urlscan.io logo urlscan.io
SecurityTrails logo

udkaksaray.com Open in urlscan Pro
37.230.106.206  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://udkaksaray.com/cli/f/login1.php
Submission: On February 02 via manual from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 27 HTTP transactions. The main IP is 37.230.106.206, located in Istanbul, Turkey and belongs to AEROTEK-AS, TR. The main domain is udkaksaray.com.
This is the only time udkaksaray.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

IP Address AS Autonomous System
12 37.230.106.206 42807 (AEROTEK-AS)
13 158.233.249.7 201271 (NORDEA-AS)
1 34.107.253.133 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
27 4
Domain Requested by
13 solo1.nordea.fi udkaksaray.com
solo1.nordea.fi
12 udkaksaray.com udkaksaray.com
1 ajax.googleapis.com udkaksaray.com
1 policy.cookiereports.com udkaksaray.com
27 4
Subject Issuer Validity Valid
solo1.nordea.fi
Entrust Certification Authority - L1M		 2020-10-08 -
2021-10-08		 a year crt.sh

This page contains 1 frames:

Primary Page: http://udkaksaray.com/cli/f/login1.php
Frame ID: 147BFB1AD1D336AA28FBCB949F7BA68C
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Page Statistics

27
Requests

48 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

106 kB
Transfer

401 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login1.php
udkaksaray.com/cli/f/ 		117 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
5fa97e7af939a00dfad7f6bbc8f267a5efee19f08e88794ccf585c06f23b0227
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Host
udkaksaray.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection
Keep-Alive
X-Powered-By
PHP/7.3.23
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Tue, 02 Feb 2021 06:49:58 GMT
X-Content-Type-Options
nosniff
nordeapn4134.css
solo1.nordea.fi/nsp/css/ 		64 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
4ea8c5d1cfe47987cbcef1d45925812c57bfe450f148fb5f97d6771ae8befeaa
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 Jan 2021 16:27:04 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
ntCoent-Length
65665
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=UTF-8
Cache-Control
private
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
logoprint.gif
udkaksaray.com/cli/f/general/images/ 		1000 B
1000 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://udkaksaray.com/cli/f/general/images/logoprint.gif
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
new_nordea_logo.gif
solo1.nordea.fi/nsp/general/images/ 		987 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/new_nordea_logo.gif
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
416c43c7789970ffa77271a78cb9ea02eebf7191fdcc4d15d13501c9cdb30c0d
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Mon, 11 May 2020 23:54:07 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
987
headline_netbank.gif
solo1.nordea.fi/nsp/dev/fullsize/htmlcss/fi_FI/images/ 		827 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/dev/fullsize/htmlcss/fi_FI/images/headline_netbank.gif
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
f22d3649d56bf8c49dee3bbf8a167d3ac450016273d8fcccdb6772fc4f062c12
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Mon, 11 May 2020 23:55:18 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
827
jquery-1.12.4.min.js
udkaksaray.com/cli/f/js/jquery/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://udkaksaray.com/cli/f/js/jquery/jquery-1.12.4.min.js
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
IncorrectInput.gif
udkaksaray.com/cli/f/general/images/ 		1000 B
1000 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://udkaksaray.com/cli/f/general/images/IncorrectInput.gif
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
pi4_Netbank-fi-launch-186X130-FI.jpg.jpg
udkaksaray.com/web_elements/images/web/local/fi3/fi/Picture/ 		1000 B
1000 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://udkaksaray.com/web_elements/images/web/local/fi3/fi/Picture/pi4_Netbank-fi-launch-186X130-FI.jpg.jpg
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
ic4_icon_popup.gif
udkaksaray.com/web_elements/images/web/common/content/All/Icon/ 		1000 B
1000 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://udkaksaray.com/web_elements/images/web/common/content/All/Icon/ic4_icon_popup.gif
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
ic4_icon_arrow.gif
udkaksaray.com/web_elements/images/web/local/fi3/All/Icon/ 		1000 B
1000 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://udkaksaray.com/web_elements/images/web/local/fi3/All/Icon/ic4_icon_arrow.gif
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
bt.gif
udkaksaray.com/cli/f/general/images/ 		1000 B
1000 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://udkaksaray.com/cli/f/general/images/bt.gif
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
81c22331735c164f946337232024b6d7e1625b37dfe774c03076226ac0c65163
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
tealium_FI.js
udkaksaray.com/cli/f/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://udkaksaray.com/cli/f/js/tealium_FI.js
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
createPageTitleAndContentGroup_WT.js
udkaksaray.com/cli/f/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://udkaksaray.com/cli/f/js/createPageTitleAndContentGroup_WT.js
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
f09f6a78_panel-fi.js
policy.cookiereports.com/ 		120 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://policy.cookiereports.com/f09f6a78_panel-fi.js
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
34.107.253.133 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
133.253.107.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
35def5406cfa802d28edb7ea4bedea9a52590a230fda05008c7d7f50fee03a67

