![](/screenshots/767a26c3-e56e-4393-913c-5985b409c5a8.png)
vaps12.wpengine.com
Open in
urlscan Pro
34.75.54.190
Malicious Activity!
Public Scan
Submission: On August 28 via api from US — Scanned from US
Summary
This is the only time vaps12.wpengine.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BankID (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 34.75.54.190 34.75.54.190 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 155.55.150.1 155.55.150.1 | 2119 (TELENOR-N...) (TELENOR-NEXTEL Telenor Norge AS) | |
6 | 3 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 190.54.75.34.bc.googleusercontent.com
vaps12.wpengine.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
wpengine.com
vaps12.wpengine.com |
28 KB |
1 |
nav.no
www.nav.no — Cisco Umbrella Rank: 679964 |
26 KB |
6 | 2 |
Domain | Requested by | |
---|---|---|
5 | vaps12.wpengine.com |
vaps12.wpengine.com
|
1 | www.nav.no |
vaps12.wpengine.com
|
6 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.nav.no Buypass Class 3 CA 2 |
2023-03-06 - 2024-03-08 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://vaps12.wpengine.com/nav/nav/id.html
Frame ID: 84D262FF4BFC3F8BFC9F359867ADBCFD
Requests: 9 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
id.html
vaps12.wpengine.com/nav/nav/ |
22 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common_auth.css
vaps12.wpengine.com/nav/nav/src/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bidm.css
vaps12.wpengine.com/nav/nav/src/ |
42 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3625.css
vaps12.wpengine.com/nav/nav/src/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo1.png
vaps12.wpengine.com/nav/nav/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google-search-nav-logo.png
www.nav.no/gfx/ |
24 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
240 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
172 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BankID (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
vaps12.wpengine.com
www.nav.no
155.55.150.1
34.75.54.190
254868d92f9456d518064051d29f9ff0532bf9a5da291b06f8accb0900e40072
304c378b4700d25f783a2a7d6142c0b4d9dd9df890722064788eee96a12999d8
31412635ed02fd2c9a9ac4c4d9093c0601a687cfe305aba0dea75c1943d7dd72
4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766
5d4ff4117e8f7f9da541cba635327a05770499b79e51e32e679c2923a4bc27b2
60c6c245a5e97421c84d55fe1d640edfddf35b3fc756377dea012ee4c23be0ab
7fbcb3628e9d79d89e9350ee5d075818cf0f6763d5fa8763ea78c13902d6691b
c241b453517b1675cf759fb714476fc4c2f606863aad5053d3e707a5103dce4a
f4eb244555324863a9067686a9e08c9bd7db827ed8dd9a0de8a3cdbc32b66437