www.nordeaonline.com Open in urlscan Pro
198.54.126.99  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response www.nordeaonline.com/netbin/	41 KB 11 KB	908ms 582ms	Document text/html	198.54.126.99 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.nordeaonline.com/netbin/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.99 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server51-1.web-hosting.com Software LiteSpeed / PHP/5.6.40 Resource Hash 9061afc7eeba16fc83537a9f15ed227244b7d775030425b73448f99a07182379 Request headers :method GET :authority www.nordeaonline.com :scheme https :path /netbin/login.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-powered-by PHP/5.6.40 set-cookie PHPSESSID=9i7sinrbg1pkou6rbjn09llsr5; path=/; secure expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache content-type text/html; charset=UTF-8 content-encoding br vary Accept-Encoding date Mon, 03 May 2021 11:09:40 GMT server LiteSpeed x-turbo-charged-by LiteSpeed
GET H2	200	sweetalert.min.js Show response www.nordeaonline.com/assets/js/custom/	40 KB 11 KB	154ms 154ms	Script application/javascript	198.54.126.99 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.nordeaonline.com/assets/js/custom/sweetalert.min.js Requested by Host: www.nordeaonline.com URL: https://www.nordeaonline.com/netbin/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.99 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server51-1.web-hosting.com Software LiteSpeed / Resource Hash 2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b Request headers :path /assets/js/custom/sweetalert.min.js pragma no-cache cookie PHPSESSID=9i7sinrbg1pkou6rbjn09llsr5 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.nordeaonline.com referer https://www.nordeaonline.com/netbin/login.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.nordeaonline.com/netbin/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 03 May 2021 11:09:40 GMT content-encoding br last-modified Fri, 22 May 2020 02:24:46 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 11427 expires Mon, 10 May 2021 11:09:40 GMT
GET H/1.1	200 OK	styles-90d1ba6c2eef1d8f73fc94069cfe444b.css identify.nordea.com/assets/	29 KB 6 KB	330ms 41ms	Stylesheet text/css	158.233.249.231 NORDEA-AS
General Check archive.org Show headers Download Go to Full URL https://identify.nordea.com/assets/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Requested by Host: www.nordeaonline.com URL: https://www.nordeaonline.com/netbin/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.233.249.231 , Sweden, ASN201271 (NORDEA-AS, SE), Reverse DNS Software / Resource Hash c52420b71e624dbd9e17fd88a0b97df1ba38d3c92a43592a251c0bd62fa0825c Security Headers Name Value Strict-Transport-Security max-age=157680000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.nordeaonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 03 May 2021 11:09:40 GMT Content-Encoding gzip Referrer-Policy origin Last-Modified Wed, 17 Feb 2021 05:39:30 GMT X-Backside-Transport OK OK,OK OK Transfer-Encoding chunked Content-Type text/css nnCoection close X-XSS-Protection 1; mode=block Cache-Control max-age=86400 X-Global-Transaction-ID c53680ad608fd9f41fcda65f Strict-Transport-Security max-age=157680000; includeSubDomains Vary Accept-Encoding, User-Agent X-Content-Type-Options nosniff
GET H/1.1	200 OK	offline-8599dbe5088e0566b0e39373d3a56b60.svg identify.nordea.com/assets/images/	2 KB 1 KB	41ms 41ms	Image image/svg+xml	158.233.249.231 NORDEA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://identify.nordea.com/assets/images/offline-8599dbe5088e0566b0e39373d3a56b60.svg Requested by Host: www.nordeaonline.com URL: https://www.nordeaonline.com/netbin/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.233.249.231 , Sweden, ASN201271 (NORDEA-AS, SE), Reverse DNS Software / Resource Hash 4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae Security Headers Name Value Strict-Transport-Security max-age=157680000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.nordeaonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers X-Backside-Transport OK OK,OK OK Date Mon, 03 May 2021 11:09:40 GMT Content-Encoding gzip Referrer-Policy origin Last-Modified Wed, 17 Feb 2021 05:39:30 GMT ETag "8599dbe5088e0566b0e39373d3a56b60" Transfer-Encoding chunked Content-Type image/svg+xml nnCoection close X-XSS-Protection 1; mode=block Cache-Control max-age=86400 X-Global-Transaction-ID c53680ad608fd9f41fcda73f Strict-Transport-Security max-age=157680000; includeSubDomains Vary Accept-Encoding, User-Agent X-Content-Type-Options nosniff
GET H/1.1	200 OK	code_calculator-6af4aa53625a02dcb8b5cfd7ac2d30bd.svg identify.nordea.com/assets/images/	671 B 827 B	69ms 41ms	Image image/svg+xml	158.233.249.231 NORDEA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://identify.nordea.com/assets/images/code_calculator-6af4aa53625a02dcb8b5cfd7ac2d30bd.svg Requested by Host: www.nordeaonline.com URL: https://www.nordeaonline.com/netbin/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.233.249.231 , Sweden, ASN201271 (NORDEA-AS, SE), Reverse DNS Software / Resource Hash 23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf Security Headers Name Value Strict-Transport-Security max-age=157680000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.nordeaonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers X-Backside-Transport OK OK,OK OK Date Mon, 03 May 2021 11:09:40 GMT Content-Encoding gzip Referrer-Policy origin Last-Modified Wed, 17 Feb 2021 05:39:30 GMT ETag "6af4aa53625a02dcb8b5cfd7ac2d30bd" Transfer-Encoding chunked Content-Type image/svg+xml nnCoection close X-XSS-Protection 1; mode=block Cache-Control max-age=86400 X-Global-Transaction-ID c53680ad608fd9f4050689f5 Strict-Transport-Security max-age=157680000; includeSubDomains Vary Accept-Encoding, User-Agent X-Content-Type-Options nosniff
