norgeid.com Open in urlscan Pro
2606:4700:3033::6815:2134 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://norgeid.com/
Effective URL:
https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/
Submission: On October 05 via manual (October 5th 2023, 3:30:10 pm UTC) from NO — Scanned from NO

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3033::6815:2134, located in United States and belongs to CLOUDFLARENET, US. The main domain is norgeid.com.
TLS certificate: Issued by E1 on October 4th 2023. Valid for: 3 months.

This is the only time norgeid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:303... 2606:4700:3036::ac43:8d69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 19	2606:4700:303... 2606:4700:3033::6815:2134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	2

2 2606:4700:3036::ac43:8d69 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

norgeid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2606:4700:3033::6815:2134 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

norgeid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	norgeid.com 4 redirects norgeid.com	152 KB
17	1

	Domain	Requested by
21	norgeid.com	4 redirects norgeid.com
17	1

This site contains no links.

Subject Issuer	Validity	Valid
*.norgeid.com E1	`2023-10-04` - `2024-01-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/
Frame ID: 5EB4073C3363AE5BEB3614BF83D99A15
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OIDC Client

Page URL History Show full URLs

http://norgeid.com/ HTTP 301
https://norgeid.com/ Page URL
https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e HTTP 301
http://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/ HTTP 301
https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/ HTTP 302
https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/ Page URL

Detected technologies

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

150 kB
Transfer

463 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://norgeid.com/ HTTP 301
https://norgeid.com/ Page URL
https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e HTTP 301
http://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/ HTTP 301
https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/ HTTP 302
https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://norgeid.com/ HTTP 301
https://norgeid.com/

