zst.uzz.mybluehost.me Open in urlscan Pro
162.241.224.41  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request auth.php Show response zst.uzz.mybluehost.me/;)takamchaw9/	24 KB 7 KB	1960ms 1527ms	Document text/html	162.241.224.41 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://zst.uzz.mybluehost.me/;)takamchaw9/auth.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.224.41 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5156.bluehost.com Software nginx/1.21.6 / Resource Hash 8719f1d85ca927b919bbc751ef58ecb40a3725c903dc6467a8522ca13b8b7505 Request headers Accept-Language da-DK,da;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.1 Response headers cache-control max-age=7200 content-encoding gzip content-length 6486 content-type text/html; charset=UTF-8 date Thu, 20 Jun 2024 06:36:19 GMT expires Thu, 20 Jun 2024 08:36:18 GMT host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== server nginx/1.21.6 vary Accept-Encoding x-endurance-cache-level 2 x-newfold-cache-level 2 x-nginx-cache WordPress x-proxy-cache MISS x-server-cache true
GET H2	200	Nets_logo.svg acs1.3dsecure.no/logos/	5 KB 2 KB	446ms 87ms	Image image/svg+xml	185.42.168.134 MODIRUM
General Check archive.org Show headers Download Go to Show image Full URL https://acs1.3dsecure.no/logos/Nets_logo.svg Requested by Host: zst.uzz.mybluehost.me URL: https://zst.uzz.mybluehost.me/;)takamchaw9/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.134 , Estonia, ASN62248 (MODIRUM, EE), Reverse DNS Software nginx / Resource Hash 88553c13740cace8eadae97046ee0d96e0c55d876d38e25de48835fa33117eb8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language da-DK,da;q=0.9;q=0.9 Referer https://zst.uzz.mybluehost.me/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.1 Response headers date Thu, 20 Jun 2024 06:36:20 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip last-modified Wed, 22 Sep 2021 19:50:43 GMT server nginx etag W/"614b8913-1278" vary Accept-Encoding content-type image/svg+xml
GET H2	200	1.svg acs1.3dsecure.no/logos/	1 KB 1 KB	444ms 85ms	Image image/svg+xml	185.42.168.134 MODIRUM
General Check archive.org Show headers Download Go to Show image Full URL https://acs1.3dsecure.no/logos/1.svg Requested by Host: zst.uzz.mybluehost.me URL: https://zst.uzz.mybluehost.me/;)takamchaw9/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.134 , Estonia, ASN62248 (MODIRUM, EE), Reverse DNS Software nginx / Resource Hash 3bde3df6acd9bb68d8c0acb341e13e08dc6755982b2a08c56f3ccb28d16cc0b6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language da-DK,da;q=0.9;q=0.9 Referer https://zst.uzz.mybluehost.me/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.1 Response headers date Thu, 20 Jun 2024 06:36:20 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip last-modified Tue, 29 Mar 2022 13:38:15 GMT server nginx etag W/"62430bc7-5e5" vary Accept-Encoding content-type image/svg+xml
GET H/1.1	200 OK	code-app-slider-emulator.svg www.mitid.dk/assets/img/	43 KB 44 KB	387ms 148ms	Image image/svg+xml	95.100.135.136 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://www.mitid.dk/assets/img/code-app-slider-emulator.svg Requested by Host: zst.uzz.mybluehost.me URL: https://zst.uzz.mybluehost.me/;)takamchaw9/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 95.100.135.136 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-100-135-136.deploy.static.akamaitechnologies.com Software nginx / Resource Hash 835d186b93c3920efbe7da4a0c7296538d8237e0ac4e322e7b390e4a6373f914 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Accept-Language da-DK,da;q=0.9;q=0.9 Referer https://zst.uzz.mybluehost.me/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.1 Response headers Strict-Transport-Security max-age=63072000; includeSubDomains; preload Date Thu, 20 Jun 2024 06:36:20 GMT Connection keep-alive Content-Length 44018 Referrer-Policy same-origin Last-Modified Mon, 26 Feb 2024 07:20:50 GMT Server nginx ETag "abf2-61243bfc91880" Access-Control-Allow-Methods GET, POST, OPTIONS, PUT, PATCH, DELETE Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control public, max-age=25, s-maxage=120 Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers Origin,Content-Type,Accept,X-Correlation-ID,Mitid-Correlation-ID,X-Request-ID,MitID-CH-UA-Platform-Version,MitID-CH-UA-Full-Version-List Expires Thu, 20 Jun 2024 06:36:45 GMT
