rapportnordea.com Open in urlscan Pro
185.61.153.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rapportnordea.com/
Effective URL:
https://rapportnordea.com/login.php
Submission: On April 12 via manual (April 12th 2021, 6:44:51 am UTC) from DK

Summary HTTP 6 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 185.61.153.106, located in United Kingdom and belongs to NAMECHEAP-NET, US. The main domain is rapportnordea.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 11th 2021. Valid for: a year.

This is the only time rapportnordea.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	185.61.153.106 185.61.153.106	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:801::200a	15169 (GOOGLE) (GOOGLE)
6	4

4 185.61.153.106 (United Kingdom)

ASN22612 (NAMECHEAP-NET, US)
PTR: server257-1.web-hosting.com

rapportnordea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	rapportnordea.com rapportnordea.com	447 KB
1	googleapis.com fonts.googleapis.com	638 B
1	jquery.com code.jquery.com	30 KB
6	3

	Domain	Requested by
4	rapportnordea.com	rapportnordea.com
1	fonts.googleapis.com	rapportnordea.com
1	code.jquery.com	rapportnordea.com
6	3

This site contains links to these domains. Also see Links.

Domain
www.nordea.se

Subject Issuer	Validity	Valid
rapportnordea.com Sectigo RSA Domain Validation Secure Server CA	`2021-04-11` - `2022-04-11`	a year	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://rapportnordea.com/login.php
Frame ID: 25A18B94C8578E06AD60056D7DF4FDD1
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://rapportnordea.com/ Page URL
https://rapportnordea.com/login.php Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

532 kB
Transfer

957 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nordea.se/privat/produkter/mobilbank-internetbank/mobilt-bankid.html
Title: Mobilt BankID

Search URL Search Domain Scan URL

URL: https://www.nordea.se/privat/produkter/mobilbank-internetbank/bank-id.html
Title: BankID på kort och fil (Företagsanvändning)

Search URL Search Domain Scan URL

URL: https://www.nordea.se/privat/kundservice/qr-lasare.html
Title: www.nordea.se/qrläsare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rapportnordea.com/ Page URL
https://rapportnordea.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
15 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
rapportnordea.com/ 53 B
312 B 207ms
132ms Document
text/html 185.61.153.106
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://rapportnordea.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.61.153.106 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server257-1.web-hosting.com
Software: Apache / PHP/7.2.34
Resource Hash: 1eb225faab324e03b5780502bfce371f58ca4ac452201afaa85dbb7b2c7b3597

Request headers

:method: GET
:authority: rapportnordea.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 12 Apr 2021 06:44:35 GMT
server: Apache
x-powered-by: PHP/7.2.34
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=c18bbe21f0e66212c3e825f801047ffe; path=/
content-length: 53
content-type: text/html; charset=UTF-8

GET
H2 200 Primary Request login.php Show response
rapportnordea.com/ 674 KB
443 KB 40ms
40ms Document
text/html 185.61.153.106
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://rapportnordea.com/login.php
Requested by: Host: rapportnordea.com
URL: https://rapportnordea.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.61.153.106 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server257-1.web-hosting.com
Software: Apache / PHP/7.2.34
Resource Hash: f3443aa149ae8374259b35ee8415994d161036912cf8de5a0f2561083bcbe609

Request headers

:method: GET
:authority: rapportnordea.com
:scheme: https
:path: /login.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://rapportnordea.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=c18bbe21f0e66212c3e825f801047ffe
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1
Referer: https://rapportnordea.com/

Response headers

date: Mon, 12 Apr 2021 06:44:35 GMT
server: Apache
x-powered-by: PHP/7.2.34
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ce22eb0c405b78a4247ec19eba5816e03a01a3c065e84a2bc58a23875cd1efc7

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 891 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b34c9039b5f92575e57676734ec42dd908ef1877fe59a4d55b4277db69663830

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 556 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ece7471dc4c8af2f310af1a97a9147c72602165e5d9542536b3bd51535027515

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 642 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b76503946c6f19f7150b0950f704eac5cb94842b7698ea8eb9b0d4372b1bd05

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 67 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9dd630e7cbf1a068b89a5a134e248ff63f2d452081bf86684aeb4b7f73712b76

Request headers

Origin: https://rapportnordea.com
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: application/font-woff2

GET
DATA 200
OK truncated
/ 26 KB
26 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03

Request headers

Origin: https://rapportnordea.com
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: application/font-woff2

GET
DATA 200
OK truncated
/ 26 KB
26 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff

Request headers

Origin: https://rapportnordea.com
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: application/font-woff2

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 22ms
8ms Script
application/javascript 2001:4de0:ac18::1:a:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: rapportnordea.com
URL: https://rapportnordea.com/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Origin: https://rapportnordea.com
Referer: https://rapportnordea.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 12 Apr 2021 06:44:35 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 23:02:39 GMT
server: nginx
etag: W/"5eb09f0f-15d84"
vary: Accept-Encoding
x-hw: 1618209875.dop227.fr8.t,1618209875.cds246.fr8.hc,1618209875.cds142.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30879

GET
H2 200 jquery.loadingModal.min.js Show response
rapportnordea.com/assets/js/ 7 KB
2 KB 30ms
30ms Script
application/javascript 185.61.153.106
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://rapportnordea.com/assets/js/jquery.loadingModal.min.js
Requested by: Host: rapportnordea.com
URL: https://rapportnordea.com/login.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.61.153.106 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server257-1.web-hosting.com
Software: Apache /
Resource Hash: 43ba19a87cfa987a34f01807aa0588a4491cbeb46d67a7cd7277b8baac4eb08d

Request headers

Referer: https://rapportnordea.com/login.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 12 Apr 2021 06:44:35 GMT
content-encoding: gzip
last-modified: Sun, 10 Jan 2021 05:21:12 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1525

GET
H2 200 jquery.loadingModal.min.css
rapportnordea.com/assets/css/ 16 KB
2 KB 31ms
30ms Stylesheet
text/css 185.61.153.106
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://rapportnordea.com/assets/css/jquery.loadingModal.min.css
Requested by: Host: rapportnordea.com
URL: https://rapportnordea.com/login.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.61.153.106 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server257-1.web-hosting.com
Software: Apache /
Resource Hash: 267d912e0f06afd6d687237d658cdb12737185b9730493e66a5637307a6a5011

Request headers

Referer: https://rapportnordea.com/login.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 12 Apr 2021 06:44:35 GMT
content-encoding: gzip
last-modified: Sun, 10 Jan 2021 05:20:58 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 2140

GET
DATA 200
OK truncated
/ 26 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8eb48d905562a6a100dd41183a7782d8505478c21728b69f73fdf2b2a6f76ab

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/jpeg

GET
H2 200 css
fonts.googleapis.com/ 2 KB
638 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans

Requested by

Host: rapportnordea.com
URL: https://rapportnordea.com/assets/css/jquery.loadingModal.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cf7a2b3976c3af63dc2bca70cc5625a26341f19b1ccd484feddf076df895ed58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://rapportnordea.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
date: Mon, 12 Apr 2021 06:44:35 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 12 Apr 2021 06:44:35 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			rapportnordea.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: c18bbe21f0e66212c3e825f801047ffe

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fonts.googleapis.com
rapportnordea.com
185.61.153.106
2001:4de0:ac18::1:a:2b
2a00:1450:4001:801::200a
037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf
0b76503946c6f19f7150b0950f704eac5cb94842b7698ea8eb9b0d4372b1bd05
1eb225faab324e03b5780502bfce371f58ca4ac452201afaa85dbb7b2c7b3597
267d912e0f06afd6d687237d658cdb12737185b9730493e66a5637307a6a5011
3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72
43ba19a87cfa987a34f01807aa0588a4491cbeb46d67a7cd7277b8baac4eb08d
443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03
4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1
9dd630e7cbf1a068b89a5a134e248ff63f2d452081bf86684aeb4b7f73712b76
a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7
a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff
b34c9039b5f92575e57676734ec42dd908ef1877fe59a4d55b4277db69663830
ce22eb0c405b78a4247ec19eba5816e03a01a3c065e84a2bc58a23875cd1efc7
cf7a2b3976c3af63dc2bca70cc5625a26341f19b1ccd484feddf076df895ed58
d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0
e8eb48d905562a6a100dd41183a7782d8505478c21728b69f73fdf2b2a6f76ab
ece7471dc4c8af2f310af1a97a9147c72602165e5d9542536b3bd51535027515
f3443aa149ae8374259b35ee8415994d161036912cf8de5a0f2561083bcbe609
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

rapportnordea.com Open in urlscan Pro 185.61.153.106 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

532 kBTransfer

957 kBSize

1 Cookies

3 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 15 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

rapportnordea.com Open in urlscan Pro
185.61.153.106 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

532 kB
Transfer

957 kB
Size

1
Cookies

6 HTTP transactions
15 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!