![](/screenshots/ba7229ee-34b0-432e-9d37-9bbfda6cbd39.png)
logon.e-boks.dk
Open in
urlscan Pro
104.111.238.84
Malicious Activity!
Public Scan
Effective URL: https://logon.e-boks.dk/nemid/logon?siteid=21
Submission: On December 28 via manual from DK
Summary
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on September 10th 2018. Valid for: 2 years.
This is the only time logon.e-boks.dk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Danske Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 6 | 104.111.238.84 104.111.238.84 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 95.100.68.245 95.100.68.245 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
5 | 2 |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-238-84.deploy.static.akamaitechnologies.com
www.e-boks.dk | |
logon.e-boks.dk |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-68-245.deploy.static.akamaitechnologies.com
applet.danid.dk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
e-boks.dk
2 redirects
www.e-boks.dk logon.e-boks.dk |
32 KB |
1 |
danid.dk
applet.danid.dk |
|
5 | 2 |
Domain | Requested by | |
---|---|---|
5 | logon.e-boks.dk |
1 redirects
logon.e-boks.dk
|
1 | applet.danid.dk |
logon.e-boks.dk
|
1 | www.e-boks.dk | 1 redirects |
5 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.e-boks.dk |
www.nemid.nu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.e-boks.dk DigiCert SHA2 Extended Validation Server CA |
2018-09-10 - 2020-09-09 |
2 years | crt.sh |
applet.danid.dk GlobalSign Organization Validation CA - SHA256 - G2 |
2017-05-16 - 2020-07-06 |
3 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://logon.e-boks.dk/nemid/logon?siteid=21
Frame ID: 1E576DEBAD1F44CB2C2373547211781F
Requests: 4 HTTP requests in this frame
Frame:
https://applet.danid.dk/launcher/std/637131778130442218
Frame ID: 0B987FFA2385611721B65D5758E7ABEE
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/ba7229ee-34b0-432e-9d37-9bbfda6cbd39.png)
Page URL History Show full URLs
-
https://www.e-boks.dk/privat
HTTP 302
https://logon.e-boks.dk/handler/logontologonprovider.aspx?siteid=21&ReturnUrl=%2fprivat HTTP 302
https://logon.e-boks.dk/nemid/logon?siteid=21 Page URL
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Problemer med at logge på med NemID
Search URL Search Domain Scan URL
Title: Certifikat/Signatur er udløbet
Search URL Search Domain Scan URL
Title: Bestil NemID
Search URL Search Domain Scan URL
Title: Download NemID Nøgleapp
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.e-boks.dk/privat
HTTP 302
https://logon.e-boks.dk/handler/logontologonprovider.aspx?siteid=21&ReturnUrl=%2fprivat HTTP 302
https://logon.e-boks.dk/nemid/logon?siteid=21 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
logon
logon.e-boks.dk/nemid/ Redirect Chain
|
9 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
logon.e-boks.dk/nemid/Content/stylesheet/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
e-boks_dk_invert_304x60.png
logon.e-boks.dk/nemid/Content/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() applet.danid.dk/launcher/std/ Frame 0B98 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nemid_super_croped.png
logon.e-boks.dk/nemid/Content/images/backgrounds/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Danske Bank (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| onNemIDMessage4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
applet.danid.dk/ | Name: JSESSIONID Value: 0000wNKgAtAm0l34mE21TI3JJuA:D048D30345ACDA01000002D80000003400000048 |
|
logon.e-boks.dk/ | Name: TS01516053 Value: 017d9aa4c0544bcb665c0cbc7eb58ca296878b0a3234d75dbada03974c38ddffc1d7cd1d8498df221a71fa7ca0d112d8f10bced2130364dcf9bc6871d6b5d94df4eef00e63dfbac4410cd382b38abbd5f6b0727fca |
|
logon.e-boks.dk/ | Name: BIGipServer~e-boks_prod~e-boks_prod_pool_external_combined-1_default-pool Value: rd5001o00000000000000000000ffff0aff1213o80 |
|
logon.e-boks.dk/ | Name: ASP.NET_SessionId Value: 3oxglyynbscrjgdniqcded4x |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
applet.danid.dk
logon.e-boks.dk
www.e-boks.dk
104.111.238.84
95.100.68.245
3eb52bc81bb2cc13053f13d00e24dc356397a176874772966c0a34107c5ac51f
84924f104696624417468f578a1ccbc37e6e0da1d4dd28d705b914209b710afc
b886a602141dedad0d1cebbba9310bc97a1d2018ff478b1b3d8fce51cf9810ad
f42e3e55c7047efb981e6f976b6da5454610a5cb46b9c35297bf77062197cc63