www.region-fyn.com Open in urlscan Pro
69.163.153.12 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.region-fyn.com/
Effective URL:
http://www.region-fyn.com/1066011987/login.php
Submission Tags: tweet @teamdreier #phishing Search All
Submission: On March 10 via api (March 10th 2023, 7:20:02 pm UTC) from FI — Scanned from FI

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 69.163.153.12, located in Brea, United States and belongs to DREAMHOST-AS, US. The main domain is www.region-fyn.com.

This is the only time www.region-fyn.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: MitID (Government)

Domain & IP information

	IP Address		AS Autonomous System
8	69.163.153.12 69.163.153.12		26347 (DREAMHOST-AS) (DREAMHOST-AS)
8	1

8 69.163.153.12 (Brea, United States)

ASN26347 (DREAMHOST-AS, US)
PTR: apache2-bongo.buxton.dreamhost.com

www.region-fyn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	region-fyn.com www.region-fyn.com	64 KB
8	1

	Domain	Requested by
8	www.region-fyn.com	www.region-fyn.com
8	1

This site contains links to these domains. Also see Links.

Domain
www.mitid.dk

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.region-fyn.com/1066011987/login.php
Frame ID: 1C96C464278853840AE1FFE5760EC4CD
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.region-fyn.com/ Page URL
http://www.region-fyn.com/1066011987/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

