![](/screenshots/d7ffc409-ea41-4d31-951b-6392855b2a16.png)
irontech.no
Open in
urlscan Pro
149.202.72.186
Malicious Activity!
Public Scan
Effective URL: https://irontech.no/sidee/ii.php?rand=13inboxlightaspxn.1774256418&fid.4.1252899642=&fid=4&fav.1=&ra...
Submission: On November 07 via automatic, source phishtank — Scanned from FR
Summary
TLS certificate: Issued by R3 on October 3rd 2021. Valid for: 3 months.
This is the only time irontech.no was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 5 | 149.202.72.186 149.202.72.186 | 16276 (OVH) (OVH) | |
1 | 2a00:1288:84:... 2a00:1288:84:800::1002 | 203219 (YAHOO-AMA) (YAHOO-AMA) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6811:490e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2a00:1450:400... 2a00:1450:4001:830::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:827::2003 | 15169 (GOOGLE) (GOOGLE) | |
18 | 7 |
ASN15169 (GOOGLE, US)
translate.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
irontech.no
1 redirects
irontech.no |
128 KB |
4 |
googleapis.com
translate.googleapis.com |
97 KB |
4 |
gstatic.com
ssl.gstatic.com www.gstatic.com |
15 KB |
1 |
cloudflare.com
ajax.cloudflare.com |
2 KB |
1 |
yahoo.com
mail.yahoo.com |
3 KB |
0 |
yeah.net
Failed
mail.yeah.net Failed |
|
0 |
optimumelectronics.com
Failed
mxmail.optimumelectronics.com Failed |
|
0 |
gfx.ms
Failed
a.gfx.ms Failed |
|
0 |
bankofamerica.com
Failed
bankofamerica.com Failed |
|
18 | 9 |
Domain | Requested by | |
---|---|---|
5 | irontech.no |
1 redirects
irontech.no
|
4 | translate.googleapis.com |
irontech.no
translate.googleapis.com srcdoc |
3 | www.gstatic.com |
irontech.no
translate.googleapis.com |
1 | ajax.cloudflare.com |
irontech.no
|
1 | ssl.gstatic.com |
irontech.no
|
1 | mail.yahoo.com |
irontech.no
|
0 | mail.yeah.net Failed |
irontech.no
|
0 | mxmail.optimumelectronics.com Failed |
irontech.no
|
0 | a.gfx.ms Failed |
irontech.no
|
0 | bankofamerica.com Failed |
irontech.no
|
18 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
translate.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
irontech.no R3 |
2021-10-03 - 2022-01-01 |
3 months | crt.sh |
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA |
2021-10-25 - 2021-11-17 |
24 days | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
ajax.cloudflare.com DigiCert ECC Secure Server CA |
2020-08-11 - 2022-08-16 |
2 years | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://irontech.no/sidee/ii.php?rand=13inboxlightaspxn.1774256418&fid.4.1252899642=&fid=4&fav.1=&rand.13inboxlight.aspxn.1774256418=&fid.1252899642=&fid.1=&email=a@a.c&.rand=13inboxlight.aspx%3fn=1774256418
Frame ID: CE085E5A518A2EFC2B2C21D3582B18B1
Requests: 17 HTTP requests in this frame
Frame:
https://translate.googleapis.com/translate_a/l?client=te&alpha=true&hl=en&cb=callback
Frame ID: 0A92EA9564456479C04B1E92F9514097
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/d7ffc409-ea41-4d31-951b-6392855b2a16.png)
Page Title
Email Service ProviderPage URL History Show full URLs
-
http://irontech.no/sidee/ii.php?rand=13inboxlightaspxn.1774256418&fid.4.1252899642=&fid...
