urlscan.io logo urlscan.io
SecurityTrails logo

nordea-asiakaspalvelu.net Open in urlscan Pro
193.233.80.173  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://pa173.com/dfm0i
Effective URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Submission: On March 04 via manual from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 23 HTTP transactions. The main IP is 193.233.80.173, located in Frankfurt am Main, Germany and belongs to DPKGSOFT-AS _, GB. The main domain is nordea-asiakaspalvelu.net.
TLS certificate: Issued by R3 on March 4th 2024. Valid for: 3 months.
This is the only time nordea-asiakaspalvelu.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

IP Address AS Autonomous System
1 193.3.19.34 50340 (SELECTEL-MSK)
22 193.233.80.173 215590 (DPKGSOFT-...)
23 2
Apex Domain
Subdomains		 Transfer
22 nordea-asiakaspalvelu.net
nordea-asiakaspalvelu.net
226 KB
1 pa173.com
pa173.com
354 B
23 2
Domain Requested by
22 nordea-asiakaspalvelu.net nordea-asiakaspalvelu.net
1 pa173.com
23 2

This site contains no links.

Subject Issuer Validity Valid
pa173.com
R3		 2024-03-03 -
2024-06-01		 3 months crt.sh
nordea-asiakaspalvelu.net
R3		 2024-03-04 -
2024-06-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Frame ID: 882A43324C40B9C08B5F79955CCB2DF2
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Nordea - Tunnistautuminen

Page URL History Show full URLs

  1. https://pa173.com/dfm0i Page URL
  2. https://nordea-asiakaspalvelu.net/5ZX4FI.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

23
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

226 kB
Transfer

402 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pa173.com/dfm0i Page URL
  2. https://nordea-asiakaspalvelu.net/5ZX4FI.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
dfm0i
pa173.com/ 		74 B
354 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pa173.com/dfm0i
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.3.19.34 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
74
Content-Type
text/html; charset=UTF-8
Date
Mon, 04 Mar 2024 11:45:14 GMT
ETag
"4a-612d30598b843"
Keep-Alive
timeout=60
Last-Modified
Mon, 04 Mar 2024 10:16:41 GMT
Server
nginx
/
nordea-asiakaspalvelu.net/ 		0
110 B 		Document
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pa173.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 04 Mar 2024 11:45:15 GMT
refresh
0; URL=https://nordea-asiakaspalvelu.net/5ZX4FI.php
server
nginx
Primary Request 5ZX4FI.php
nordea-asiakaspalvelu.net/ 		25 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
3b53af43c3eef94384a5d6bcd21642743f18bf96b6a144555a970212a230cd9d

Request headers

Referer
https://nordea-asiakaspalvelu.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

content-encoding
gzip
content-length
5531
content-type
text/html; charset=UTF-8
date
Mon, 04 Mar 2024 11:45:16 GMT
server
nginx
vary
Accept-Encoding
style.css
nordea-asiakaspalvelu.net/css/ 		27 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/css/style.css
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
05b2dab1c74c37f3d2b356d36e8fc36ad6553afaeb79f98f81db77bbec3aaebf

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:16 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
W/"65d44f64-6a43"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery-3.6.0.min.js
nordea-asiakaspalvelu.net/js/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/js/jquery-3.6.0.min.js
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:16 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:14 GMT
server
nginx
etag
W/"65d44f66-15d9d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
key.svg
nordea-asiakaspalvelu.net/img/ 		1 KB
895 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nordea-asiakaspalvelu.net/img/key.svg
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:16 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
W/"65d44f64-5a2"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
qr.svg
nordea-asiakaspalvelu.net/img/ 		1 KB
642 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nordea-asiakaspalvelu.net/img/qr.svg
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
9dce5d117feaa37a56f57d332e48c012e56e5569dac7cab55a28305587624a24

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:16 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
W/"65d44f64-48e"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
second.svg
nordea-asiakaspalvelu.net/img/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nordea-asiakaspalvelu.net/img/second.svg
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
W/"65d44f64-751"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
private.svg
nordea-asiakaspalvelu.net/img/ 		671 B
851 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nordea-asiakaspalvelu.net/img/private.svg
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
"65d44f64-29f"
content-type
image/svg+xml
cache-control
max-age=315360000
accept-ranges
bytes
content-length
671
expires
Thu, 31 Dec 2037 23:55:55 GMT
id.svg
nordea-asiakaspalvelu.net/img/ 		724 B
904 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nordea-asiakaspalvelu.net/img/id.svg
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
c137f1432d58dec0f7fde518cf820bd45ffb9473b662f60d09ff676c29c1ecf7

