![](/screenshots/b1dd9dfc-d18c-4eed-86a9-44cde72ecf6e.png)
cert.privatkunde.dan.20-4-34-89.cprapid.com
Open in
urlscan Pro
20.4.34.89
Malicious Activity!
Public Scan
Effective URL: https://cert.privatkunde.dan.20-4-34-89.cprapid.com/id/home.php?&return_url=0d3061a0b5b81f6ef38c0100d9ccfd58&enrolmentID=85dfcc9d0010c83fe6f18b5b0a1...
Submission: On October 31 via manual from DK — Scanned from DK
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 25th 2022. Valid for: 3 months.
This is the only time cert.privatkunde.dan.20-4-34-89.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nordea (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 216.119.142.131 216.119.142.131 | 55293 (A2HOSTING) (A2HOSTING) | |
1 3 | 20.4.34.89 20.4.34.89 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 2606:4700:10:... 2606:4700:10::6816:4aab | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 158.69.139.226 158.69.139.226 | 16276 (OVH) (OVH) | |
1 | 104.18.19.39 104.18.19.39 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 67.202.105.33 67.202.105.33 | 32748 (STEADFAST) (STEADFAST) | |
16 | 7 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
cert.privatkunde.dan.20-4-34-89.cprapid.com |
ASN13335 (CLOUDFLARENET, US)
widgets.amung.us | |
whos.amung.us |
ASN32748 (STEADFAST, US)
PTR: ip33.67-202-105.static.steadfastdns.net
ic.tynt.com | |
de.tynt.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
tynt.com
cdn.tynt.com — Cisco Umbrella Rank: 9748 ic.tynt.com — Cisco Umbrella Rank: 6219 de.tynt.com — Cisco Umbrella Rank: 1438 |
9 KB |
3 |
cprapid.com
1 redirects
cert.privatkunde.dan.20-4-34-89.cprapid.com |
456 KB |
2 |
dtscout.com
t.dtscout.com — Cisco Umbrella Rank: 12688 |
3 KB |
2 |
amung.us
widgets.amung.us — Cisco Umbrella Rank: 21411 whos.amung.us — Cisco Umbrella Rank: 15062 |
4 KB |
1 |
soft.pe
saywa.soft.pe |
588 B |
16 | 5 |
Domain | Requested by | |
---|---|---|
7 | ic.tynt.com | |
3 | cert.privatkunde.dan.20-4-34-89.cprapid.com |
1 redirects
saywa.soft.pe
cert.privatkunde.dan.20-4-34-89.cprapid.com |
2 | t.dtscout.com |
widgets.amung.us
t.dtscout.com |
1 | de.tynt.com |
cdn.tynt.com
|
1 | cdn.tynt.com |
widgets.amung.us
|
1 | whos.amung.us |
widgets.amung.us
|
1 | widgets.amung.us |
cert.privatkunde.dan.20-4-34-89.cprapid.com
|
1 | saywa.soft.pe | |
16 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cert.privatkunde.dan.20-4-34-89.cprapid.com cPanel, Inc. Certification Authority |
2022-10-25 - 2023-01-23 |
3 months | crt.sh |
*.amung.us Sectigo RSA Domain Validation Secure Server CA |
2022-05-18 - 2023-06-17 |
a year | crt.sh |
*.dtscout.com Sectigo RSA Domain Validation Secure Server CA |
2021-10-28 - 2022-11-27 |
a year | crt.sh |
*.tynt.com Sectigo RSA Domain Validation Secure Server CA |
2022-09-07 - 2023-09-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://cert.privatkunde.dan.20-4-34-89.cprapid.com/id/home.php?&return_url=0d3061a0b5b81f6ef38c0100d9ccfd58&enrolmentID=85dfcc9d0010c83fe6f18b5b0a1603d0?securessl=true
Frame ID: 166DB6109459AAA8087F6132BAF50C5A
Requests: 22 HTTP requests in this frame
Screenshot
![](/screenshots/b1dd9dfc-d18c-4eed-86a9-44cde72ecf6e.png)
Page Title
Nordea - identifikationPage URL History Show full URLs
- http://saywa.soft.pe/dp.php Page URL
-
https://cert.privatkunde.dan.20-4-34-89.cprapid.com/id/
HTTP 302
https://cert.privatkunde.dan.20-4-34-89.cprapid.com/id/home.php?&return_url=0d3061a0b5b81f6ef38c0100d9ccfd58&enrolmentID=85dfcc9... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://saywa.soft.pe/dp.php Page URL
-
https://cert.privatkunde.dan.20-4-34-89.cprapid.com/id/
HTTP 302
https://cert.privatkunde.dan.20-4-34-89.cprapid.com/id/home.php?&return_url=0d3061a0b5b81f6ef38c0100d9ccfd58&enrolmentID=85dfcc9d0010c83fe6f18b5b0a1603d0?securessl=true Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
dp.php
saywa.soft.pe/ |
229 B 588 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
home.php
cert.privatkunde.dan.20-4-34-89.cprapid.com/id/ Redirect Chain
|
28 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
cert.privatkunde.dan.20-4-34-89.cprapid.com/id/partials/css/ |
428 KB 428 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
small.js
widgets.amung.us/ |
8 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
67 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
26 KB 26 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
26 KB 26 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
t.dtscout.com/i/ |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
25 B 126 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tc.js
cdn.tynt.com/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
439 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
t.dtscout.com/pv/ |
51 B 319 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v2
de.tynt.com/deb/ |
4 B 260 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nordea (Banking)29 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| _wau object| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x2 object| Tynt object| _dtspv object| _33Across function| __uspapi3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.dtscout.com/ | Name: m Value: 1 |
|
.dtscout.com/ | Name: oa Value: 1 |
|
.dtscout.com/ | Name: df Value: 1667218793 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.tynt.com
cert.privatkunde.dan.20-4-34-89.cprapid.com
de.tynt.com
ic.tynt.com
saywa.soft.pe
t.dtscout.com
whos.amung.us
widgets.amung.us
104.18.19.39
158.69.139.226
20.4.34.89
216.119.142.131
2606:4700:10::6816:4aab
67.202.105.33
00b035c9f42e2f61fbd8f3d975780425d45beca0f74f1031ed6a412660955e5c
341b6d608d346d2b16e5e710b4595379786d7e59b1c5a78b4d8fc2985bb51aea
443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03
6bb27299ef7a2f71792920ae936f4f0800cf1a43ff5f8b4c835233fde4c1e387
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
937458495c30f567aeafe715f0164bfe061ab17aee4a34aabbf191f69a6d32ae
a39a9f4def461b78c3c76a4d853c5f56a5379e72855d5b03a54599d49442cc32
a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff
acc90b5255f375e13cc61f865040478454f42cde1dbdc69ae4c9f09431866417
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5a9b257a893a1870b81dc7b661a268271d50b6e5e5f3f70bcf3ee4420ed39ff
eee6ef188662ab76c29c720cab899af19bad8153a9c86d548d90b3fa46886fc9
f5dcb4e84f9290ee0abcc2b7a3f60ad689c373fd73c94730e85601dd52d9e2eb
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac