nyskatteetaten.wpenginepowered.com Open in urlscan Pro
141.193.213.10 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Submission: On December 10 via manual (December 10th 2024, 1:27:00 pm UTC) from NO — Scanned from NO

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 141.193.213.10, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare London, LLC, US. The main domain is nyskatteetaten.wpenginepowered.com.
TLS certificate: Issued by E6 on November 16th 2024. Valid for: 3 months.

This is the only time nyskatteetaten.wpenginepowered.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	141.193.213.10 141.193.213.10	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
1	172.217.16.202 172.217.16.202	15169 (GOOGLE) (GOOGLE)
1	95.175.105.204 95.175.105.204	49282 (FICOLO Fi...) (FICOLO Ficolo Oy)
11	3

9 141.193.213.10 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

nyskatteetaten.wpenginepowered.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.202 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.175.105.204 (Helsinki, Finland)

ASN49282 (FICOLO Ficolo Oy, FI)
PTR: kommunikasjon.ntb.no

kommunikasjon.ntb.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	wpenginepowered.com nyskatteetaten.wpenginepowered.com	34 KB
1	ntb.no kommunikasjon.ntb.no	6 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1 KB
11	3

	Domain	Requested by
9	nyskatteetaten.wpenginepowered.com	nyskatteetaten.wpenginepowered.com
1	kommunikasjon.ntb.no
1	fonts.googleapis.com	nyskatteetaten.wpenginepowered.com
11	3

This site contains no links.

Subject Issuer	Validity	Valid
wpenginepowered.com E6	`2024-11-16` - `2025-02-14`	3 months	crt.sh
upload.video.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
kommunikasjon.ntb.no R10	`2024-10-28` - `2025-01-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Frame ID: E6076028BF069CA2575EB3CA09C178C2
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NORGE AS

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

41 kB
Transfer

231 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request perso.html Show response
nyskatteetaten.wpenginepowered.com/no/id/ 3 KB
1 KB 425ms
288ms Document
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4431562fed5bf82688d75df8ad40b1e4bd42b67cb8c573f132bcc1326fc779cc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8efd91bd5ac1ac1a-GOT
content-encoding: br
content-type: text/html
date: Tue, 10 Dec 2024 13:26:54 GMT
last-modified: Mon, 09 Dec 2024 14:32:49 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 1
x-cache-group: iphone
x-cacheable: SHORT

GET
H3 200 bootstrap.css
nyskatteetaten.wpenginepowered.com/no/id/css/ 189 KB
26 KB 72ms
69ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://nyskatteetaten.wpenginepowered.com/no/id/css/bootstrap.css
Requested by: Host: nyskatteetaten.wpenginepowered.com
URL: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"6756ff91-2f22a"
age: 1248
cf-ray: 8efd91bf7d11ac1a-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 10 Dec 2024 13:26:54 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Mon, 09 Dec 2024 14:32:49 GMT
priority: u=0,i=?0

GET
H3 200 lary.css
nyskatteetaten.wpenginepowered.com/no/id/css/ 10 KB
2 KB 70ms
67ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://nyskatteetaten.wpenginepowered.com/no/id/css/lary.css
Requested by: Host: nyskatteetaten.wpenginepowered.com
URL: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"6756ff91-279f"
age: 1248
cf-ray: 8efd91bf7d13ac1a-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 10 Dec 2024 13:26:54 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Mon, 09 Dec 2024 14:32:49 GMT
priority: u=0,i=?0

GET
H3 200 acc.svg
nyskatteetaten.wpenginepowered.com/no/id/image/ 2 KB
977 B 64ms
61ms Image
image/svg+xml 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nyskatteetaten.wpenginepowered.com/no/id/image/acc.svg
Requested by: Host: nyskatteetaten.wpenginepowered.com
URL: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"6756ff91-824"
age: 1241
cf-ray: 8efd91bf7d15ac1a-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 10 Dec 2024 13:26:54 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Mon, 09 Dec 2024 14:32:49 GMT
priority: u=2,i

GET
H3 200 bar_lg.png
nyskatteetaten.wpenginepowered.com/no/id/image/ 388 B
663 B 118ms
116ms Image
image/webp 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nyskatteetaten.wpenginepowered.com/no/id/image/bar_lg.png
Requested by: Host: nyskatteetaten.wpenginepowered.com
URL: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd28b6a30856cd02cca7ef9c08733be740e18f4e4e75867267bf4e513e3f86f9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-bgj: imgq:100,h2pri
etag: "6756ff91-374"
age: 1241
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=884
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 10 Dec 2024 13:26:54 GMT
content-type: image/webp
content-disposition: inline; filename="bar_lg.webp"
vary: Accept
last-modified: Mon, 09 Dec 2024 14:32:49 GMT
priority: u=2,i
cache-control: public, max-age=31536000
cf-ray: 8efd91bf7d16ac1a-GOT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 388
server: cloudflare