17 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response norgeid.com/ Redirect Chain http://norgeid.com/ https://norgeid.com/	728 B 889 B	239ms 153ms	Document text/html	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `71f14c8af759d15597a7d8e5e1494cc7ba99b89088c4ebd7eced54acaff71984` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language no-NO,no;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8116b431a911569c-OSL content-encoding br content-type text/html; charset=UTF-8 date Thu, 05 Oct 2023 15:30:05 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uemqFjv0ZwoTVn3AO7we1uvon9as0ooeTzOfW1585M6JQQzx9iNohdjIOkzkuPALeoZM%2BhdaROAGX5LFhBwnpoC%2F6znRuIG4xLt40g%2Fikn8wwYBCcmtYr3Avj%2B4T0%2BgEKnV2r9He5VGDSw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers CF-RAY 8116b430dded5687-OSL Cache-Control max-age=3600 Connection keep-alive Date Thu, 05 Oct 2023 15:30:05 GMT Expires Thu, 05 Oct 2023 16:30:05 GMT Location https://norgeid.com/ NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LYxmdRw8iXmi7U8x40DMqFX%2FphZuYsqf8vNtl%2FypMje0698o25ZPf8j0sFnbvebZoDoTpo%2FiinjFnTfUZyBDCvIMFu7awOaiMVW9wmSZLC%2FH08K1bGm7Bm2Bmr%2BMW6vZnZJx895d6N0mZA%3D%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400
GET H3	200	Primary Request / Show response norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/ Redirect Chain https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e? http://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/? https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/? https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/?	92 KB 24 KB	564ms 563ms	Document text/html	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Requested by Host: norgeid.com URL: https://norgeid.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b71a6f0cfde446fb60e66b6c00160fa20fd2083caccbcb71bfa2d7eb8f56cac7` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language no-NO,no;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-cache, no-store, must-revalidate cf-cache-status DYNAMIC cf-ray 8116b43a3c3eb517-OSL content-encoding br content-type text/html; charset=UTF-8 date Thu, 05 Oct 2023 15:30:07 GMT expires 0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=idH4sy7itEMo0pF1V%2B9rRhwptJA0ttAxQBqwpQouGCk98%2BR59Ulkq%2FpXhvVIg8V07kAYxNAzF7NWoDJzvET4RrMPwXe5cmdLIpPD2OPO9%2FKQZcbioxK%2B7cKVmx1lf0I2PqD1l7BKktFD1Q%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8116b439cbe0b517-OSL content-type text/html; charset=UTF-8 date Thu, 05 Oct 2023 15:30:07 GMT location login/? nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YeA6tGaiuRuF9bNTYPOvwA3Hx3DhNqeMd1ALzmMmLswZFTSqLG7ajZbta%2Bf09GQ3yYcyUy6dBH2Rubl%2BSTkMPGZ3K%2BmWlJvXWu2W7QaEB1T%2BCWFEu%2B7Hbn5gJIcL%2B1XMyu30ORFd3lDtyA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H3	404	index.ec33b587.css norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/assets/	0 0	96ms 91ms	Stylesheet text/html	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/assets/index.ec33b587.css Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wYMpt9e9c9%2FxDeR2fhPqioYNFrYlNGDSzpguiVoMzQhs1gbICb3CuR6veRnQLWV7P99v0Gr5J3hKPr2DXP7SVntf9Pw1E84OMUF0JnaszyKOs3czQ3fhzFacSpCK1JNb2VQvhPw9x13lrA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 8116b43ddfefb517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	jquery.min.js Show response norgeid.com/bower_components/jquery/dist/	85 KB 31 KB	72ms 68ms	Script application/javascript	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/bower_components/jquery/dist/jquery.min.js Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status HIT last-modified Tue, 26 Oct 2021 02:59:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 2140 etag W/"15283-5cf38a9984480-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TNZxluBVpDWh3lmZVSLHyq2AAqJjjmpe7uzXBthkHGvMmrDPiWLRxSY%2BL6E2hOcEISsIw%2Bygy8Bz3qPFNv%2FV%2FjrjC3FvbCwCTp%2B3Kyl58PHV9b7pv8mBCis8QSQ3OeuLKOIVipDviIyypg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 8116b43ddff0b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	ua-parser.min.js Show response norgeid.com/bower_components/ua-parser-js/dist/	17 KB 7 KB	55ms 51ms	Script application/javascript	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/bower_components/ua-parser-js/dist/ua-parser.min.js Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status HIT last-modified Tue, 26 Oct 2021 02:59:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 2142 etag W/"4298-5cf38a9984480-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CbRHnjrbvCbN%2BUp2jx9CDSjw4fSmYlmTCDle6LXgd6PVMkZAT1yMzChE48gWlaklbvqlW8IaQ9TLiqcsso0wbhZrcmpzoGUWxZ09GaRJRNO2MJdKPuTu79HDAx2U2k0C9%2F3UQsPHflqLww%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 8116b43ddff1b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	font-awesome.min.css norgeid.com/bower_components/font-awesome/css/	30 KB 7 KB	96ms 92ms	Stylesheet text/css	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status HIT last-modified Tue, 26 Oct 2021 02:59:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 2142 etag W/"7918-5cf38a9984480-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NwAtVbkow4bCyecgYggkwkMkl0hnb4Tketj6GZBvXGxlyZlj71IEDxOFQ%2B2Bnz5XAGRaZto1WtLHp40QM%2BxviBIHUo90sN2tWf%2F19t9c%2BQCqxCqeCA9LHToTy2122CDzmtSyAqxBeEDEmA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 8116b43ddff3b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	core_form.js Show response norgeid.com/core/form/	19 KB 5 KB	53ms 49ms	Script application/javascript	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/core/form/core_form.js Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `48bb3380e42b806624d4bee159c2964e969327ade4283548383a5f6c2d360a91` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status HIT last-modified Thu, 05 Oct 2023 02:17:36 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 2139 etag W/"4c6b-606eeba3b6e68-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SO0nYQzWTNvYoDsPPz2%2FuszF1uKptOt5dt%2FmX0R7x89t4QmzsT3Nj7lGiHRq5bSfEcZBpFM2T3TVhX3L6uC0ceyZa4WV%2FtaA4ME06ws9FlaNY65hHuiXEhz8BKAl%2BErZk2x0K9Kag2Jn1A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 8116b43ddff4b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	core_token.js Show response norgeid.com/core/token/	21 KB 2 KB	111ms 107ms	Script application/javascript	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/core/token/core_token.js?1696519807 Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4c3e4071216a137c68f9021cc6d649ced6c05d900d28ae9d3bd3750ad603b4f8` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status MISS last-modified Thu, 05 Oct 2023 02:16:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"546d-606eeb64c19cb-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gi6sT86sqWJMgJtYBSdyeJ7qQMQK6cvuGoaPxWzi9OKBQinXX7o0e54CR0yPo3nmH0RM6IEOnAiKwzM3oD6vr%2Fg1ArrGRuohxi8BhWrHENEfsJC83SFYllyqqaLqqwkPsAgSibmBXZ5UxQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 8116b43ddff5b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	angular.min.js Show response norgeid.com/bower_components/angular/	165 KB 59 KB	112ms 107ms	Script application/javascript	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/bower_components/angular/angular.min.js Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status HIT last-modified Tue, 26 Oct 2021 02:59:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 2142 etag W/"2937c-5cf38a9984480-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S14Lc%2FEhyIrPk0xZ%2FSJKU8R9PH6N1dFd5%2BKBdmkYpfWwuVVL7nowPCMZSPuM2H%2BPB7CJcjGeiY1LFWFo5H1w8tOZfVprFpe%2BYBFT9fB52xvao9UkNFBkGdNyGu84xWyswco3uVtqirUGLQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 