omavero.fi-02.net Open in urlscan Pro
45.93.20.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://omavero.fi-02.net/public/pages/?d=nordea
Submission: On January 04 via manual (January 4th 2024, 6:55:00 am UTC) from FI — Scanned from FI

Summary HTTP 22 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 22 HTTP transactions. The main IP is 45.93.20.188, located in Russian Federation and belongs to CHANGWAY-AS, HK. The main domain is omavero.fi-02.net.
TLS certificate: Issued by R3 on January 3rd 2024. Valid for: 3 months.

This is the only time omavero.fi-02.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address		AS Autonomous System
22	45.93.20.188 45.93.20.188		57523 (CHANGWAY-AS) (CHANGWAY-AS)
22	1

22 45.93.20.188 (Russian Federation)

ASN57523 (CHANGWAY-AS, HK)

omavero.fi-02.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	fi-02.net omavero.fi-02.net	292 KB
22	1

	Domain	Requested by
22	omavero.fi-02.net	omavero.fi-02.net
22	1

This site contains links to these domains. Also see Links.

Domain
www.nordea.fi

Subject Issuer	Validity	Valid
omavero.fi-02.net R3	`2024-01-03` - `2024-04-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://omavero.fi-02.net/public/pages/?d=nordea
Frame ID: EE2F1B4F3BCB40F0EC1F9A4E93E97885
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nordea - Tunnistautuminen

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

22
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

292 kB
Transfer

729 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nordea.fi/en/personal/our-services/online-mobile-services/code-app.html
Title: www.nordea.fi

Search URL Search Domain Scan URL

URL: https://www.nordea.fi/en/personal/our-services/online-mobile-services/code-calculator.html
Title: www.nordea.fi

