urlscan.io logo urlscan.io
SecurityTrails logo

kingsith.co.uk Open in urlscan Pro
3.123.23.27  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://kingsith.co.uk/?k=lillheidi
Effective URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.d...
Submission: On March 10 via manual from DK
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 22 HTTP transactions. The main IP is 3.123.23.27, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is kingsith.co.uk.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 7th 2020. Valid for: 3 months.
This is the only time kingsith.co.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

IP Address AS Autonomous System
15 3.123.23.27 16509 (AMAZON-02)
6 158.233.249.3 201271 (NORDEA-AS)
1 95.100.68.245 16625 (AKAMAI-AS)
22 4
Apex Domain
Subdomains		 Transfer
15 kingsith.co.uk
kingsith.co.uk
218 KB
6 nordea.dk
www.netbank.nordea.dk
9 KB
1 danid.dk
applet.danid.dk
460 B
22 3
Domain Requested by
15 kingsith.co.uk kingsith.co.uk
6 www.netbank.nordea.dk kingsith.co.uk
1 applet.danid.dk kingsith.co.uk
22 3

This site contains no links.

Subject Issuer Validity Valid
kingsith.co.uk
cPanel, Inc. Certification Authority		 2020-03-07 -
2020-06-05		 3 months crt.sh
www.netbank.nordea.dk
Entrust Certification Authority - L1M		 2019-09-19 -
2020-08-15		 a year crt.sh
applet.danid.dk
GlobalSign Organization Validation CA - SHA256 - G2		 2017-05-16 -
2020-07-06		 3 years crt.sh

This page contains 2 frames:

Primary Page: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Frame ID: 570144E0D9CB0B8DD5979027BBE59273
Requests: 17 HTTP requests in this frame

Frame: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/login.php
Frame ID: C271E75FF1480A8D7BDE15F6C340D384
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://kingsith.co.uk/?k=lillheidi Page URL
  2. https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/indexs.php Page URL
  3. https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

22
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

227 kB
Transfer

241 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://kingsith.co.uk/?k=lillheidi Page URL
  2. https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/indexs.php Page URL
  3. https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set /
kingsith.co.uk/ 		631 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kingsith.co.uk/?k=lillheidi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
dedff27183168e50e9133ed9cfed121667c2ee95294283f1ea00b583e06c593a

Request headers

Host
kingsith.co.uk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

Date
Tue, 10 Mar 2020 10:55:47 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=19f085d9d051a5bf4bc81e0c7eb94887; path=/
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
indexs.php
kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/ 		221 B
537 B 		Document
General
Check archive.org
Download Go to
Full URL
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/indexs.php
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/?k=lillheidi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
58429f9ba657278743e1ccded77bba37870c1f52088aaa06fef3ff8978ed4d5f

Request headers

Host
kingsith.co.uk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Referer
https://kingsith.co.uk/?k=lillheidi
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PHPSESSID=19f085d9d051a5bf4bc81e0c7eb94887
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://kingsith.co.uk/?k=lillheidi

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Primary Request update.php
kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/ 		10 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
2788578b56551e3ddc7d67071b291c960484dc67490183985c2a92a3a9268188

Request headers

Host
kingsith.co.uk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/indexs.php
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PHPSESSID=19f085d9d051a5bf4bc81e0c7eb94887
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/indexs.php

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Keep-Alive
timeout=5, max=98
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
enc.js
kingsith.co.uk/files/boot/ 		8 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kingsith.co.uk/files/boot/enc.js
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Last-Modified
Tue, 16 Jul 2019 16:16:24 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
8505
nordea_small_DK.css
www.netbank.nordea.dk/netbank/stylesheets/ 		21 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.netbank.nordea.dk/netbank/stylesheets/nordea_small_DK.css
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/?k=lillheidi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.3 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
d426ca39062a123e263d11b314829b9e79bbc82865b435d8a8f8abf3506e0cbd
Security Headers
Name Value
Strict-Transport-Security max-age=157680000