8116b43ddff6b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	jquery.maskedinput.min.js Show response norgeid.com/bower_components/jquery.maskedinput/dist/	16 KB 4 KB	149ms 144ms	Script application/javascript	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/bower_components/jquery.maskedinput/dist/jquery.maskedinput.min.js Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6a2f967ab83a1b16b06c60bbbbbe901f1719b620718f43ee6b7a48d7578cee67` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status HIT last-modified Tue, 26 Oct 2021 02:59:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 2142 etag W/"4001-5cf38a9984480-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VDwaq4eMD31%2FFS7hnfUE1B3s9%2FQwVltvmWDOf7PcYt8FYcoo9jF1Qs5%2Fkmi8EFtOWeFT3%2BmZ83sQux2gcId9NoP3m2%2FJa2CwUxGAXv6Q0lv4FWxFu7e70EDOxYlj3Dt4V9roXMIyxY%2B8Ww%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 8116b43ddff7b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	core_form.css norgeid.com/core/form/	3 KB 1 KB	149ms 144ms	Stylesheet text/css	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/core/form/core_form.css Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `406a11c423ffe3d6c6c94df7fbe6eaf6f49a70086e9f82bbfa0cad51fbd31ad8` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status HIT last-modified Tue, 26 Oct 2021 02:59:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 2142 etag W/"adb-5cf38a9984480-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZSj%2B27pLTe4SavuC2NLI6nkws6D73RvU7qpCqbN8GGYDe8%2F1rC2Mo1rqIEs%2FXlz0%2F9W%2FwTrvMRPIeGzSEsOHo8lJpJO3Aq6GjrdZHg9yHRBQ8SrJRcXqBMJIl4TxQDHdnlpv7KCN4rOwSQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 8116b43ddff8b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	form.js Show response norgeid.com/login/form/	3 KB 1 KB	118ms 117ms	Script application/javascript	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/login/form/form.js?v=651ed67f8dd18 Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status MISS last-modified Tue, 26 Oct 2021 02:59:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"bf7-5cf38a9984480-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b2MFh10Kj5DNfDtlk1fCN1NZ4J%2FiW4PXvxss9P6%2Bs8RqAq%2BJGbQDLCQ%2F%2FXMq1CD8RfcBFAnOPYyDkACpVheurEjEahJnuaeeb0BLm1GoTzY9UwcQxmW4gQQi51dF38pQnyfj%2Fze56D7beQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 8116b43e0820b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	ng.js Show response norgeid.com/login/ng/	6 KB 2 KB	118ms 117ms	Script application/javascript	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/login/ng/ng.js?v=651ed67f8dd1e Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c214695e0609b540ab0885b59787f76a0e0be8ccb2a333d8d2231ecae1825f4b` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status MISS last-modified Tue, 26 Oct 2021 02:59:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"16af-5cf38a9984480-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LZIQSGzfGXcVKQkkwZH%2FhwAo9bZy71rSm7iGAzrkzHum9IZz51GYcGqGYcJsQwp62MnLcxYOgA%2FUbdhMrsn0V8MhNkJxEKEqb5OtT3jXgpQFdINNrweEhi1kyG6J2vwbiOULP9pSW5SyXg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 8116b43e0822b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	token.js Show response norgeid.com/login/token/	1 KB 1015 B	119ms 117ms	Script application/javascript	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/login/token/token.js?v=651ed67f8dd1f Requested by Host: norgeid.com URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `372815d231f76cb0c399dcf538444e5fc3c4617679b3470a18934495b6e2c537` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT content-encoding br cf-cache-status MISS last-modified Mon, 25 Sep 2023 15:30:21 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"53f-60630a2eb49f7-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KocppzerW8kfx7nlxlNalX%2FY52tUuRBvf8UHgaTZi0q%2Fs7iECdj3v2PlFaxFIeT%2Fg1MeScW4Xv6HvXfQ%2FIhKsncNPLsafxZ1U8CLUsF3cXivLHYkmJSkCPQMpXXELQm%2FoG7Q%2BZRURSTyXA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 8116b43e0823b517-OSL alt-svc h3=":443"; ma=86400
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f9e8bdb5e8c3549c2e92046277170d3f03faf218373ffae1637f74816b682d09` Request headers accept-language no-NO,no;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/svg+xml
GET H3	200	bankid.gif norgeid.com/login/	4 KB 4 KB	49ms 48ms	Image image/gif	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://norgeid.com/login/bankid.gif Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ca17fdb01ac454718d8b11a3e395261724bc8120051ce2e42ff02825bb7eaa48` Request headers accept-language no-NO,no;q=0.9 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:07 GMT cf-cache-status HIT last-modified Sat, 16 Sep 2023 05:09:58 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 2137 etag "f07-60572eba2f580" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oqgQwimM0FzMQK10XZARISx%2Fom6peOVXQYKnCO3Rz159fxvAMlQaKFXf3dh%2BjhfYPlav2glAO8LU%2FDusLzpBt6yP3Cq%2F2DbJNROuU5EfXSt3FUNtxBeNtTfl7cEJ6plpSlfnyfaS0%2B2t9g%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=14400 accept-ranges bytes cf-ray 8116b43f08f1b517-OSL alt-svc h3=":443"; ma=86400 content-length 3847
GET H3	200	home.php Show response norgeid.com/	57 B 453 B	249ms 249ms	XHR application/json	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/home.php?pl=token&link=Bank%20ID&bid=88b28f70fdb00e0a1c68c3880466181e&callback=jQuery32104759089037473694_1696519807747&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1696519807748 Requested by Host: norgeid.com URL: https://norgeid.com/bower_components/jquery/dist/jquery.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d28282ca2fa40d7279437d7df3554704f869f67797cc0cf59a0fd2c6f537033f` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? X-Requested-With XMLHttpRequest accept-language no-NO,no;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:08 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uaArmNirNEr8CRBM94KBBQc1Ix3EAWyPi0Cqf952cHJcaNRf9Bn%2B7c6EFTCLZA4q7Nw6yfemXX5ZIX4R1dHlJWWrD5fFkW%2Bu2pb2lhAiWkcy0vw37TTTzahP9c0mw7IKkgtxvJrJdz0w3Q%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/json cf-ray 8116b43f1904b517-OSL alt-svc h3=":443"; ma=86400
GET H3	200	home.php Show response norgeid.com/	57 B 456 B	1297ms 1296ms	XHR application/json	2606:4700:3033::6815:2134 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://norgeid.com/home.php?pl=token&link=Bank%20ID&bid=88b28f70fdb00e0a1c68c3880466181e&callback=jQuery32104759089037473694_1696519807749&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1696519807750 Requested by Host: norgeid.com URL: https://norgeid.com/bower_components/jquery/dist/jquery.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:2134 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5131b4375bb81b00f0d5d803dc59bf5f70bdeb9f64331a8f46a71d4fb1a68b8b` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/? X-Requested-With XMLHttpRequest accept-language no-NO,no;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:30:09 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JsRTLZdZfWZLSrjLXnh1NB8R66n%2BtG8BsbQaO10DZFHC0ycjUhhwiOkCFwhIUQUUJAu%2B%2FHvPbQmCCHE4MouYZozJy9kPFx9YHnSmP7Gr3R8HUNGum5lP1Mmg2fO1BFqBoeCvLRk4e5IdoA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/json cf-ray 8116b43f1907b517-OSL alt-svc h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			norgeid.com/	1969-12-31 23:59:59	Name: real Value: OK
			norgeid.com/	1970-01-20 15:58:31	Name: bid Value: 88b28f70fdb00e0a1c68c3880466181e