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response omavero.fi-02.net/public/pages/	101 KB 29 KB	517ms 117ms	Document text/html	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `364afddb69daadf677c03347d5fcdeb6f79e3c11ccaacb713381a41c04622a07` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 29653 content-type text/html; charset=UTF-8 date Thu, 04 Jan 2024 06:54:55 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding
GET H2	200	styles-90d1ba6c2eef1d8f73fc94069cfe444b.css omavero.fi-02.net/public/front_end/front_end_files/nordea/	29 KB 6 KB	56ms 51ms	Stylesheet text/css	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `c449d881b8a86555a34768460eab87a7c527df3c70eb1eed38d76be235dd39a3` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:32 GMT server LiteSpeed etag "75ab-64e39ce0-2810b8;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 5753 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	jquery.js Show response omavero.fi-02.net/public/front_end/front_end_files/nordea/	266 KB 72 KB	56ms 52ms	Script application/x-javascript	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/jquery.js Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:30 GMT server LiteSpeed etag "42719-64e39cde-2810aa;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 73807 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	jquery.validate.js Show response omavero.fi-02.net/public/front_end/front_end_files/nordea/	47 KB 12 KB	87ms 83ms	Script application/x-javascript	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/jquery.validate.js Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `643cec1f3b8b02da905715f06e046d7c03d743b500a09457040503bdcf46f422` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:32 GMT server LiteSpeed etag "bab4-64e39ce0-2810ae;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 11910 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	jquery.maskedinput.js Show response omavero.fi-02.net/public/front_end/front_end_files/nordea/	10 KB 3 KB	88ms 85ms	Script application/x-javascript	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/jquery.maskedinput.js Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `b134fc3f777a1aeb46d45b7999e88fb655daa62f4fafe5bcaed5f70b4bb7bcef` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:30 GMT server LiteSpeed etag "2902-64e39cde-2810ab;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 2498 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	jquery.payment.js Show response omavero.fi-02.net/public/front_end/front_end_files/nordea/	17 KB 3 KB	88ms 85ms	Script application/x-javascript	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/jquery.payment.js Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `95d434ce5101fa0215bc35d3422c524705f6cd7998b728fcc6d8277b07f39730` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:30 GMT server LiteSpeed etag "4494-64e39cde-2810ad;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 3357 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	jquery.js Show response omavero.fi-02.net/public/js/cntdjs/	87 KB 30 KB	89ms 86ms	Script application/x-javascript	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/js/cntdjs/jquery.js Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:36 GMT server LiteSpeed etag "15d9d-64e39ce4-28114d;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 30112 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	jquery.mask.js Show response omavero.fi-02.net/public/js/cntdjs/	23 KB 6 KB	104ms 101ms	Script application/x-javascript	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/js/cntdjs/jquery.mask.js Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:36 GMT server LiteSpeed etag "5a88-64e39ce4-28114e;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 5554 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	cntd.js Show response omavero.fi-02.net/public/js/cntdjs/	3 KB 1000 B	104ms 102ms	Script application/x-javascript	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/js/cntdjs/cntd.js Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `c92e085ddf7aea5c3dc350f80e757f6f7a743fb97b4f004a69320a6e56d8c709` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:36 GMT server LiteSpeed etag "b0b-64e39ce4-28114c;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 934 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	loading.js Show response omavero.fi-02.net/public/js/shared/	3 KB 843 B	105ms 103ms	Script application/x-javascript	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/js/shared/loading.js Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `986f80e622582142a00b8ec4f60b69082f6c1548e5ecf519a0295900a1cf3531` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:38 GMT server LiteSpeed etag "ce7-64e39ce6-281164;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 753 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	online_status.js Show response omavero.fi-02.net/public/js/shared/	998 B 472 B	105ms 104ms	Script application/x-javascript	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/js/shared/online_status.js Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:38 GMT server LiteSpeed etag "3e6-64e39ce6-281166;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 383 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg omavero.fi-02.net/public/front_end/front_end_files/nordea/	3 KB 1 KB	105ms 104ms	Image image/svg+xml	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/service-break-f426cda35f41e4c0b7c30c814b5eb2ee.svg Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:32 GMT server LiteSpeed etag "af3-64e39ce0-2810b4;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 1268 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	offline-8599dbe5088e0566b0e39373d3a56b60.svg omavero.fi-02.net/public/front_end/front_end_files/nordea/	2 KB 959 B	106ms 105ms	Image image/svg+xml	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/offline-8599dbe5088e0566b0e39373d3a56b60.svg Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:32 GMT server LiteSpeed etag "751-64e39ce0-2810b2;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 881 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	technical-error-91ca9eec9eed6ed945355d650bb10d41.svg omavero.fi-02.net/public/front_end/front_end_files/nordea/	3 KB 1 KB	64ms 63ms	Image image/svg+xml	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/technical-error-91ca9eec9eed6ed945355d650bb10d41.svg Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:32 GMT server LiteSpeed etag "b1e-64e39ce0-2810b9;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 1099 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg omavero.fi-02.net/public/front_end/front_end_files/nordea/	3 KB 1 KB	92ms 91ms	Image image/svg+xml	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/something-went-wrong-9bbd07dc81f3c2a11d2c7735b416ee18.svg Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:32 GMT server LiteSpeed etag "c20-64e39ce0-2810b7;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 1160 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg omavero.fi-02.net/public/front_end/front_end_files/nordea/	3 KB 1 KB	74ms 73ms	Image image/svg+xml	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/cancel-d0c0f9d25ebde42bbd552c8ad5363f01.svg Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:30 GMT server LiteSpeed etag "c19-64e39cde-28109f;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 1347 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	no-connection-83f79e2367a313b468986e12a237c346.svg omavero.fi-02.net/public/front_end/front_end_files/nordea/	5 KB 2 KB	86ms 86ms	Image image/svg+xml	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/no-connection-83f79e2367a313b468986e12a237c346.svg Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:32 GMT server LiteSpeed etag "136e-64e39ce0-2810b1;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 1947 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	empty-3857ebe69f653487f8c9d99adde4657f.svg omavero.fi-02.net/public/front_end/front_end_files/nordea/	2 KB 695 B	87ms 86ms	Image image/svg+xml	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/empty-3857ebe69f653487f8c9d99adde4657f.svg Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/pages/?d=nordea Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/pages/?d=nordea User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT content-encoding br last-modified Mon, 21 Aug 2023 17:20:30 GMT server LiteSpeed etag "66a-64e39cde-2810a4;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 629 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	564d0ff0f3578b7128a458ef269b286a.jpg omavero.fi-02.net/public/front_end/front_end_files/nordea/	67 KB 67 KB	76ms 76ms	Image image/jpeg	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/564d0ff0f3578b7128a458ef269b286a.jpg Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/front_end/front_end_files/nordea/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff` Request headers accept-language fi-FI,fi;q=0.9 Referer https://omavero.fi-02.net/public/front_end/front_end_files/nordea/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT last-modified Mon, 21 Aug 2023 17:20:30 GMT server LiteSpeed etag "10b43-64e39cde-281097;;;" content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 68419 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	bb0a855a4f155c9c835a419f38c85653.woff2 omavero.fi-02.net/public/front_end/front_end_files/nordea/	2 KB 2 KB	70ms 69ms	Font font/woff2	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/bb0a855a4f155c9c835a419f38c85653.woff2 Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/front_end/front_end_files/nordea/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `9dd630e7cbf1a068b89a5a134e248ff63f2d452081bf86684aeb4b7f73712b76` Request headers Referer https://omavero.fi-02.net/public/front_end/front_end_files/nordea/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Origin https://omavero.fi-02.net accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT last-modified Mon, 21 Aug 2023 17:20:30 GMT server LiteSpeed etag "8e8-64e39cde-28109d;;;" content-type font/woff2 cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 2280 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	c233a817ad142919d728ebf4c8b3d54c.woff2 omavero.fi-02.net/public/front_end/front_end_files/nordea/	26 KB 26 KB	68ms 68ms	Font font/woff2	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/c233a817ad142919d728ebf4c8b3d54c.woff2 Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/front_end/front_end_files/nordea/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03` Request headers Referer https://omavero.fi-02.net/public/front_end/front_end_files/nordea/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Origin https://omavero.fi-02.net accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT last-modified Mon, 21 Aug 2023 17:20:30 GMT server LiteSpeed etag "6900-64e39cde-28109e;;;" content-type font/woff2 cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 26880 expires Thu, 11 Jan 2024 06:54:55 GMT
GET H2	200	7bc117ce8cbf2ce4b08a7ed17d16cf89.woff2 omavero.fi-02.net/public/front_end/front_end_files/nordea/	26 KB 26 KB	71ms 70ms	Font font/woff2	45.93.20.188 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL https://omavero.fi-02.net/public/front_end/front_end_files/nordea/7bc117ce8cbf2ce4b08a7ed17d16cf89.woff2 Requested by Host: omavero.fi-02.net URL: https://omavero.fi-02.net/public/front_end/front_end_files/nordea/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.93.20.188 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software LiteSpeed / Resource Hash `a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff` Request headers Referer https://omavero.fi-02.net/public/front_end/front_end_files/nordea/styles-90d1ba6c2eef1d8f73fc94069cfe444b.css Origin https://omavero.fi-02.net accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Thu, 04 Jan 2024 06:54:55 GMT last-modified Mon, 21 Aug 2023 17:20:30 GMT server LiteSpeed etag "6734-64e39cde-281099;;;" content-type font/woff2 cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 26420 expires Thu, 11 Jan 2024 06:54:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			omavero.fi-02.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0ob46b5hm6s5vg524quo2u3qul

