![](/screenshots/c5232008-59a1-4175-9ae7-b17bd77c74f0.png)
eika00112.wpenginepowered.com
Open in
urlscan Pro
141.193.213.11
Malicious Activity!
Public Scan
Effective URL: https://eika00112.wpenginepowered.com/02221DS/norge/
Submission: On April 23 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 19th 2023. Valid for: a year.
This is the only time eika00112.wpenginepowered.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BankID (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 101.2.166.88 101.2.166.88 | 38592 (CTGONLINE...) (CTGONLINE-AS-AP Chittagong Online Limited AS38592 AP) | |
1 19 | 141.193.213.11 141.193.213.11 | 209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare) | |
19 | 2 |
ASN38592 (CTGONLINE-AS-AP Chittagong Online Limited AS38592 AP, BD)
PTR: mail.oceanparadisehotel.com
mail.oceanparadisehotel.com |
ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
eika00112.wpenginepowered.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
wpenginepowered.com
1 redirects
eika00112.wpenginepowered.com |
85 KB |
1 |
oceanparadisehotel.com
mail.oceanparadisehotel.com |
292 B |
19 | 2 |
Domain | Requested by | |
---|---|---|
19 | eika00112.wpenginepowered.com |
1 redirects
eika00112.wpenginepowered.com
|
1 | mail.oceanparadisehotel.com | |
19 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
id.portalbank.no |
www.bankid.no |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-03-19 - 2024-03-18 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://eika00112.wpenginepowered.com/02221DS/norge/
Frame ID: 4240B94C6E590CB408BDD307D3C2A591
Requests: 17 HTTP requests in this frame
Frame:
https://eika00112.wpenginepowered.com/02221DS/norge/BankID_files/saved_resource.html
Frame ID: ED4441BFB3CCF99FA2E2DFEB5DF3D9B5
Requests: 1 HTTP requests in this frame
Frame:
https://eika00112.wpenginepowered.com/02221DS/norge/BankID_files/saved_resource(1).html
Frame ID: 264F1BAED382E876E298054959C131BA
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/c5232008-59a1-4175-9ae7-b17bd77c74f0.png)
Page Title
BankIDPage URL History Show full URLs
- http://mail.oceanparadisehotel.com/mail/p3.html Page URL
-
https://eika00112.wpenginepowered.com/02221DS/
HTTP 302
https://eika00112.wpenginepowered.com/02221DS/norge/ Page URL
Detected technologies
![](/vendor/wappa/icons/Ionicons.png)
Detected patterns
- <link[^>]* href=[^>]+ionicons(?:\.min)?\.css
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: BankID på mobil
Search URL Search Domain Scan URL
Title: Bruk og support av BankID og BankID på mobil
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://mail.oceanparadisehotel.com/mail/p3.html Page URL
-
https://eika00112.wpenginepowered.com/02221DS/
HTTP 302
https://eika00112.wpenginepowered.com/02221DS/norge/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
p3.html
mail.oceanparadisehotel.com/mail/ |
169 B 292 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
eika00112.wpenginepowered.com/02221DS/norge/ Redirect Chain
|
10 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
eika-green.css
eika00112.wpenginepowered.com/02221DS/norge/BankID_files/ |
451 KB 62 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ionicons.css
eika00112.wpenginepowered.com/02221DS/norge/BankID_files/ |
60 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
eika00112.wpenginepowered.com/02221DS/norge/BankID_files/ |
12 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
small_logo.jpg
eika00112.wpenginepowered.com/02221DS/norge/BankID_files/ |
4 KB 5 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bundle.js.t%C3%A9l%C3%A9chargement
eika00112.wpenginepowered.com/02221DS/norge/BankID_files/ |
0 555 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
saved_resource.html
eika00112.wpenginepowered.com/02221DS/norge/BankID_files/ Frame ED44 |
149 B 685 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
saved_resource(1).html
eika00112.wpenginepowered.com/02221DS/norge/BankID_files/ Frame 264F |
149 B 688 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Eika-Medium.woff2
eika00112.wpenginepowered.com/02221DS/norge/fonts/Eika/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Roboto-medium.woff2
eika00112.wpenginepowered.com/02221DS/norge/fonts/Roboto/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Eika-Bold.woff2
eika00112.wpenginepowered.com/02221DS/norge/fonts/Eika/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Roboto-regular.woff2
eika00112.wpenginepowered.com/02221DS/norge/fonts/Roboto/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Eika-Semibold.woff2
eika00112.wpenginepowered.com/02221DS/norge/fonts/Eika/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Eika-Semibold.woff
eika00112.wpenginepowered.com/02221DS/norge/fonts/Eika/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Roboto-medium.woff
eika00112.wpenginepowered.com/02221DS/norge/fonts/Roboto/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Roboto-regular.woff
eika00112.wpenginepowered.com/02221DS/norge/fonts/Roboto/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Eika-Bold.woff
eika00112.wpenginepowered.com/02221DS/norge/fonts/Eika/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Eika-Medium.woff
eika00112.wpenginepowered.com/02221DS/norge/fonts/Eika/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BankID (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 boolean| credentialless0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
10 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
eika00112.wpenginepowered.com
mail.oceanparadisehotel.com
101.2.166.88
141.193.213.11
06951624d80fdda468d7efffb27c4de747d0650055b488b326a701cb3fd697b8
0e9a497482401d2b6e057bc67ceb07d672b401b224523c1c179f2d7eac075348
56d8aeae87f4b02769a8b4fa9e531e6a0f047e64f15699dcc129ce3383460fcd
633c013fc19fc06d55f9cc525af7196f5b4eb6be6c1ab2b60d885db0aa995179
72da2e711a056e074fae79a2e63a8e759f3843d267491b5d1e0068f3a8d56e97
97f9b10039b05e1af4a3c9b778fc72ba44cf68a376e4ec1d55f2558f16cf3e50
9ec2c7e9e32b00406ff47a6b4352acb38f4aa2b68802cddcc8317ebbbe4b2c1b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855