GET H/1.1	200 OK	scripts-6db7f1f3edd0e72b01f4957bf91c3b91.js Show response identify.nordea.com/assets/	95 KB 21 KB	172ms 43ms	Script application/javascript	158.233.249.231 NORDEA-AS
General Check archive.org Show headers Download Go to Full URL https://identify.nordea.com/assets/scripts-6db7f1f3edd0e72b01f4957bf91c3b91.js Requested by Host: www.nordeaonline.com URL: https://www.nordeaonline.com/netbin/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.233.249.231 , Sweden, ASN201271 (NORDEA-AS, SE), Reverse DNS Software / Resource Hash b5c035c93478a4792b01db15814b7a2bb21b3d281f609cbac6ea09bd4d4237a1 Security Headers Name Value Strict-Transport-Security max-age=157680000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.nordeaonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers X-Backside-Transport OK OK,OK OK Date Mon, 03 May 2021 11:09:40 GMT Content-Encoding gzip Referrer-Policy origin Last-Modified Wed, 17 Feb 2021 05:39:30 GMT ETag "6db7f1f3edd0e72b01f4957bf91c3b91" Transfer-Encoding chunked Content-Type application/javascript nnCoection close X-XSS-Protection 1; mode=block Cache-Control max-age=86400 X-Global-Transaction-ID c2da75b4608fd9f41fbf514f Strict-Transport-Security max-age=157680000; includeSubDomains Vary Accept-Encoding, User-Agent X-Content-Type-Options nosniff
GET DATA	200 OK	truncated /	43 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/gif
GET H/1.1	200 OK	564d0ff0f3578b7128a458ef269b286a.jpg identify.nordea.com/assets/	67 KB 67 KB	79ms 40ms	Image image/jpeg	158.233.249.231 NORDEA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://identify.nordea.com/assets/564d0ff0f3578b7128a458ef269b286a.jpg Requested by Host: identify.nordea.com URL: https://identify.nordea.com/assets/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.233.249.231 , Sweden, ASN201271 (NORDEA-AS, SE), Reverse DNS Software / Resource Hash 836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff Security Headers Name Value Strict-Transport-Security max-age=157680000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://identify.nordea.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 03 May 2021 11:09:40 GMT Content-Encoding gzip Referrer-Policy origin Last-Modified Wed, 17 Feb 2021 05:40:58 GMT X-Backside-Transport OK OK,OK OK Transfer-Encoding chunked Content-Type image/jpeg nnCoection close X-XSS-Protection 1; mode=block Cache-Control max-age=86400 X-Global-Transaction-ID c2da75b4608fd9f41fbf544f Strict-Transport-Security max-age=157680000; includeSubDomains X-Content-Type-Options nosniff
GET		c233a817ad142919d728ebf4c8b3d54c.woff2 identify.nordea.com/assets/	0 0
GET		7bc117ce8cbf2ce4b08a7ed17d16cf89.woff2 identify.nordea.com/assets/	0 0
GET H2	200	getMessage Show response www.nordea.com/wemapp/api/	11 B 207 B	112ms 24ms	XHR application/json	92.123.148.206 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.nordea.com/wemapp/api/getMessage?id=281 Requested by Host: identify.nordea.com URL: https://identify.nordea.com/assets/scripts-6db7f1f3edd0e72b01f4957bf91c3b91.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.123.148.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a92-123-148-206.deploy.static.akamaitechnologies.com Software / Resource Hash 8fe32e407a1038ee38753b70e5374b3a46d6ae9d5f16cd5b73c53abaca8f5ed0 Security Headers Name Value Strict-Transport-Security max-age=31536000, max-age=157680000 Request headers Referer https://www.nordeaonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000, max-age=157680000 date Mon, 03 May 2021 11:09:40 GMT p3p CP="This is not a P3P policy!!!" access-control-allow-origin * cache-control public, max-age=24 content-type application/json;charset=UTF-8 content-length 11
GET		e18bb962ed5dc6adc929833b78251735.woff identify.nordea.com/assets/	0 0
GET		8303da27eb3496a604f280ca8f3b4388.woff identify.nordea.com/assets/	0 0
GET H2	404	service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg www.nordeaonline.com/assets/images/	10 KB 10 KB	155ms 154ms	Image text/html	198.54.126.99 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.nordeaonline.com/assets/images/service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.99 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server51-1.web-hosting.com Software LiteSpeed / Resource Hash 069ec957512c2ff22bc1b933ac9cd60c2cdf1d154980b717be48553975ce0855 Request headers :path /assets/images/service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg pragma no-cache cookie PHPSESSID=9i7sinrbg1pkou6rbjn09llsr5 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.nordeaonline.com referer https://www.nordeaonline.com/netbin/login.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.nordeaonline.com/netbin/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 03 May 2021 11:09:40 GMT content-encoding gzip x-turbo-charged-by LiteSpeed server LiteSpeed vary Accept-Encoding content-type text/html