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Date
Tue, 10 Mar 2020 10:55:49 GMT
Content-Encoding
gzip
Last-Modified
Sat, 05 May 2018 23:29:57 GMT
X-Powered-By
Servlet/2.5 JSP/2.1
ntCoent-Length
21033
Strict-Transport-Security
max-age=157680000
Content-Type
text/css
Cache-Control
private
Accept-Ranges
bytes
Content-Length
5155
load.php
kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/ Frame C271 		16 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/load.php
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/?k=lillheidi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
fbede716b069a5a63f2d386bc1f8b711fc15c286e206a595ab90f2f0bc23ceb1

Request headers

Host
kingsith.co.uk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PHPSESSID=19f085d9d051a5bf4bc81e0c7eb94887
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Server
Apache
Keep-Alive
timeout=5, max=96
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
nordea_logo_blue.gif
kingsith.co.uk/files/ 		562 B
804 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kingsith.co.uk/files/nordea_logo_blue.gif
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
88e3fe7c2217eaf0e3f3fa6d616ff31154556d65568b0af06f135908ffb56960

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Last-Modified
Mon, 17 Feb 2020 11:20:04 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
562
filestitle_netbank.jpg
kingsith.co.uk/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kingsith.co.uk/filestitle_netbank.jpg
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
home.gif
kingsith.co.uk/files/ 		90 B
331 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kingsith.co.uk/files/home.gif
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
4469d2fb935c65395267926aa8fd4483bc9c26da57a3a1def655cc48ec512d64

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Last-Modified
Mon, 17 Feb 2020 11:20:04 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
90
info_information_l.gif
kingsith.co.uk/files/ 		663 B
905 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kingsith.co.uk/files/info_information_l.gif
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d22a981dbaa2fb5e178cd4c2c7cbb0c4ce490b6242a3716b824b1b3619e0c081

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Last-Modified
Mon, 17 Feb 2020 11:20:06 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
663
icon_fp_arrow.gif
kingsith.co.uk/files/ 		208 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kingsith.co.uk/files/icon_fp_arrow.gif
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
e5ee447d433985f10c8c3d6eaa1894ece89d9b8f8b45f6a1ebd0fd149fa5f480

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Last-Modified
Mon, 17 Feb 2020 11:20:06 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
208
i_m_lock.gif
kingsith.co.uk/files/ 		175 B
416 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kingsith.co.uk/files/i_m_lock.gif
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
7f35ada46e604b7d60eaf785a667b442f179a634382289da2cb01622c7409ff0

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Last-Modified
Mon, 17 Feb 2020 11:20:06 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
175
filesnone.gif
kingsith.co.uk/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kingsith.co.uk/filesnone.gif
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:48 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
enc.js
kingsith.co.uk/files/boot/ Frame C271 		8 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kingsith.co.uk/files/boot/enc.js
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/load.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/load.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Tue, 10 Mar 2020 10:55:49 GMT
Last-Modified
Tue, 16 Jul 2019 16:16:24 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
8505
nemid.css
kingsith.co.uk/files/ Frame C271 		168 KB
169 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://kingsith.co.uk/files/nemid.css
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/?k=lillheidi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
cb5c0d422cbee77cf5d102e29dc5156d88cd6b06ad4e3c43b3364dcb8c7c1546

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/load.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Date
Tue, 10 Mar 2020 10:55:49 GMT
Last-Modified
Mon, 17 Feb 2020 11:20:04 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
172510
KAAAAHQNMRk05BzMTZf-hNssOTCM8QhgKsvMh9DZUqgt1Qz_tnP0bLyCB0ZVX43tTf9sdlkh
applet.danid.dk/init/ Frame C271 		116 B
460 B 		Script
General
Check archive.org
Download Go to
Full URL
https://applet.danid.dk/init/KAAAAHQNMRk05BzMTZf-hNssOTCM8QhgKsvMh9DZUqgt1Qz_tnP0bLyCB0ZVX43tTf9sdlkh
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/?k=lillheidi
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.68.245 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-68-245.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a8043c4b72e80ddd872f7086367d30622f7d62b5b862d97180f897bb190b4af6