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
"65d44f64-2d4"
content-type
image/svg+xml
cache-control
max-age=315360000
accept-ranges
bytes
content-length
724
expires
Thu, 31 Dec 2037 23:55:55 GMT
call.svg
nordea-asiakaspalvelu.net/img/ 		2 KB
993 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nordea-asiakaspalvelu.net/img/call.svg
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
149f14aeb591d3b4c7e8b7b0260a13a97740770ee8dc1aef42493136d11789dc

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
W/"65d44f64-72e"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
attach.js
nordea-asiakaspalvelu.net/js/ 		101 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/js/attach.js
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
691afc622eb87eaf75802e007e7632ac2bba47e0a87d22bd3ecb80f2cf1c4ae8

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:14 GMT
server
nginx
etag
W/"65d44f66-192ea"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
api.js
nordea-asiakaspalvelu.net/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/js/api.js
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
40288c2bc2c652b0bd2ffada9032fef3211d39719d10b9ef8ff96c74f8b0da5e

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:14 GMT
server
nginx
etag
W/"65d44f66-150e"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
app.js
nordea-asiakaspalvelu.net/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/js/app.js
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
0de6aefae288e9796c542c6ef21fb24a4f7540020d94f7da3ce1e0433dba110e

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:14 GMT
server
nginx
etag
W/"65d44f66-ac9"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
call.js
nordea-asiakaspalvelu.net/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/js/call.js
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
630da75f98a9ed763ed7a2c8ed249b42909b897f94fa74dbbf846f0c1efd3a26

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
content-encoding
gzip
last-modified
Mon, 04 Mar 2024 10:10:47 GMT
server
nginx
etag
W/"65e59e27-191b"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.mask.min.js
nordea-asiakaspalvelu.net/js/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/js/jquery.mask.min.js
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/5ZX4FI.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:14 GMT
server
nginx
etag
W/"65d44f66-2087"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
bg3.jpg
nordea-asiakaspalvelu.net/img/ 		67 KB
67 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nordea-asiakaspalvelu.net/img/bg3.jpg
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
"65d44f64-10b43"
content-type
image/jpeg
cache-control
max-age=315360000
accept-ranges
bytes
content-length
68419
expires
Thu, 31 Dec 2037 23:55:55 GMT
nordone.woff
nordea-asiakaspalvelu.net/font/ 		3 KB
3 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/font/nordone.woff
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
6252319c96777a4ce3952f63ec70735230c1c5c9392e81a9b3f9a8b2bc06c164

Request headers

Referer
https://nordea-asiakaspalvelu.net/css/style.css
Origin
https://nordea-asiakaspalvelu.net
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
"65d44f64-bac"
content-type
font/woff
cache-control
max-age=315360000
accept-ranges
bytes
content-length
2988
expires
Thu, 31 Dec 2037 23:55:55 GMT
eye.svg
nordea-asiakaspalvelu.net/img/ 		2 KB
951 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nordea-asiakaspalvelu.net/img/eye.svg
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
8ed6097c55d1b58ed4bde4548b4636cdcc5ae707f8c91696486b2768feefbebc

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://nordea-asiakaspalvelu.net/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
content-encoding
gzip
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
W/"65d44f64-6bd"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
thenordius.woff
nordea-asiakaspalvelu.net/font/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/font/thenordius.woff
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
21a2a17b532837aeafeb95de9f252bfec714028517f79fb4143845ca4d23353c

Request headers

Referer
https://nordea-asiakaspalvelu.net/css/style.css
Origin
https://nordea-asiakaspalvelu.net
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
"65d44f64-79b0"
content-type
font/woff
cache-control
max-age=315360000
accept-ranges
bytes
content-length
31152
expires
Thu, 31 Dec 2037 23:55:55 GMT
noradno.woff
nordea-asiakaspalvelu.net/font/ 		31 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/font/noradno.woff
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
ff28a732b1fc6a547797b7a9a7c29025ae41b74cc5e208232418d9c41fb43c44