GET		back.png acs1.3dsecure.no/auths/071/g_-1/content/	0 0
GET H/1.1	200 OK	code-app-slider-emulator.svg www.mitid.dk/assets/img/ Frame 4F56	0 0	334ms 145ms	Document image/svg+xml	95.100.135.136 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://www.mitid.dk/assets/img/code-app-slider-emulator.svg Requested by Host: zst.uzz.mybluehost.me URL: https://zst.uzz.mybluehost.me/;)takamchaw9/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 95.100.135.136 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-100-135-136.deploy.static.akamaitechnologies.com Software nginx / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Accept-Language da-DK,da;q=0.9;q=0.9 Referer https://zst.uzz.mybluehost.me/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.1 Response headers Accept-Ranges bytes Access-Control-Allow-Credentials true Access-Control-Allow-Headers Origin,Content-Type,Accept,X-Correlation-ID,Mitid-Correlation-ID,X-Request-ID,MitID-CH-UA-Platform-Version,MitID-CH-UA-Full-Version-List Access-Control-Allow-Methods GET, POST, OPTIONS, PUT, PATCH, DELETE Access-Control-Allow-Origin * Cache-Control public, max-age=25, s-maxage=120 Connection keep-alive Content-Length 44018 Content-Type image/svg+xml Date Thu, 20 Jun 2024 06:36:20 GMT ETag "abf2-61243bfc91880" Expires Thu, 20 Jun 2024 06:36:45 GMT Last-Modified Mon, 26 Feb 2024 07:20:50 GMT Referrer-Policy same-origin Server nginx Strict-Transport-Security max-age=63072000; includeSubDomains; preload
GET H2	404	favicon.ico zst.uzz.mybluehost.me/	315 B 389 B	290ms 290ms	Other text/html	162.241.224.41 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://zst.uzz.mybluehost.me/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.224.41 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5156.bluehost.com Software nginx/1.21.6 / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Request headers Accept-Language da-DK,da;q=0.9;q=0.9 Referer https://zst.uzz.mybluehost.me/;)takamchaw9/auth.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.1 Response headers date Thu, 20 Jun 2024 06:36:20 GMT server nginx/1.21.6 host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 315 content-type text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

acs1.3dsecure.no

URL

https://acs1.3dsecure.no/auths/071/g_-1/content/back.png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nexi (Banking) Visa (Financial)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 undefined| event object| fence object| sharedStorage object| onorientationchange number| orientation function| onMitIDMessage

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			zst.uzz.mybluehost.me/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4b71d7b7075fb0d2818b565fd4d8b167

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://acs1.3dsecure.no/auths/071/g_-1/content/back.png Message: Failed to load resource: net::ERR_HTTP2_PROTOCOL_ERROR
network	error	URL: https://zst.uzz.mybluehost.me/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acs1.3dsecure.no
www.mitid.dk
zst.uzz.mybluehost.me
acs1.3dsecure.no
162.241.224.41
185.42.168.134
95.100.135.136
3bde3df6acd9bb68d8c0acb341e13e08dc6755982b2a08c56f3ccb28d16cc0b6
835d186b93c3920efbe7da4a0c7296538d8237e0ac4e322e7b390e4a6373f914
8719f1d85ca927b919bbc751ef58ecb40a3725c903dc6467a8522ca13b8b7505
88553c13740cace8eadae97046ee0d96e0c55d876d38e25de48835fa33117eb8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3