www.id-sikkerhet.org

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 54.38.46.147, located in France and belongs to OVH, FR. The main domain is www.id-sikkerhet.org.
TLS certificate: Issued by R3 on September 26th 2021. Valid for: 3 months.

This is the only time www.id-sikkerhet.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address	AS Autonomous System
5	54.38.46.147 54.38.46.147	16276 (OVH) (OVH)
1	13.107.246.44 13.107.246.44	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	2

5 54.38.46.147 (France)

ASN16276 (OVH, FR)
PTR: pl2-rbx7.hostingpanel2.com

www.id-sikkerhet.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.246.44 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.vipps.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	id-sikkerhet.org www.id-sikkerhet.org	387 KB
1	vipps.no www.vipps.no	20 KB
6	2

	Domain	Requested by
5	www.id-sikkerhet.org	www.id-sikkerhet.org
1	www.vipps.no	www.id-sikkerhet.org
6	2

This site contains no links.

Subject Issuer	Validity	Valid
id-sikkerhet.org R3	`2021-09-26` - `2021-12-25`	3 months	crt.sh
vipps.no Go Daddy Secure Certificate Authority - G2	`2020-10-13` - `2021-11-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.id-sikkerhet.org/
Frame ID: 76CD6C531566095BAEDF0B5DACF9F8ED
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BankID Sikkerhet

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

407 kB
Transfer

749 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.id-sikkerhet.org/ 1 KB
661 B 122ms
15ms Document
text/html 54.38.46.147
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.id-sikkerhet.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 54.38.46.147 , France, ASN16276 (OVH, FR),
Reverse DNS: pl2-rbx7.hostingpanel2.com
Software: nginx / PleskLin
Resource Hash: b805c85552aae4e4221d00deba3895d7fbea3b84cc3b031ff6c497262031c045

Request headers

:method: GET
:authority: www.id-sikkerhet.org
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
date: Sun, 26 Sep 2021 22:27:50 GMT
content-type: text/html
last-modified: Sun, 26 Sep 2021 21:48:38 GMT
etag: W/"6150eab6-5b9"
x-powered-by: PleskLin
content-encoding: br

GET
H2 200 login.css
www.id-sikkerhet.org/build/ 155 KB
23 KB 35ms
34ms Stylesheet
text/css 54.38.46.147
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.id-sikkerhet.org/build/login.css
Requested by: Host: www.id-sikkerhet.org
URL: https://www.id-sikkerhet.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 54.38.46.147 , France, ASN16276 (OVH, FR),
Reverse DNS: pl2-rbx7.hostingpanel2.com
Software: nginx / PleskLin
Resource Hash: 80cb47cff4575f9c39c8311f84204ec478e15b467c133171b378f555668fcb5e

Request headers

:path: /build/login.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.id-sikkerhet.org
referer: https://www.id-sikkerhet.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.id-sikkerhet.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:27:50 GMT
content-encoding: br
etag: W/"6150eab7-26b81"
last-modified: Sun, 26 Sep 2021 21:48:39 GMT
server: nginx
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 layout.css
www.id-sikkerhet.org/build/ 246 KB
36 KB 49ms
48ms Stylesheet
text/css 54.38.46.147
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.id-sikkerhet.org/build/layout.css
Requested by: Host: www.id-sikkerhet.org
URL: https://www.id-sikkerhet.org/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 54.38.46.147 , France, ASN16276 (OVH, FR),
Reverse DNS: pl2-rbx7.hostingpanel2.com
Software: nginx / PleskLin
Resource Hash: 93f69ae23fcb7420470d67fc915dabdb0f477f89e2b6f911fd1d946aa67bc30b

Request headers

:path: /build/layout.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.id-sikkerhet.org
referer: https://www.id-sikkerhet.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.id-sikkerhet.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:27:50 GMT
content-encoding: br
etag: W/"6150eab7-3d8ce"
last-modified: Sun, 26 Sep 2021 21:48:39 GMT
server: nginx
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 BankID_Main_Logo.png
www.vipps.no/documents/113/ 19 KB
20 KB 323ms
121ms Image
image/png 13.107.246.44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.vipps.no/documents/113/BankID_Main_Logo.png

