wecarecursos.com - urlscan.io

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 108.167.188.20, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is wecarecursos.com.

This is the only time wecarecursos.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Danske Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	108.167.188.20 108.167.188.20	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	212.93.38.8 212.93.38.8	12483 (DANSKEBAN...) (DANSKEBANK-AS Aarhus Denmark)
1	212.93.61.97 212.93.61.97	12483 (DANSKEBAN...) (DANSKEBANK-AS Aarhus Denmark)
7	4

2 108.167.188.20 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: br354-ip03.hostgator.com.br

wecarecursos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.93.38.8 (Denmark)

ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK)

shared-logon.danskebank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.93.61.97 (Denmark)

ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK)

danskebank.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	wecarecursos.com wecarecursos.com	2 KB
1	danskebank.fi danskebank.fi	5 KB
1	danskebank.com shared-logon.danskebank.com — Cisco Umbrella Rank: 408738	2 KB
7	3

	Domain	Requested by
2	wecarecursos.com	wecarecursos.com
1	danskebank.fi	wecarecursos.com
1	shared-logon.danskebank.com	wecarecursos.com shared-logon.danskebank.com
7	3

This site contains no links.

Subject Issuer	Validity	Valid
shared-logon.danskebank.com GlobalSign RSA OV SSL CA 2018	`2023-03-26` - `2024-04-26`	a year	crt.sh
www.danskebank.fi GlobalSign ECC OV SSL CA 2018	`2024-01-23` - `2025-02-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://wecarecursos.com/fi/
Frame ID: 5C047C404A1795E54896B94B4BA0B0BE
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Tunnistaudu palveluun: Allekirjoituspalvelu - ID: Y7SX

Page Statistics

7
Requests

29 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

9 kB
Transfer

13 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
wecarecursos.com/fi/ 4 KB
2 KB 271ms
121ms Document
text/html 108.167.188.20
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: http://wecarecursos.com/fi/
Protocol: HTTP/1.1
Server: 108.167.188.20 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: br354-ip03.hostgator.com.br
Software: Apache /
Resource Hash: 1989ffa455347abef138d3b062053584d7c0d052ee80ca2abfd8bfc6a57d66a8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 1618
Content-Type: text/html; charset=UTF-8
Date: Sun, 10 Mar 2024 15:54:05 GMT
Keep-Alive: timeout=5, max=75
Server: Apache
Upgrade: h2,h2c
Vary: Accept-Encoding

GET
H/1.1 200
OK main.2b901aef.css
shared-logon.danskebank.com/logon/default/static/css/ 5 KB
2 KB 829ms
159ms Stylesheet
text/css 212.93.38.8
DANSKEBANK-AS Aar...

General

Check archive.org

Show headers Download Go to

Full URL

https://shared-logon.danskebank.com/logon/default/static/css/main.2b901aef.css

Requested by

Host: wecarecursos.com
URL: http://wecarecursos.com/fi/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

212.93.38.8 , Denmark, ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK),

Reverse DNS

Software

/

Resource Hash

f0228a65851c12b5da774f1ee2d931aa3fd2352914ef6de25c1c9d6dd1426627

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: en-US,en;q=0.9
Referer: http://wecarecursos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Mar 2024 15:54:06 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=157680000
last-modified: Tue, 05 Mar 2024 14:08:49 GMT
etag: W/"1421-18e0ef21168"
vary: Accept-Encoding
transfer-encoding: chunked
content-type: text/css; charset=UTF-8
cache-control: no-cache
accept-ranges: bytes
keep-alive: timeout=5

GET
H/1.1 404
Not Found main.2b901aef.css
wecarecursos.com/fi/static/css/ 0
0 254ms
254ms Stylesheet
text/html 108.167.188.20
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: http://wecarecursos.com/fi/static/css/main.2b901aef.css
Requested by: Host: wecarecursos.com
URL: http://wecarecursos.com/fi/
Protocol: HTTP/1.1
Server: 108.167.188.20 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: br354-ip03.hostgator.com.br
Software: Apache /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: http://wecarecursos.com/fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Sun, 10 Mar 2024 15:54:05 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <https://wecarecursos.com/wp-json/>; rel="https://api.w.org/"
Content-Length: 12564
Keep-Alive: timeout=5, max=74
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK danske-bank-logo.svg
danskebank.fi/-/media/danske-bank/img/ 4 KB
5 KB 684ms
239ms Image
image/svg+xml 212.93.61.97
DANSKEBANK-AS Aar...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://danskebank.fi/-/media/danske-bank/img/danske-bank-logo.svg

Requested by

Host: wecarecursos.com
URL: http://wecarecursos.com/fi/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

212.93.61.97 , Denmark, ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK),

Reverse DNS

Software

/

Resource Hash

2566dcb0230f1ae2412d24ade3f940e3e6a6b3b6ee40501711bf53abc19386a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: http://wecarecursos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date: Sun, 10 Mar 2024 15:54:05 GMT
Strict-Transport-Security: max-age=157680000
X-Content-Type-Options: nosniff
Content-Disposition: inline; filename="danske-bank-logo.svg"
Connection: keep-alive
Content-Length: 4322
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 07 Feb 2018 13:37:02 GMT
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
ETag: dcb1c2e36945431fa0c242285e339349
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
Content-Type: image/svg+xml
Origin-Agent-Cluster: ?0
X-Farm: 7A
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type

GET dk_text-webfont.50529db33ac4e983017c.woff2
shared-logon.danskebank.com/logon/default/static/media/ 0
0

GET dk_text-webfont.c9aa6505bf324e3397eb.woff
shared-logon.danskebank.com/logon/default/static/media/ 0
0

GET dk_text-webfont.09946ad1b366746e0749.ttf
shared-logon.danskebank.com/logon/default/static/media/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: shared-logon.danskebank.com
URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.50529db33ac4e983017c.woff2

Domain: shared-logon.danskebank.com
URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.c9aa6505bf324e3397eb.woff

Domain: shared-logon.danskebank.com
URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.09946ad1b366746e0749.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Danske Bank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| loadCode

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://wecarecursos.com/fi/static/css/main.2b901aef.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: http://wecarecursos.com/fi/ Message: Access to font at 'https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.50529db33ac4e983017c.woff2' from origin 'http://wecarecursos.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.50529db33ac4e983017c.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://wecarecursos.com/fi/ Message: Access to font at 'https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.c9aa6505bf324e3397eb.woff' from origin 'http://wecarecursos.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.c9aa6505bf324e3397eb.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://wecarecursos.com/fi/ Message: Access to font at 'https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.09946ad1b366746e0749.ttf' from origin 'http://wecarecursos.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.09946ad1b366746e0749.ttf Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

danskebank.fi
shared-logon.danskebank.com
wecarecursos.com
shared-logon.danskebank.com
108.167.188.20
212.93.38.8
212.93.61.97
1989ffa455347abef138d3b062053584d7c0d052ee80ca2abfd8bfc6a57d66a8
2566dcb0230f1ae2412d24ade3f940e3e6a6b3b6ee40501711bf53abc19386a7
f0228a65851c12b5da774f1ee2d931aa3fd2352914ef6de25c1c9d6dd1426627

wecarecursos.com Open in urlscan Pro 108.167.188.20 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

7 Requests

29 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

9 kBTransfer

13 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

7 Console Messages

Indicators

wecarecursos.com Open in urlscan Pro
108.167.188.20 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

29 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

9 kB
Transfer

13 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!