i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 2003:2:2:15:80:150:6:138, located in Germany and belongs to DTAG Internet service provider operations, DE. The main domain is i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de.
TLS certificate: Issued by Telekom Security ServerID OV Class 2 CA on June 16th 2023. Valid for: a year.

This is the only time i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Danske Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	2003:2:2:15:8... 2003:2:2:15:80:150:6:138	3320 (DTAG Inte...) (DTAG Internet service provider operations)
1	212.93.47.8 212.93.47.8	12483 (DANSKEBAN...) (DANSKEBANK-AS Aarhus Denmark)
1	212.93.61.97 212.93.61.97	12483 (DANSKEBAN...) (DANSKEBANK-AS Aarhus Denmark)
7	4

2 2003:2:2:15:80:150:6:138 (Germany)

ASN3320 (DTAG Internet service provider operations, DE)

i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.93.47.8 (Denmark)

ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK)

shared-logon.danskebank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.93.61.97 (Denmark)

ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK)

danskebank.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	t-online.de i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de	4 KB
1	danskebank.fi danskebank.fi	5 KB
1	danskebank.com shared-logon.danskebank.com — Cisco Umbrella Rank: 430906	2 KB
7	3

	Domain	Requested by
2	i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de	i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de
1	danskebank.fi	i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de
1	shared-logon.danskebank.com	i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de shared-logon.danskebank.com
7	3

This site contains no links.

Subject Issuer	Validity	Valid
*.homepage.t-online.de Telekom Security ServerID OV Class 2 CA	`2023-06-16` - `2024-06-20`	a year	crt.sh
shared-logon.danskebank.com GlobalSign RSA OV SSL CA 2018	`2023-03-26` - `2024-04-26`	a year	crt.sh
www.danskebank.fi GlobalSign ECC OV SSL CA 2018	`2024-01-23` - `2025-02-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/
Frame ID: 0EB98B975A2E97AF609E010B603C7419
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Tunnistaudu palveluun: Allekirjoituspalvelu - ID: Y7SX

Page Statistics

7
Requests

57 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

11 kB
Transfer

13 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/ 4 KB
4 KB 166ms
45ms Document
text/html 2003:2:2:15:80:150:6:138
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2003:2:2:15:80:150:6:138 , Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software: CM4all Webserver /
Resource Hash: 1989ffa455347abef138d3b062053584d7c0d052ee80ca2abfd8bfc6a57d66a8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-type: text/html; charset=UTF-8
date: Sun, 04 Feb 2024 19:30:54 GMT
server: CM4all Webserver

GET
H/1.1 200
OK main.2b901aef.css
shared-logon.danskebank.com/logon/default/static/css/ 5 KB
2 KB 196ms
45ms Stylesheet
text/css 212.93.47.8
DANSKEBANK-AS Aar...

General

Check archive.org

Show headers Download Go to

Full URL

https://shared-logon.danskebank.com/logon/default/static/css/main.2b901aef.css

Requested by

Host: i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de
URL: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

212.93.47.8 , Denmark, ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK),

Reverse DNS

Software

/

Resource Hash

f0228a65851c12b5da774f1ee2d931aa3fd2352914ef6de25c1c9d6dd1426627

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 19:30:54 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=157680000
last-modified: Fri, 03 Nov 2023 13:22:49 GMT
etag: W/"1421-18b9559c028"
vary: Accept-Encoding
transfer-encoding: chunked
content-type: text/css; charset=UTF-8
cache-control: no-cache
accept-ranges: bytes
keep-alive: timeout=5

GET
H2 404 main.2b901aef.css
i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/static/css/ 0
0 47ms
46ms Stylesheet
text/html 2003:2:2:15:80:150:6:138
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/static/css/main.2b901aef.css
Requested by: Host: i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de
URL: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2003:2:2:15:80:150:6:138 , Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software: CM4all Webserver /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 19:30:54 GMT
server: CM4all Webserver
content-length: 196
content-type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK danske-bank-logo.svg
danskebank.fi/-/media/danske-bank/img/ 4 KB
5 KB 227ms
78ms Image
image/svg+xml 212.93.61.97
DANSKEBANK-AS Aar...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://danskebank.fi/-/media/danske-bank/img/danske-bank-logo.svg

Requested by

Host: i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de
URL: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

212.93.61.97 , Denmark, ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK),

Reverse DNS

Software

/

Resource Hash

2566dcb0230f1ae2412d24ade3f940e3e6a6b3b6ee40501711bf53abc19386a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Sun, 04 Feb 2024 19:30:54 GMT
Strict-Transport-Security: max-age=157680000
X-Content-Type-Options: nosniff
Content-Disposition: inline; filename="danske-bank-logo.svg"
Connection: keep-alive
Content-Length: 4322
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 07 Feb 2018 13:37:02 GMT
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
ETag: dcb1c2e36945431fa0c242285e339349
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
Content-Type: image/svg+xml
Origin-Agent-Cluster: ?0
X-Farm: 7C
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type

GET dk_text-webfont.50529db33ac4e983017c.woff2
shared-logon.danskebank.com/logon/default/static/media/ 0
0

GET dk_text-webfont.c9aa6505bf324e3397eb.woff
shared-logon.danskebank.com/logon/default/static/media/ 0
0

GET dk_text-webfont.09946ad1b366746e0749.ttf
shared-logon.danskebank.com/logon/default/static/media/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: shared-logon.danskebank.com
URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.50529db33ac4e983017c.woff2

Domain: shared-logon.danskebank.com
URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.c9aa6505bf324e3397eb.woff

Domain: shared-logon.danskebank.com
URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.09946ad1b366746e0749.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Danske Bank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| loadCode

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/static/css/main.2b901aef.css Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/ Message: Access to font at 'https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.50529db33ac4e983017c.woff2' from origin 'https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.50529db33ac4e983017c.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/ Message: Access to font at 'https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.c9aa6505bf324e3397eb.woff' from origin 'https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.c9aa6505bf324e3397eb.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de/app/fi/ Message: Access to font at 'https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.09946ad1b366746e0749.ttf' from origin 'https://i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.09946ad1b366746e0749.ttf Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

danskebank.fi
i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de
shared-logon.danskebank.com
shared-logon.danskebank.com
2003:2:2:15:80:150:6:138
212.93.47.8
212.93.61.97
1989ffa455347abef138d3b062053584d7c0d052ee80ca2abfd8bfc6a57d66a8
2566dcb0230f1ae2412d24ade3f940e3e6a6b3b6ee40501711bf53abc19386a7
f0228a65851c12b5da774f1ee2d931aa3fd2352914ef6de25c1c9d6dd1426627

i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de Open in urlscan Pro 2003:2:2:15:80:150:6:138 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

7 Requests

57 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

11 kBTransfer

13 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

7 Console Messages

Indicators

i8239v82449yywu3e9lpia-appincupdate2024-danskebank.homepage.t-online.de Open in urlscan Pro
2003:2:2:15:80:150:6:138 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

57 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

11 kB
Transfer

13 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!