Requested by

Host: www.id-sikkerhet.org
URL: https://www.id-sikkerhet.org/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.246.44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

e46fa364b0ec7cff5334924a1102e2219f59b7e3df1288ea7c0239464a3d8829

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; img-src 'self' data: https://ssl.gstatic.com https://www.gstatic.com 8218820.fls.doubleclick.net https://res.cloudinary.com https://vipps.no https://www.vipps.no https://px.ads.linkedin.com https://www.facebook.com https://maps.gstatic.com https://maps.googleapis.com https://www.google-analytics.com https://googleads.g.doubleclick.net https://www.google.com https://www.google.no https://www.googletagmanager.com; object-src 'none'; font-src 'self' https://fonts.gstatic.com; manifest-src 'self'; child-src 'self' 8218820.fls.doubleclick.net https://player.gobistories.co https://www.youtube-nocookie.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googleadservices.com https://www.google.com https://maps.googleapis.com https://snap.licdn.com https://connect.facebook.net https://googleads.g.doubleclick.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self' https://contactform-api.vipps.no https://contactform-api-test.vipps.no https://api.gobistories.co https://raw.githubusercontent.com https://data.brreg.no https://api-test.vippsbedrift.no https://api.vippsbedrift.no https://chat.vipps.no https://chat-test.vsmb.no/ https://vipps.no https://www.vipps.no https://www.google-analytics.com; form-action 'self' https://webto.salesforce.com https://vipps.no https://www.vipps.no https://login-staging.vipps.io/ https://login.vipps.io/
Strict-Transport-Security	max-age=31536000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.id-sikkerhet.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src 'none'; img-src 'self' data: https://ssl.gstatic.com https://www.gstatic.com 8218820.fls.doubleclick.net https://res.cloudinary.com https://vipps.no https://www.vipps.no https://px.ads.linkedin.com https://www.facebook.com https://maps.gstatic.com https://maps.googleapis.com https://www.google-analytics.com https://googleads.g.doubleclick.net https://www.google.com https://www.google.no https://www.googletagmanager.com; object-src 'none'; font-src 'self' https://fonts.gstatic.com; manifest-src 'self'; child-src 'self' 8218820.fls.doubleclick.net https://player.gobistories.co https://www.youtube-nocookie.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googleadservices.com https://www.google.com https://maps.googleapis.com https://snap.licdn.com https://connect.facebook.net https://googleads.g.doubleclick.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self' https://contactform-api.vipps.no https://contactform-api-test.vipps.no https://api.gobistories.co https://raw.githubusercontent.com https://data.brreg.no https://api-test.vippsbedrift.no https://api.vippsbedrift.no https://chat.vipps.no https://chat-test.vsmb.no/ https://vipps.no https://www.vipps.no https://www.google-analytics.com; form-action 'self' https://webto.salesforce.com https://vipps.no https://www.vipps.no https://login-staging.vipps.io/ https://login.vipps.io/
content-encoding: None
x-content-type-options: nosniff
x-azure-ref-originshield: 05vNQYQAAAABukvE5RURNTp0VVKkm4I9ZTE9OMjFFREdFMDEyMQBhNTA2YjNkMS1iNDMyLTQ2ODItYmM0OC1lYjYyMTg3Zjg0NGQ=
x-cache: TCP_REMOTE_HIT
content-disposition: attachment; filename="BankID_Main_Logo.png"
strict-transport-security: max-age=31536000; includeSubdomains
content-length: 19181
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 18 Dec 2019 09:24:17 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Sun, 26 Sep 2021 22:27:50 GMT
x-azure-ref: 05vNQYQAAAABbOWeQ2vD2TKyJr1NAVG7OUFJHMDFFREdFMDYxOQBhNTA2YjNkMS1iNDMyLTQ2ODItYmM0OC1lYjYyMTg3Zjg0NGQ=
content-type: image/png
cache-control: public; max-age=3600; s-maxage=259200
etag: "c566a22461c48854d0eb241d549778947e2a1bd0"
link: <https://vipps.no/documents/113/BankID_Main_Logo.png>; rel="canonical"