GET H2	404	technical-error-91ca9eec9eed6ed945355d650bb10d41.svg www.nordeaonline.com/assets/images/	10 KB 10 KB	157ms 156ms	Image text/html	198.54.126.99 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.nordeaonline.com/assets/images/technical-error-91ca9eec9eed6ed945355d650bb10d41.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.99 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server51-1.web-hosting.com Software LiteSpeed / Resource Hash 069ec957512c2ff22bc1b933ac9cd60c2cdf1d154980b717be48553975ce0855 Request headers :path /assets/images/technical-error-91ca9eec9eed6ed945355d650bb10d41.svg pragma no-cache cookie PHPSESSID=9i7sinrbg1pkou6rbjn09llsr5 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.nordeaonline.com referer https://www.nordeaonline.com/netbin/login.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.nordeaonline.com/netbin/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 03 May 2021 11:09:40 GMT content-encoding gzip x-turbo-charged-by LiteSpeed server LiteSpeed vary Accept-Encoding content-type text/html
GET H2	404	something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg www.nordeaonline.com/assets/images/	10 KB 10 KB	296ms 295ms	Image text/html	198.54.126.99 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.nordeaonline.com/assets/images/something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.99 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server51-1.web-hosting.com Software LiteSpeed / Resource Hash 069ec957512c2ff22bc1b933ac9cd60c2cdf1d154980b717be48553975ce0855 Request headers :path /assets/images/something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg pragma no-cache cookie PHPSESSID=9i7sinrbg1pkou6rbjn09llsr5 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.nordeaonline.com referer https://www.nordeaonline.com/netbin/login.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.nordeaonline.com/netbin/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 03 May 2021 11:09:40 GMT content-encoding gzip x-turbo-charged-by LiteSpeed server LiteSpeed vary Accept-Encoding content-type text/html
GET H2	404	cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg www.nordeaonline.com/assets/images/	10 KB 10 KB	298ms 297ms	Image text/html	198.54.126.99 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.nordeaonline.com/assets/images/cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.99 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server51-1.web-hosting.com Software LiteSpeed / Resource Hash 069ec957512c2ff22bc1b933ac9cd60c2cdf1d154980b717be48553975ce0855 Request headers :path /assets/images/cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg pragma no-cache cookie PHPSESSID=9i7sinrbg1pkou6rbjn09llsr5 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.nordeaonline.com referer https://www.nordeaonline.com/netbin/login.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.nordeaonline.com/netbin/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 03 May 2021 11:09:40 GMT content-encoding gzip x-turbo-charged-by LiteSpeed server LiteSpeed vary Accept-Encoding content-type text/html
GET H2	404	no-connection-83f79e2367a313b468986e12a237c346.svg www.nordeaonline.com/assets/images/	10 KB 10 KB	333ms 332ms	Image text/html	198.54.126.99 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.nordeaonline.com/assets/images/no-connection-83f79e2367a313b468986e12a237c346.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.99 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server51-1.web-hosting.com Software LiteSpeed / Resource Hash 069ec957512c2ff22bc1b933ac9cd60c2cdf1d154980b717be48553975ce0855 Request headers :path /assets/images/no-connection-83f79e2367a313b468986e12a237c346.svg pragma no-cache cookie PHPSESSID=9i7sinrbg1pkou6rbjn09llsr5 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.nordeaonline.com referer https://www.nordeaonline.com/netbin/login.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.nordeaonline.com/netbin/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 03 May 2021 11:09:40 GMT content-encoding gzip x-turbo-charged-by LiteSpeed server LiteSpeed vary Accept-Encoding content-type text/html
GET H2	404	empty-3857ebe69f653487f8c9d99adde4657f.svg www.nordeaonline.com/assets/images/	10 KB 10 KB	334ms 333ms	Image text/html	198.54.126.99 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.nordeaonline.com/assets/images/empty-3857ebe69f653487f8c9d99adde4657f.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.99 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server51-1.web-hosting.com Software LiteSpeed / Resource Hash 069ec957512c2ff22bc1b933ac9cd60c2cdf1d154980b717be48553975ce0855 Request headers :path /assets/images/empty-3857ebe69f653487f8c9d99adde4657f.svg pragma no-cache cookie PHPSESSID=9i7sinrbg1pkou6rbjn09llsr5 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.nordeaonline.com referer https://www.nordeaonline.com/netbin/login.php :scheme https sec-fetch-site same-origin :method GET Referer https://www.nordeaonline.com/netbin/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 03 May 2021 11:09:40 GMT content-encoding gzip x-turbo-charged-by LiteSpeed server LiteSpeed vary Accept-Encoding content-type text/html

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

identify.nordea.com

URL

https://identify.nordea.com/assets/c233a817ad142919d728ebf4c8b3d54c.woff2

Domain

identify.nordea.com

URL

https://identify.nordea.com/assets/7bc117ce8cbf2ce4b08a7ed17d16cf89.woff2

Domain

identify.nordea.com

URL

https://identify.nordea.com/assets/e18bb962ed5dc6adc929833b78251735.woff

Domain

identify.nordea.com

URL

https://identify.nordea.com/assets/8303da27eb3496a604f280ca8f3b4388.woff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| setImmediate function| clearImmediate function| swal function| sweetAlert function| safeLog function| ignore object| httpLogger object| App

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.nordeaonline.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 9i7sinrbg1pkou6rbjn09llsr5

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://www.nordeaonline.com/netbin/login.php(Line 24) Message: Stop! This is a browser feature intended for developers. Using the console may allow attackers to impersonate you and steal your information using an attack called Self-XSS. Do not enter code that you do not understand.
console-api	log	URL: https://www.nordeaonline.com/netbin/login.php(Line 59) Message: Loaded: https://identify.nordea.com/assets/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css
console-api	log	URL: https://www.nordeaonline.com/netbin/login.php(Line 59) Message: Loaded: https://identify.nordea.com/assets/scripts-6db7f1f3edd0e72b01f4957bf91c3b91.js
console-api	error	URL: https://www.nordeaonline.com/netbin/login.php(Line 63) Message: Script error. at :0:0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

identify.nordea.com
www.nordea.com
www.nordeaonline.com
identify.nordea.com
158.233.249.231
198.54.126.99
92.123.148.206
069ec957512c2ff22bc1b933ac9cd60c2cdf1d154980b717be48553975ce0855
23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf
2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b
4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
8fe32e407a1038ee38753b70e5374b3a46d6ae9d5f16cd5b73c53abaca8f5ed0
9061afc7eeba16fc83537a9f15ed227244b7d775030425b73448f99a07182379
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b5c035c93478a4792b01db15814b7a2bb21b3d281f609cbac6ea09bd4d4237a1
c52420b71e624dbd9e17fd88a0b97df1ba38d3c92a43592a251c0bd62fa0825c