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Via
1.1 google
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public,max-age=3600
Transfer-Encoding
chunked
Content-Encoding
gzip
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 26 Jan 2021 18:31:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
562727
Cross-Origin-Resource-Policy
cross-origin
Content-Length
31021
X-XSS-Protection
0
Last-Modified
Fri, 08 May 2020 07:05:03 GMT
Server
sffe
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Expires
Wed, 26 Jan 2022 18:31:11 GMT
tab_left_on.gif
solo1.nordea.fi/nsp/general/images/ 		146 B
731 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/tab_left_on.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
afa364466000fd40797a1f566c025d6306131179d284aeee1a24825b6f594397
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Mon, 11 May 2020 23:57:10 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
146
tab_right_on.gif
solo1.nordea.fi/nsp/general/images/ 		374 B
959 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/tab_right_on.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
5dd358892efe04d5013be059df15be67ec2e2baf532584c5678d3f30d8e29951
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Mon, 11 May 2020 23:59:24 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
374
tab_left.gif
solo1.nordea.fi/nsp/general/images/ 		383 B
968 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/tab_left.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
0418589b166ace440d1803124f08b913868e0929bd14e1951f4383347cc6a149
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Tue, 12 May 2020 00:01:30 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
383
tab_right.gif
solo1.nordea.fi/nsp/general/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/tab_right.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
44a89d72c65a0becbc9458eada2156301143c423095decd950303d7a44128131
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Mon, 11 May 2020 23:59:23 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
1708
tabC_background.gif
solo1.nordea.fi/nsp/general/images/ 		54 B
638 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/tabC_background.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
20b64bed9c688786e32515b5ae1d05692cce12fd8ce2c9313f84a3c0fedbadf7
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Mon, 11 May 2020 23:59:24 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
54
tabC_left.gif
solo1.nordea.fi/nsp/general/images/ 		231 B
816 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/tabC_left.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
0c890d3ab9c18caca77a012366dbf880a06eabd93fb066a12ded4dca005f3a16
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:59 GMT
Last-Modified
Tue, 12 May 2020 00:00:24 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
231
tabC_right.gif
solo1.nordea.fi/nsp/general/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/tabC_right.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
4313ac7ef8101848558c691f423fed35650f4420835460aa7fb5880ea9172de3
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:59 GMT
Last-Modified
Tue, 12 May 2020 00:00:24 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
2004
tabC_left_on.gif
solo1.nordea.fi/nsp/general/images/ 		173 B
757 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/tabC_left_on.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
a6862835b321ceba2b9c159f9677d7b73b83f529aaaf7077d21c0324c0c84eee
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Mon, 11 May 2020 23:59:24 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
173
tabC_right_on.gif
solo1.nordea.fi/nsp/general/images/ 		627 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/tabC_right_on.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
cd640ec6972da2912796f181f490b0e5ddf151a378ff448f9dd820f589951247
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Mon, 11 May 2020 23:55:12 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
627
tealium_FI.js
udkaksaray.com/cli/f/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://udkaksaray.com/cli/f/js/tealium_FI.js
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:59 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531
bar1_bg.gif
solo1.nordea.fi/nsp/general/images/ 		180 B
765 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://solo1.nordea.fi/nsp/general/images/bar1_bg.gif
Requested by
Host: solo1.nordea.fi
URL: https://solo1.nordea.fi/nsp/css/nordeapn4134.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.7 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
fc2c3b723631f2dcd5777133c97c2aaee28ea7bc9a498680e7fc8b4afee262e6
Security Headers
Name Value
Strict-Transport-Security max-age=157680000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://solo1.nordea.fi/nsp/css/nordeapn4134.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 02 Feb 2021 06:49:58 GMT
Last-Modified
Mon, 11 May 2020 23:54:00 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Strict-Transport-Security
max-age=157680000
Accept-Ranges
bytes
Content-Length
180
createPageTitleAndContentGroup_WT.js
udkaksaray.com/cli/f/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://udkaksaray.com/cli/f/js/createPageTitleAndContentGroup_WT.js
Requested by
Host: udkaksaray.com
URL: http://udkaksaray.com/cli/f/login1.php
Protocol
HTTP/1.1
Server
37.230.106.206 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS
srvc49.turhost.com
Software
/ PHP/7.3.23
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://udkaksaray.com/cli/f/login1.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Feb 2021 06:49:59 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Powered-By
PHP/7.3.23
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
531

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| GetMessageByChannelID function| GetSystemStatusUrl function| GetQueryStringParams function| success function| error function| parseSystemStatusToolResponse function| autoTab function| formSubmit number| formSubmitted function| toggleRadioButton string| currDate string| currTime string| invoiceNumber string| pageId object| utag_data string| tealium_url undefined| _tag function| call_webtrends function| addLoadEvent function| create_Tealium_tags object| _cookiereports function| $ function| jQuery function| justdoit function| create_WT_tags object| cookieTable object| elm

1 Cookies

Domain/Path Name / Value
udkaksaray.com/ Name: d9d2d2597b03978892fdb29ba1ee1650
Value: 0c3e115b035eee3a2fd991838c9aee4b

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff