www.nickellogin.com
Open in
urlscan Pro
45.136.48.18
Malicious Activity!
Public Scan
Effective URL: https://www.nickellogin.com/clients/
Submission: On February 26 via automatic, source certstream-suspicious — Scanned from NL
Summary
TLS certificate: Issued by R3 on February 26th 2023. Valid for: 3 months.
This is the only time www.nickellogin.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nickel (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 11 | 45.136.48.18 45.136.48.18 | 58061 (SCALAXY-AS) (SCALAXY-AS) | |
4 | 104.83.4.17 104.83.4.17 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 2a06:98c1:312... 2a06:98c1:3121::c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 4 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-83-4-17.deploy.static.akamaitechnologies.com
app.nickel.eu | |
static-resources.nickel.eu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
nickellogin.com
1 redirects
www.nickellogin.com |
35 KB |
4 |
nickel.eu
app.nickel.eu static-resources.nickel.eu |
289 KB |
1 |
rawgit.com
rawgit.com — Cisco Umbrella Rank: 9398 |
38 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 693 |
30 KB |
16 | 4 |
Domain | Requested by | |
---|---|---|
11 | www.nickellogin.com |
1 redirects
www.nickellogin.com
|
3 | static-resources.nickel.eu |
www.nickellogin.com
|
1 | rawgit.com |
www.nickellogin.com
|
1 | code.jquery.com |
www.nickellogin.com
|
1 | app.nickel.eu |
www.nickellogin.com
|
16 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
nickellogin.com R3 |
2023-02-26 - 2023-05-27 |
3 months | crt.sh |
bnp09s.bnpparibas.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-02-22 - 2024-01-24 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-06 - 2023-06-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.nickellogin.com/clients/
Frame ID: 4CCBFA73AB3B63F251050F2F67F29798
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Espace client : GĂ©rer son compte | NickelPage URL History Show full URLs
-
https://www.nickellogin.com/
HTTP 302
https://www.nickellogin.com/clients/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.nickellogin.com/
HTTP 302
https://www.nickellogin.com/clients/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.nickellogin.com/clients/ Redirect Chain
|
188 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
86fffa26.chunk.css
www.nickellogin.com/assets/css/ |
25 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
24571a40.chunk.css
www.nickellogin.com/assets/css/ |
32 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
des.css
www.nickellogin.com/assets/css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f55d3599.chunk.css
www.nickellogin.com/assets/css/ |
6 KB 935 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
645939e1.chunk.css
www.nickellogin.com/assets/css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fe9185d1.chunk.css
www.nickellogin.com/assets/css/ |
5 KB 930 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2282daa7.chunk.css
www.nickellogin.com/assets/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
74.b7389af6.chunk.css
www.nickellogin.com/assets/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
65.045f2d82.chunk.css
www.nickellogin.com/assets/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sketch-homepage.a14b9180.png
app.nickel.eu/static/media/ |
193 KB 194 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.inputmask.js
rawgit.com/RobinHerbots/Inputmask/5.x/dist/ |
198 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MullerNarrow-Light.woff2
static-resources.nickel.eu/fonts/ |
31 KB 32 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MullerNarrow-ExtraBold.woff2
static-resources.nickel.eu/fonts/ |
30 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MullerNarrow-Medium.woff2
static-resources.nickel.eu/fonts/ |
32 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nickel (Financial)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery function| Inputmask function| default function| resetpass function| refreshpass1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.nickellogin.com/ | Name: PHPSESSID Value: dvjufu5qgrprip7lr39ja3ueud |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app.nickel.eu
code.jquery.com
rawgit.com
static-resources.nickel.eu
www.nickellogin.com
104.83.4.17
2001:4de0:ac18::1:a:1b
2a06:98c1:3121::c
45.136.48.18
222662d0ed5617d8df9772f5394fdb715acdd3296f00d6db261b682e8400ecd2
234a61d9c004512f92960323b0e8ea01bf7138f7e3daa22648f50000bec54301
29a377530b36d1a9e568c24f4539126c6342ce8bc14de3843fdcf7a3dc18add4
368d3e222fb20951615a298ab3bd932813679981b92d448183a988068c113d77
4da7ff58a085e3c3fdc781d9e38117c808d7d3425dda5ab7d605d05ad7025493
5ce7979af69c35c2381677bbb13f2c07717278dbbb31c09984310e34408d5c4b
6392a748f3002e48611ba86cd3f3bec9ff95a4f2c11449e15dc1253ce3585028
8861c1f2a1b8ff89eaff1464d2c1682dcd796b2ffcec377eff55ecb33e79d119
939a1d3c8c49ee6551aa504ca8f5a47ef5e8eba28ebae68336801e7f09938685
e671416c9ac25a7877362f1c6581b91fbe987ec04e187b365a96a3feecc2bb1a
f0e7fef75b97057f33e9ba884f068688dd6514ad2e303685ab29418e1390b842
f996d7eb10768373376f60c455f38135808f5ad7d6a347aec0584362de092fa7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e