64 kB
Transfer

61 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.mitid.dk/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.region-fyn.com/ Page URL
http://www.region-fyn.com/1066011987/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response www.region-fyn.com/	290 B 570 B	801ms 205ms	Document text/html	69.163.153.12 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL http://www.region-fyn.com/ Protocol HTTP/1.1 Server 69.163.153.12 Brea, United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-bongo.buxton.dreamhost.com Software Apache / Resource Hash `19d34ee2e695ab968316f6876715ab418f70392a1d807f6233613da029b30635` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Cache-Control max-age=600 Connection Upgrade, Keep-Alive Content-Encoding gzip Content-Length 233 Content-Type text/html; charset=UTF-8 Date Fri, 10 Mar 2023 19:19:57 GMT Expires Fri, 10 Mar 2023 19:29:57 GMT Keep-Alive timeout=5, max=100 Server Apache Upgrade h2 Vary Accept-Encoding,User-Agent
GET H/1.1	200 OK	header_bar.png www.region-fyn.com/props/	5 KB 5 KB	191ms 191ms	Image image/png	69.163.153.12 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://www.region-fyn.com/props/header_bar.png Requested by Host: www.region-fyn.com URL: http://www.region-fyn.com/ Protocol HTTP/1.1 Server 69.163.153.12 Brea, United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-bongo.buxton.dreamhost.com Software Apache / Resource Hash `b5ce5fa34a8cf562e9e39f2c7b2a0e424c4c35664085b348f936a91962f30607` Request headers accept-language fi-FI,fi;q=0.9 Referer http://www.region-fyn.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 19:19:57 GMT Last-Modified Fri, 10 Mar 2023 12:33:35 GMT Server Apache ETag "1469-5f68af855ae38" Vary User-Agent,Accept-Encoding Content-Type image/png Cache-Control max-age=2592000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 5225 Expires Sun, 09 Apr 2023 19:19:57 GMT
GET H/1.1	206 Partial Content	loading.mp4 www.region-fyn.com/props/	24 KB 24 KB	203ms 203ms	Media video/mp4	69.163.153.12 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL http://www.region-fyn.com/props/loading.mp4 Requested by Host: www.region-fyn.com URL: http://www.region-fyn.com/ Protocol HTTP/1.1 Server 69.163.153.12 Brea, United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-bongo.buxton.dreamhost.com Software Apache / Resource Hash Request headers Referer http://www.region-fyn.com/ Accept-Encoding identity;q=1, ;q=0 accept-language* fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Range bytes=0- Response headers Date Fri, 10 Mar 2023 19:19:58 GMT Last-Modified Fri, 10 Mar 2023 12:33:34 GMT Server Apache ETag "5fc5-5f68af83d4444" Vary User-Agent Upgrade h2 Content-Type video/mp4 Content-Range bytes 0-24516/24517 Cache-Control max-age=172800 Connection Upgrade, Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 24517 Expires Sun, 12 Mar 2023 19:19:58 GMT
GET H/1.1	200 OK	Primary Request login.php Show response www.region-fyn.com/1066011987/	1 KB 1 KB	203ms 200ms	Document text/html	69.163.153.12 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL http://www.region-fyn.com/1066011987/login.php Protocol HTTP/1.1 Server 69.163.153.12 Brea, United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-bongo.buxton.dreamhost.com Software Apache / Resource Hash `4987b73e69bd911bd09c80a82ae79f642451ba835ba1002a954afe7e80dda699` Request headers Referer http://www.region-fyn.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Length 616 Content-Type text/html; charset=UTF-8 Date Fri, 10 Mar 2023 19:19:58 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache Vary Accept-Encoding,User-Agent
GET H/1.1	200 OK	brugerid5.png www.region-fyn.com/props/	4 KB 4 KB	714ms 714ms	Image image/png	69.163.153.12 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://www.region-fyn.com/props/brugerid5.png Requested by Host: www.region-fyn.com URL: http://www.region-fyn.com/1066011987/login.php Protocol HTTP/1.1 Server 69.163.153.12 Brea, United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-bongo.buxton.dreamhost.com Software Apache / Resource Hash `57d626dd85a54b59c269dcb13c2d40f529285667408953a954af5673e9b4c746` Request headers accept-language fi-FI,fi;q=0.9 Referer http://www.region-fyn.com/1066011987/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 19:19:59 GMT Last-Modified Fri, 10 Mar 2023 12:33:35 GMT Server Apache ETag "1011-5f68af8508dba" Vary User-Agent,Accept-Encoding Content-Type image/png Cache-Control max-age=2592000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 4113 Expires Sun, 09 Apr 2023 19:19:59 GMT
GET H/1.1	200 OK	submit.png www.region-fyn.com/props/	4 KB 4 KB	192ms 192ms	Image image/png	69.163.153.12 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://www.region-fyn.com/props/submit.png Requested by Host: www.region-fyn.com URL: http://www.region-fyn.com/1066011987/login.php Protocol HTTP/1.1 Server 69.163.153.12 Brea, United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-bongo.buxton.dreamhost.com Software Apache / Resource Hash `e3f251fc59b6c8a371e0a5e7174a6e16991dcc41ae92c8e8c625caea8dd51d81` Request headers accept-language fi-FI,fi;q=0.9 Referer http://www.region-fyn.com/1066011987/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 19:19:58 GMT Last-Modified Fri, 10 Mar 2023 12:33:32 GMT Server Apache ETag "fd7-5f68af8247c90" Vary User-Agent,Accept-Encoding Content-Type image/png Cache-Control max-age=2592000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 4055 Expires Sun, 09 Apr 2023 19:19:58 GMT
GET H/1.1	200 OK	glemtbruger1.png www.region-fyn.com/props/	5 KB 6 KB	368ms 190ms	Image image/png	69.163.153.12 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://www.region-fyn.com/props/glemtbruger1.png Requested by Host: www.region-fyn.com URL: http://www.region-fyn.com/1066011987/login.php Protocol HTTP/1.1 Server 69.163.153.12 Brea, United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-bongo.buxton.dreamhost.com Software Apache / Resource Hash `16e7aeb6ca721ef19c806d5176d4c93d4baaf27011f677579d211f55dd0fd0bf` Request headers accept-language fi-FI,fi;q=0.9 Referer http://www.region-fyn.com/1066011987/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 19:19:58 GMT Last-Modified Fri, 10 Mar 2023 12:33:37 GMT Server Apache ETag "15da-5f68af86d6c4c" Vary User-Agent,Accept-Encoding Content-Type image/png Cache-Control max-age=2592000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 5594 Expires Sun, 09 Apr 2023 19:19:58 GMT
GET H/1.1	200 OK	login_form.png www.region-fyn.com/props/	17 KB 18 KB	379ms 194ms	Image image/png	69.163.153.12 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://www.region-fyn.com/props/login_form.png Requested by Host: www.region-fyn.com URL: http://www.region-fyn.com/1066011987/login.php Protocol HTTP/1.1 Server 69.163.153.12 Brea, United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-bongo.buxton.dreamhost.com Software Apache / Resource Hash `3ba7233c426e66dfa9e126acc48025adb5c13030a5cc07005075566ac793ce90` Request headers accept-language fi-FI,fi;q=0.9 Referer http://www.region-fyn.com/1066011987/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Fri, 10 Mar 2023 19:19:58 GMT Last-Modified Fri, 10 Mar 2023 12:33:33 GMT Server Apache ETag "458b-5f68af833de08" Vary User-Agent,Accept-Encoding Upgrade h2 Content-Type image/png Cache-Control max-age=2592000 Connection Upgrade, Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 17803 Expires Sun, 09 Apr 2023 19:19:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: MitID (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.region-fyn.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: c7c983cffd55edb322d129377ec2ea5d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.region-fyn.com
69.163.153.12
16e7aeb6ca721ef19c806d5176d4c93d4baaf27011f677579d211f55dd0fd0bf
19d34ee2e695ab968316f6876715ab418f70392a1d807f6233613da029b30635
3ba7233c426e66dfa9e126acc48025adb5c13030a5cc07005075566ac793ce90
4987b73e69bd911bd09c80a82ae79f642451ba835ba1002a954afe7e80dda699
57d626dd85a54b59c269dcb13c2d40f529285667408953a954af5673e9b4c746
b5ce5fa34a8cf562e9e39f2c7b2a0e424c4c35664085b348f936a91962f30607
e3f251fc59b6c8a371e0a5e7174a6e16991dcc41ae92c8e8c625caea8dd51d81

www.region-fyn.com Open in urlscan Pro 69.163.153.12 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

64 kBTransfer

61 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

www.region-fyn.com Open in urlscan Pro
69.163.153.12 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

64 kB
Transfer

61 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!