ebooklogpa.cloudaccess.host
Open in
urlscan Pro
104.37.86.29
Malicious Activity!
Public Scan
Effective URL: https://ebooklogpa.cloudaccess.host/e-boks.pa-log-in-5/e-boke.html
Submission: On November 20 via manual from DK
Summary
TLS certificate: Issued by RapidSSL RSA CA 2018 on October 3rd 2019. Valid for: 2 years.
This is the only time ebooklogpa.cloudaccess.host was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Danske Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 160.153.128.172 160.153.128.172 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
3 | 104.37.86.29 104.37.86.29 | 54456 (CLOUDACCE...) (CLOUDACCESS-NETWORK - CloudAccess.net) | |
2 | 23.8.12.29 23.8.12.29 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
6 | 3 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-160-153-128-172.ip.secureserver.net
gic.net.kw |
ASN54456 (CLOUDACCESS-NETWORK - CloudAccess.net, LLC, US)
PTR: lamp128-out.cloudaccess.net
ebooklogpa.cloudaccess.host |
ASN20940 (AKAMAI-ASN1, US)
PTR: a23-8-12-29.deploy.static.akamaitechnologies.com
logon.e-boks.dk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
cloudaccess.host
ebooklogpa.cloudaccess.host |
10 KB |
2 |
e-boks.dk
logon.e-boks.dk |
22 KB |
2 |
gic.net.kw
1 redirects
gic.net.kw |
603 B |
6 | 3 |
Domain | Requested by | |
---|---|---|
3 | ebooklogpa.cloudaccess.host |
gic.net.kw
ebooklogpa.cloudaccess.host |
2 | logon.e-boks.dk |
ebooklogpa.cloudaccess.host
|
2 | gic.net.kw | 1 redirects |
6 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.e-boks.dk |
www.nemid.nu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cloudaccess.host RapidSSL RSA CA 2018 |
2019-10-03 - 2021-12-01 |
2 years | crt.sh |
www.e-boks.dk DigiCert SHA2 Extended Validation Server CA |
2018-09-10 - 2020-09-09 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://ebooklogpa.cloudaccess.host/e-boks.pa-log-in-5/e-boke.html
Frame ID: 90BEBFD8BBE9B780081F4A8CF3B6B4EA
Requests: 5 HTTP requests in this frame
Frame:
https://ebooklogpa.cloudaccess.host/e-boks.pa-log-in-5/e-boke_files/75395100.html
Frame ID: D6AC83BAB672E692CDF2AD4882726491
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://gic.net.kw/5
HTTP 301
http://gic.net.kw/5/ Page URL
- https://ebooklogpa.cloudaccess.host/e-boks.pa-log-in-5/e-boke.html Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Problemer med at logge på med NemID
Search URL Search Domain Scan URL
Title: Certifikat/Signatur er udløbet
Search URL Search Domain Scan URL
Title: Bestil NemID
Search URL Search Domain Scan URL
Title: Download NemID Nøgleapp
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://gic.net.kw/5
HTTP 301
http://gic.net.kw/5/ Page URL
- https://ebooklogpa.cloudaccess.host/e-boks.pa-log-in-5/e-boke.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://gic.net.kw/5 HTTP 301
- http://gic.net.kw/5/
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
gic.net.kw/5/ Redirect Chain
|
104 B 371 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
e-boke.html
ebooklogpa.cloudaccess.host/e-boks.pa-log-in-5/ |
9 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
logon.e-boks.dk/nemid/Content/stylesheet/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
e-boks_dk_invert_304x60.png
ebooklogpa.cloudaccess.host/e-boks.pa-log-in-5/e-boke_files/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
75395100.html
ebooklogpa.cloudaccess.host/e-boks.pa-log-in-5/e-boke_files/ Frame D6AC |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nemid_super_croped.png
logon.e-boks.dk/nemid/Content/images/backgrounds/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Danske Bank (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| onNemIDMessage0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ebooklogpa.cloudaccess.host
gic.net.kw
logon.e-boks.dk
104.37.86.29
160.153.128.172
23.8.12.29
1cb34a08e0e97b177f5ff6e00b4aeda427046aeba842fd464e367a61b1ddfe85
3eb52bc81bb2cc13053f13d00e24dc356397a176874772966c0a34107c5ac51f
3f59e457e10a0eb1633d69eb8343cb89cb885202b69c44f8b8be77223b5bab46
84924f104696624417468f578a1ccbc37e6e0da1d4dd28d705b914209b710afc
b886a602141dedad0d1cebbba9310bc97a1d2018ff478b1b3d8fce51cf9810ad
f5b9846af3fea396d9b4a324b25e218446ed4d0f31a813bcb6116c5a9d60f17a