Request headers

Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/load.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Tue, 10 Mar 2020 10:55:49 GMT
Last-Modified
Tue, 10 Mar 2020 10:55:49 GMT
Vary
*
Content-Language
en-US
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
application/javascript; charset=UTF-8
Content-Length
116
Expires
Fri, 01 Jan 2010 00:00:00 GMT
truncated
/ Frame C271 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ceb3546bf17ea471197d321e4bb1b474d58b62d25f3e0978c33a31e05f748870

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
tabC_background.gif
www.netbank.nordea.dk/netbank/images/theme/ 		54 B
304 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.netbank.nordea.dk/netbank/images/theme/tabC_background.gif
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.3 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
20b64bed9c688786e32515b5ae1d05692cce12fd8ce2c9313f84a3c0fedbadf7
Security Headers
Name Value
Strict-Transport-Security max-age=157680000

Request headers

Referer
https://www.netbank.nordea.dk/netbank/stylesheets/nordea_small_DK.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:49 GMT
Last-Modified
Sat, 05 May 2018 23:29:53 GMT
Accept-Ranges
bytes
X-Powered-By
Servlet/2.5 JSP/2.1
Content-Length
54
Strict-Transport-Security
max-age=157680000
Content-Type
image/gif
tabC_left_on.gif
www.netbank.nordea.dk/netbank/images/theme/ 		173 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.netbank.nordea.dk/netbank/images/theme/tabC_left_on.gif
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.3 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
a6862835b321ceba2b9c159f9677d7b73b83f529aaaf7077d21c0324c0c84eee
Security Headers
Name Value
Strict-Transport-Security max-age=157680000

Request headers

Referer
https://www.netbank.nordea.dk/netbank/stylesheets/nordea_small_DK.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:49 GMT
Last-Modified
Sat, 05 May 2018 23:29:53 GMT
Accept-Ranges
bytes
X-Powered-By
Servlet/2.5 JSP/2.1
Content-Length
173
Strict-Transport-Security
max-age=157680000
Content-Type
image/gif
tabC_right_on.gif
www.netbank.nordea.dk/netbank/images/theme/ 		627 B
878 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.netbank.nordea.dk/netbank/images/theme/tabC_right_on.gif
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.3 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
cd640ec6972da2912796f181f490b0e5ddf151a378ff448f9dd820f589951247
Security Headers
Name Value
Strict-Transport-Security max-age=157680000

Request headers

Referer
https://www.netbank.nordea.dk/netbank/stylesheets/nordea_small_DK.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:49 GMT
Last-Modified
Sat, 05 May 2018 23:29:53 GMT
Accept-Ranges
bytes
X-Powered-By
Servlet/2.5 JSP/2.1
Content-Length
627
Strict-Transport-Security
max-age=157680000
Content-Type
image/gif
sales_gradient.gif
www.netbank.nordea.dk/netbank/images/theme/ 		450 B
701 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.netbank.nordea.dk/netbank/images/theme/sales_gradient.gif
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.3 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
43625e1e7279f5a2ecf1b36855a0e10406e72eaea653c255e9f5d789af321897
Security Headers
Name Value
Strict-Transport-Security max-age=157680000

Request headers

Referer
https://www.netbank.nordea.dk/netbank/stylesheets/nordea_small_DK.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:49 GMT
Last-Modified
Sat, 05 May 2018 23:29:57 GMT
Accept-Ranges
bytes
X-Powered-By
Servlet/2.5 JSP/2.1
Content-Length
450
Strict-Transport-Security
max-age=157680000
Content-Type
image/gif
sales-li.gif
www.netbank.nordea.dk/netbank/images/theme/ 		834 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.netbank.nordea.dk/netbank/images/theme/sales-li.gif
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.233.249.3 , Finland, ASN201271 (NORDEA-AS, SE),
Reverse DNS
Software
/ Servlet/2.5 JSP/2.1
Resource Hash
cfb49cc6a6a4a7342e6654950f1db3f93845715688ab46772c26da8eca0ed61b
Security Headers
Name Value
Strict-Transport-Security max-age=157680000