HTTP 301
https://irontech.no/sidee/ii.php?rand=13inboxlightaspxn.1774256418&fid.4.1252899642=&fid... Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Translate
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://irontech.no/sidee/ii.php?rand=13inboxlightaspxn.1774256418&fid.4.1252899642=&fid=4&fav.1=&rand.13inboxlight.aspxn.1774256418=&fid.1252899642=&fid.1=&email=a@a.c&.rand=13inboxlight.aspx?n=1774256418
HTTP 301
https://irontech.no/sidee/ii.php?rand=13inboxlightaspxn.1774256418&fid.4.1252899642=&fid=4&fav.1=&rand.13inboxlight.aspxn.1774256418=&fid.1252899642=&fid.1=&email=a@a.c&.rand=13inboxlight.aspx%3fn=1774256418 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://irontech.no/sidee/navbar.css HTTP 0
- http://bankofamerica.com/
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
ii.php
irontech.no/sidee/ Redirect Chain
|
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.css
irontech.no/sidee/files/ |
120 KB 120 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
bankofamerica.com/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin.css
irontech.no/sidee/files/ |
791 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
element.js
irontech.no/sidee/files/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
mail.yahoo.com/ |
2 KB 3 KB |
Image
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OLFav.ico
a.gfx.ms/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_strip_2x.png
ssl.gstatic.com/accounts/ui/ |
10 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
mxmail.optimumelectronics.com/mail/skins/default/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
mail.yeah.net/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cloudflare.min.js
ajax.cloudflare.com/cdn-cgi/nexp/dok8v=b064e16429/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translateelement.css
translate.googleapis.com/translate_static/css/ |
18 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
translate.googleapis.com/translate_static/js/element/ |
6 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
element_main.js
translate.googleapis.com/element/TE_20210503_00/e/js/element/ |
252 KB 90 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translate_24dp.png
www.gstatic.com/images/branding/product/1x/ |
846 B 959 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ |
910 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
translate.googleapis.com/translate_a/ Frame 0A92 |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- bankofamerica.com
- URL
- http://bankofamerica.com/
- Domain
- a.gfx.ms
- URL
- https://a.gfx.ms/OLFav.ico
- Domain
- mxmail.optimumelectronics.com
- URL
- https://mxmail.optimumelectronics.com/mail/skins/default/images/favicon.ico
- Domain
- mail.yeah.net
- URL
- https://mail.yeah.net/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| CloudFlare object| a object| b function| googleTranslateElementInit object| google object| closure_lm_9943650 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.gfx.ms
ajax.cloudflare.com
bankofamerica.com
irontech.no
mail.yahoo.com
mail.yeah.net
mxmail.optimumelectronics.com
ssl.gstatic.com
translate.googleapis.com
www.gstatic.com
a.gfx.ms
bankofamerica.com
mail.yeah.net
mxmail.optimumelectronics.com
149.202.72.186
2606:4700::6811:490e
2a00:1288:84:800::1002
2a00:1450:4001:827::2003
2a00:1450:4001:828::2003
2a00:1450:4001:830::200a
09363cc7c668ce12683214a9877ae9c068a82dfb8f64111355933c24e7193a98
13b5eece5a7359f9c0de2b4b3c24eeed42fa547e5811238bc9434dcc975bb101
251c607557e1302862934faeb35d7c9c20cbb64b4abb6a4faed721b71db501f2
26cc7eaf4fbf8bcd6eb99a36db09ce948e22e14e18a92423ef5d9065f81f808b
3332fec379c1fa3fa83e8de48b7dc9c408360b4e62bab4bf0e355310108969cb
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99
5d0a6e3bc914db376bf187c380750b197c317e1bf40fab9ad959ad5facd8f9ed
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
79d1744b3148a4b7265a9d2006eb1f6b72fda68490c398e380cb0692aeb8c5e5
a7240089193e066e346d5c5081d5db305ac931a9079a133e47bf22940e946143
ac81afcf15ce9ca0590f191d2cf83ac785631956f97ad189c299b30bb6d2e9d3
b2d3305551055e5d28aea38f218ee6ff6006afb8c80cc4f206a206bcb758df7c
c6f7ee2cadae2e121342a8c4245141175bfe887776206deb17149d46cf3aa827