GET
H3 200 sahm.svg
nyskatteetaten.wpenginepowered.com/no/id/image/ 172 B
363 B 61ms
61ms Image
image/svg+xml 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nyskatteetaten.wpenginepowered.com/no/id/image/sahm.svg
Requested by: Host: nyskatteetaten.wpenginepowered.com
URL: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"6756ff8e-ac"
age: 1241
cf-ray: 8efd91c0ce60ac1a-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 10 Dec 2024 13:26:54 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Mon, 09 Dec 2024 14:32:46 GMT
priority: u=2,i

GET
H3 200 protege.png
nyskatteetaten.wpenginepowered.com/no/id/image/ 2 KB
3 KB 64ms
63ms Image
image/png 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nyskatteetaten.wpenginepowered.com/no/id/image/protege.png
Requested by: Host: nyskatteetaten.wpenginepowered.com
URL: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 375aa9cbfaf03a02679363d4967f662930ea9eb9bc7e75e1ae50e5bd105844fc

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-bgj: imgq:100,h2pri
etag: "6756ff8e-12f5"
age: 1241
cf-cache-status: HIT
cf-polished: origSize=4853, status=webp_bigger
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 10 Dec 2024 13:26:54 GMT
content-type: image/png
last-modified: Mon, 09 Dec 2024 14:32:46 GMT
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=31536000
cf-ray: 8efd91c0ce68ac1a-GOT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2381
server: cloudflare

GET
H3 404 jquery-3.5.1.min.js
nyskatteetaten.wpenginepowered.com/no/id/js/ 0
0 67ms
66ms Script
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://nyskatteetaten.wpenginepowered.com/no/id/js/jquery-3.5.1.min.js
Requested by: Host: nyskatteetaten.wpenginepowered.com
URL: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: HIT
age: 0
cf-ray: 8efd91c13ed0ac1a-GOT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 10 Dec 2024 13:26:54 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H3 404 jquery.mask.js
nyskatteetaten.wpenginepowered.com/no/id/js/ 0
0 111ms
110ms Script
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://nyskatteetaten.wpenginepowered.com/no/id/js/jquery.mask.js
Requested by: Host: nyskatteetaten.wpenginepowered.com
URL: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: HIT
age: 0
cf-ray: 8efd91c14ee2ac1a-GOT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Tue, 10 Dec 2024 13:26:54 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H2 200 css2
fonts.googleapis.com/ 19 KB
1 KB 1382ms
839ms Stylesheet
text/css 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Wix+Madefor+Text:ital,wght@0,400;0,500;0,600;0,700;0,800;1,400;1,500;1,600;1,700;1,800&display=swap

Requested by

Host: nyskatteetaten.wpenginepowered.com
URL: https://nyskatteetaten.wpenginepowered.com/no/id/css/lary.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f10.1e100.net

Software

ESF /

Resource Hash

af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Tue, 10 Dec 2024 13:26:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 10 Dec 2024 13:26:55 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Tue, 10 Dec 2024 13:26:55 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg
kommunikasjon.ntb.no/data/images/00306/ 6 KB
6 KB 265ms
85ms Other
image/jpeg 95.175.105.204
FICOLO Ficolo Oy

General

Check archive.org

Show headers Download Go to

Full URL

https://kommunikasjon.ntb.no/data/images/00306/95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.175.105.204 Helsinki, Finland, ASN49282 (FICOLO Ficolo Oy, FI),

Reverse DNS

kommunikasjon.ntb.no

Software

nginx /

Resource Hash

425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nyskatteetaten.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=2592000
etag: W/"12533788021"
access-control-allow-methods: POST, PUT, GET, DELETE, OPTIONS
x-prs-image-width: 208
expires: Thu, 09 Jan 2025 13:26:56 GMT
access-control-allow-origin: https://kommunikasjon.ntb.no
content-length: 5707
date: Tue, 10 Dec 2024 13:26:56 GMT
content-type: image/jpeg
server: nginx
x-prs-image-height: 250
access-control-allow-headers: Accept, Accept-Language, Content-Language, Content-Type, Origin

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://nyskatteetaten.wpenginepowered.com/no/id/js/jquery-3.5.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://nyskatteetaten.wpenginepowered.com/no/id/js/jquery.mask.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
kommunikasjon.ntb.no
nyskatteetaten.wpenginepowered.com
141.193.213.10
172.217.16.202
95.175.105.204
2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4
26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6
375aa9cbfaf03a02679363d4967f662930ea9eb9bc7e75e1ae50e5bd105844fc
425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd
4431562fed5bf82688d75df8ad40b1e4bd42b67cb8c573f132bcc1326fc779cc
4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766
823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917
af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506
fd28b6a30856cd02cca7ef9c08733be740e18f4e4e75867267bf4e513e3f86f9

nyskatteetaten.wpenginepowered.com Open in urlscan Pro 141.193.213.10 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

41 kBTransfer

231 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

nyskatteetaten.wpenginepowered.com Open in urlscan Pro
141.193.213.10 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

41 kB
Transfer

231 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!