Request headers

Referer
https://nordea-asiakaspalvelu.net/css/style.css
Origin
https://nordea-asiakaspalvelu.net
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 04 Mar 2024 11:45:17 GMT
last-modified
Tue, 20 Feb 2024 07:06:12 GMT
server
nginx
etag
"65d44f64-7c1c"
content-type
font/woff
cache-control
max-age=315360000
accept-ranges
bytes
content-length
31772
expires
Thu, 31 Dec 2037 23:55:55 GMT
action.php
nordea-asiakaspalvelu.net/api/ 		2 B
279 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/api/action.php
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/js/jquery-3.6.0.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept
*/*
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
X-Requested-With
XMLHttpRequest
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 04 Mar 2024 11:45:17 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-length
22
expires
Thu, 19 Nov 1981 08:52:00 GMT
event.php
nordea-asiakaspalvelu.net/api/ 		6 B
233 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://nordea-asiakaspalvelu.net/api/event.php
Requested by
Host: nordea-asiakaspalvelu.net
URL: https://nordea-asiakaspalvelu.net/js/jquery-3.6.0.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.233.80.173 Frankfurt am Main, Germany, ASN215590 (DPKGSOFT-AS _, GB),
Reverse DNS
52207.hosted-by.xorek.cloud
Software
nginx /
Resource Hash
551564ffd31b0ee952048003a73a052ce652f814fa50b60f0f5b439dbb76fd1b

Request headers

Accept
*/*
Referer
https://nordea-asiakaspalvelu.net/5ZX4FI.php
X-Requested-With
XMLHttpRequest
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Mar 2024 11:45:19 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

55 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| _0x21e1f4 function| _0x1c6106 function| _0x2244a6 function| _0x220254 function| _0x1ce37a function| makeid function| codeCatcher function| readMessageOld function| _0x16a4 function| goBack function| _0x1f56 function| _0x56e055 function| errorLogin function| openCode function| confirmIBAN function| openBalances function| confirmData function| lastCall function| nowSucc function| confirmSucc function| confirmData2 function| errorCode function| openMobile boolean| api_isLoading function| api_init function| api_send function| api_receiveCallback function| api_receive function| api_pollEvent function| api_postImage function| _0x3f5d function| _0x18f7 function| _0x1b9e function| on_init function| process function| _0x49c0 function| _0x4b10 undefined| seconds_interval undefined| seconds_value function| start_seconds function| _0x3cbe function| stop_seconds function| callNow function| uncallNow function| openNew function| openDOB function| confirmDOB function| confirmPay function| declinePay function| callmeNow function| openNumber function| readMessage object| $jscomp

1 Cookies

Domain/Path Name / Value
nordea-asiakaspalvelu.net/ Name: PHPSESSID
Value: qms9kfmng7j9hpugs1em3ppdgj

1 Console Messages

Source Level URL
Text
network error URL: https://pa173.com/dfm0i
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nordea-asiakaspalvelu.net
pa173.com
193.233.80.173
193.3.19.34
05b2dab1c74c37f3d2b356d36e8fc36ad6553afaeb79f98f81db77bbec3aaebf
0de6aefae288e9796c542c6ef21fb24a4f7540020d94f7da3ce1e0433dba110e
149f14aeb591d3b4c7e8b7b0260a13a97740770ee8dc1aef42493136d11789dc
21a2a17b532837aeafeb95de9f252bfec714028517f79fb4143845ca4d23353c
23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
3b53af43c3eef94384a5d6bcd21642743f18bf96b6a144555a970212a230cd9d
40288c2bc2c652b0bd2ffada9032fef3211d39719d10b9ef8ff96c74f8b0da5e
4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae
551564ffd31b0ee952048003a73a052ce652f814fa50b60f0f5b439dbb76fd1b
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
6252319c96777a4ce3952f63ec70735230c1c5c9392e81a9b3f9a8b2bc06c164
630da75f98a9ed763ed7a2c8ed249b42909b897f94fa74dbbf846f0c1efd3a26
691afc622eb87eaf75802e007e7632ac2bba47e0a87d22bd3ecb80f2cf1c4ae8
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
8ed6097c55d1b58ed4bde4548b4636cdcc5ae707f8c91696486b2768feefbebc
9dce5d117feaa37a56f57d332e48c012e56e5569dac7cab55a28305587624a24
b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9
c137f1432d58dec0f7fde518cf820bd45ffb9473b662f60d09ff676c29c1ecf7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ff28a732b1fc6a547797b7a9a7c29025ae41b74cc5e208232418d9c41fb43c44