sh |
applet.danid.dk GlobalSign Organization Validation CA - SHA256 - G2 |
2017-05-16 - 2020-07-06 |
3 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://logon.e-boks.dk/nemid/logon?siteid=21
Frame ID: 0CFB9C11A873A2A729482D99F3A6D4D3
Requests: 4 HTTP requests in this frame
Frame:
https://applet.danid.dk/launcher/std/637112740728032093
Frame ID: DA0B0DA6723E020FE1BBDC78B9D4DC2D
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.e-boks.dk/privat
HTTP 302
https://logon.e-boks.dk/handler/logontologonprovider.aspx?siteid=21&ReturnUrl=%2fprivat HTTP 302
https://logon.e-boks.dk/nemid/logon?siteid=21 Page URL
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Problemer med at logge på med NemID
Search URL Search Domain Scan URL
Title: Certifikat/Signatur er udløbet
Search URL Search Domain Scan URL
Title: Bestil NemID
Search URL Search Domain Scan URL
Title: Download NemID Nøgleapp
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.e-boks.dk/privat
HTTP 302
https://logon.e-boks.dk/handler/logontologonprovider.aspx?siteid=21&ReturnUrl=%2fprivat HTTP 302
https://logon.e-boks.dk/nemid/logon?siteid=21 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
logon
logon.e-boks.dk/nemid/ Redirect Chain
|
9 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
logon.e-boks.dk/nemid/Content/stylesheet/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
e-boks_dk_invert_304x60.png
logon.e-boks.dk/nemid/Content/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
637112740728032093
applet.danid.dk/launcher/std/ Frame DA0B |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nemid_super_croped.png
logon.e-boks.dk/nemid/Content/images/backgrounds/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Danske Bank (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| onNemIDMessage4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
applet.danid.dk/ | Name: JSESSIONID Value: 0000qDQ78ryXHDgjh6cp-6bZdHP:D048D30345ACDA01000002D80000003400000048 |
|
logon.e-boks.dk/ | Name: TS01516053 Value: 017d9aa4c01a6f3cd3aff800bc81a72c9334a1aee90af0beddeab2d7240f19ab40a2599e625309f04f8413a09ce267730dd7409e8f18ed768006e85c41f0c9e2265b924e001723cc639f0c2bfcc2058f58f31fe873 |
|
logon.e-boks.dk/ | Name: BIGipServer~e-boks_prod~e-boks_prod_pool_external_combined-1_default-pool Value: rd5001o00000000000000000000ffff0aff121do80 |
|
logon.e-boks.dk/ | Name: ASP.NET_SessionId Value: ny43gv5nztmobrhawtaw1mz5 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
applet.danid.dk
logon.e-boks.dk
www.e-boks.dk
104.111.238.84
95.100.68.245
1268e8b51c10aaa0639b24c7d107e645f7052d40b5850a4bd3fb193e03f54262
3eb52bc81bb2cc13053f13d00e24dc356397a176874772966c0a34107c5ac51f
84924f104696624417468f578a1ccbc37e6e0da1d4dd28d705b914209b710afc
b886a602141dedad0d1cebbba9310bc97a1d2018ff478b1b3d8fce51cf9810ad