GET
H2 200 FedraSansAltPro-Book.1fdabbe5.woff
www.id-sikkerhet.org/build/fonts/ 166 KB
166 KB 18ms
18ms Font
application/font-woff 54.38.46.147
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.id-sikkerhet.org/build/fonts/FedraSansAltPro-Book.1fdabbe5.woff
Requested by: Host: www.id-sikkerhet.org
URL: https://www.id-sikkerhet.org/build/login.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 54.38.46.147 , France, ASN16276 (OVH, FR),
Reverse DNS: pl2-rbx7.hostingpanel2.com
Software: nginx / PleskLin
Resource Hash: 7f929b626a86338ac1541137d66552559b5d954757b1de7602202d4b5a772311

Request headers

:path: /build/fonts/FedraSansAltPro-Book.1fdabbe5.woff
pragma: no-cache
origin: https://www.id-sikkerhet.org
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.id-sikkerhet.org
referer: https://www.id-sikkerhet.org/build/login.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.id-sikkerhet.org/build/login.css
Origin: https://www.id-sikkerhet.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:27:50 GMT
last-modified: Sun, 26 Sep 2021 21:48:40 GMT
server: nginx
x-powered-by: PleskLin
etag: "6150eab8-29630"
content-type: application/font-woff
accept-ranges: bytes
content-length: 169520

GET
H2 200 FedraSansAltPro-Bold.6ef1b20c.woff
www.id-sikkerhet.org/build/fonts/ 162 KB
162 KB 35ms
34ms Font
application/font-woff 54.38.46.147
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.id-sikkerhet.org/build/fonts/FedraSansAltPro-Bold.6ef1b20c.woff
Requested by: Host: www.id-sikkerhet.org
URL: https://www.id-sikkerhet.org/build/login.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 54.38.46.147 , France, ASN16276 (OVH, FR),
Reverse DNS: pl2-rbx7.hostingpanel2.com
Software: nginx / PleskLin
Resource Hash: bb4db96fc6343802be44e82b7160c51de4097869aec007d662d6fc37895b6106

Request headers

:path: /build/fonts/FedraSansAltPro-Bold.6ef1b20c.woff
pragma: no-cache
origin: https://www.id-sikkerhet.org
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.id-sikkerhet.org
referer: https://www.id-sikkerhet.org/build/login.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.id-sikkerhet.org/build/login.css
Origin: https://www.id-sikkerhet.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:27:50 GMT
last-modified: Sun, 26 Sep 2021 21:48:40 GMT
server: nginx
x-powered-by: PleskLin
etag: "6150eab8-286f8"
content-type: application/font-woff
accept-ranges: bytes
content-length: 165624

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.id-sikkerhet.org
www.vipps.no
13.107.246.44
54.38.46.147
7f929b626a86338ac1541137d66552559b5d954757b1de7602202d4b5a772311
80cb47cff4575f9c39c8311f84204ec478e15b467c133171b378f555668fcb5e
93f69ae23fcb7420470d67fc915dabdb0f477f89e2b6f911fd1d946aa67bc30b
b805c85552aae4e4221d00deba3895d7fbea3b84cc3b031ff6c497262031c045
bb4db96fc6343802be44e82b7160c51de4097869aec007d662d6fc37895b6106
e46fa364b0ec7cff5334924a1102e2219f59b7e3df1288ea7c0239464a3d8829

www.id-sikkerhet.org Open in urlscan Pro 54.38.46.147 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

407 kBTransfer

749 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

www.id-sikkerhet.org Open in urlscan Pro
54.38.46.147 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

407 kB
Transfer

749 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!