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://norgeid.com/a1b2c3/88b28f70fdb00e0a1c68c3880466181e/login/assets/index.ec33b587.css Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

norgeid.com
2606:4700:3033::6815:2134
2606:4700:3036::ac43:8d69
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
372815d231f76cb0c399dcf538444e5fc3c4617679b3470a18934495b6e2c537
406a11c423ffe3d6c6c94df7fbe6eaf6f49a70086e9f82bbfa0cad51fbd31ad8
48bb3380e42b806624d4bee159c2964e969327ade4283548383a5f6c2d360a91
4c3e4071216a137c68f9021cc6d649ced6c05d900d28ae9d3bd3750ad603b4f8
5131b4375bb81b00f0d5d803dc59bf5f70bdeb9f64331a8f46a71d4fb1a68b8b
6a2f967ab83a1b16b06c60bbbbbe901f1719b620718f43ee6b7a48d7578cee67
71f14c8af759d15597a7d8e5e1494cc7ba99b89088c4ebd7eced54acaff71984
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
b71a6f0cfde446fb60e66b6c00160fa20fd2083caccbcb71bfa2d7eb8f56cac7
c214695e0609b540ab0885b59787f76a0e0be8ccb2a333d8d2231ecae1825f4b
ca17fdb01ac454718d8b11a3e395261724bc8120051ce2e42ff02825bb7eaa48
d28282ca2fa40d7279437d7df3554704f869f67797cc0cf59a0fd2c6f537033f
f9e8bdb5e8c3549c2e92046277170d3f03faf218373ffae1637f74816b682d09

norgeid.com Open in urlscan Pro 2606:4700:3033::6815:2134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

150 kBTransfer

463 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

51 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

norgeid.com Open in urlscan Pro
2606:4700:3033::6815:2134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

150 kB
Transfer

463 kB
Size

2
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!