Request headers

Referer
https://www.netbank.nordea.dk/netbank/stylesheets/nordea_small_DK.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Tue, 10 Mar 2020 10:55:49 GMT
Last-Modified
Sat, 05 May 2018 23:29:57 GMT
Accept-Ranges
bytes
X-Powered-By
Servlet/2.5 JSP/2.1
Content-Length
834
Strict-Transport-Security
max-age=157680000
Content-Type
image/gif
Cookie set login.php
kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/ Frame C271 		184 B
565 B 		Document
General
Check archive.org
Download Go to
Full URL
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/login.php
Requested by
Host: kingsith.co.uk
URL: https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/update.php?locale=da-dk&returnURL=https%3A%2F%2Fwww.nordea.dk%2Fdk-da%2F%23log_paa_selvbetjening%3Fid%3D8526&dk_ID=BrURotSgekSucysMGDntQYEysNKKFHyhARVSidUxwVjaVRetPxeWEGtQA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.23.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-23-27.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
c957e514c9b6362b47b88dd78795dd0a661c8071275c8152af108a43857479d2

Request headers

Host
kingsith.co.uk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/locale=da-DK&?id=
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://kingsith.co.uk/8d6edcd1f3455b998e9c7194b7c15cf4543/locale=da-DK&?id=

Response headers

Date
Tue, 10 Mar 2020 10:55:54 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=84b67342823a52b5257799a797dfdafe; path=/
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| Aes object| Base64 object| Utf8 string| gentot string| udud string| keluaran string| ctrTxt object| _0xa211 function| _kaktys_encode

1 Cookies

Domain/Path Name / Value
kingsith.co.uk/ Name: PHPSESSID
Value: 19f085d9d051a5bf4bc81e0c7eb94887

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

applet.danid.dk
kingsith.co.uk
www.netbank.nordea.dk
158.233.249.3
3.123.23.27
95.100.68.245
20b64bed9c688786e32515b5ae1d05692cce12fd8ce2c9313f84a3c0fedbadf7
2788578b56551e3ddc7d67071b291c960484dc67490183985c2a92a3a9268188
43625e1e7279f5a2ecf1b36855a0e10406e72eaea653c255e9f5d789af321897
4469d2fb935c65395267926aa8fd4483bc9c26da57a3a1def655cc48ec512d64
58429f9ba657278743e1ccded77bba37870c1f52088aaa06fef3ff8978ed4d5f
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f
7f35ada46e604b7d60eaf785a667b442f179a634382289da2cb01622c7409ff0
88e3fe7c2217eaf0e3f3fa6d616ff31154556d65568b0af06f135908ffb56960
a6862835b321ceba2b9c159f9677d7b73b83f529aaaf7077d21c0324c0c84eee
a8043c4b72e80ddd872f7086367d30622f7d62b5b862d97180f897bb190b4af6
c957e514c9b6362b47b88dd78795dd0a661c8071275c8152af108a43857479d2
cb5c0d422cbee77cf5d102e29dc5156d88cd6b06ad4e3c43b3364dcb8c7c1546
cd640ec6972da2912796f181f490b0e5ddf151a378ff448f9dd820f589951247
ceb3546bf17ea471197d321e4bb1b474d58b62d25f3e0978c33a31e05f748870
cfb49cc6a6a4a7342e6654950f1db3f93845715688ab46772c26da8eca0ed61b
d22a981dbaa2fb5e178cd4c2c7cbb0c4ce490b6242a3716b824b1b3619e0c081
d426ca39062a123e263d11b314829b9e79bbc82865b435d8a8f8abf3506e0cbd
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dedff27183168e50e9133ed9cfed121667c2ee95294283f1ea00b583e06c593a
e5ee447d433985f10c8c3d6eaa1894ece89d9b8f8b45f6a1ebd0fd149fa5f480
fbede716b069a5a63f2d386bc1f8b711fc15c286e206a595ab90f2f0bc23ceb1