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

omavero.fi-02.net
45.93.20.188
037024a96d014cbe884a9f81804ceadc25bd1e49d0d9018de09acddac997afbf
364afddb69daadf677c03347d5fcdeb6f79e3c11ccaacb713381a41c04622a07
3fc2607b1e133fb89affeca8fa96db25e9af2fa9d2f7960d2a9602df9e96ef72
443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03
4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae
4f98589b5ad297e797fc12ed5b90a5e9244a17dbc34c5cee66e01ae8c1455d2c
643cec1f3b8b02da905715f06e046d7c03d743b500a09457040503bdcf46f422
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff
8a22f5ea2bc34877a3334b91210c881523678eec1e915cf6a4ee261ba58121b1
95d434ce5101fa0215bc35d3422c524705f6cd7998b728fcc6d8277b07f39730
986f80e622582142a00b8ec4f60b69082f6c1548e5ecf519a0295900a1cf3531
9dd630e7cbf1a068b89a5a134e248ff63f2d452081bf86684aeb4b7f73712b76
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
a386a6170805a64ba2e46bcc37c79500b5207bd708b0d1da83cbcbc483e64cb7
a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff
b134fc3f777a1aeb46d45b7999e88fb655daa62f4fafe5bcaed5f70b4bb7bcef
c449d881b8a86555a34768460eab87a7c527df3c70eb1eed38d76be235dd39a3
c92e085ddf7aea5c3dc350f80e757f6f7a743fb97b4f004a69320a6e56d8c709
d690ce1d3a1304fff86d11c4f38ad540da84949d881ea0c04b49bcc0f13483e0
e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

omavero.fi-02.net Open in urlscan Pro 45.93.20.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

22 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

292 kBTransfer

729 kBSize

1 Cookies

2 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

omavero.fi-02.net Open in urlscan Pro
45.93.20.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

292 kB
Transfer

729 kB
Size

1
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!