urlscan.io logo urlscan.io
SecurityTrails logo

novoportal.hu Open in urlscan Pro
79.172.201.222  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://609249.kikiwongo.com/
Effective URL: https://novoportal.hu/lnmk/webauth/signin
Submission: On February 03 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 79.172.201.222, located in Hungary and belongs to DENINET-HU-AS, HU. The main domain is novoportal.hu.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 18th 2021. Valid for: 3 months.
This is the only time novoportal.hu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 192.185.48.202 46606 (UNIFIEDLA...)
3 12 79.172.201.222 29278 (DENINET-H...)
9 1
Apex Domain
Subdomains		 Transfer
12 novoportal.hu
novoportal.hu
1 MB
1 kikiwongo.com
609249.kikiwongo.com
258 B
9 2
Domain Requested by
12 novoportal.hu 3 redirects novoportal.hu
1 609249.kikiwongo.com 1 redirects
9 2

This site contains no links.

Subject Issuer Validity Valid
novoportal.hu
cPanel, Inc. Certification Authority		 2021-12-18 -
2022-03-18		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://novoportal.hu/lnmk/webauth/signin
Frame ID: BCBBCB5281FA6C19BA8FBE0A316C4F9E
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Chase Online

Page URL History Show full URLs

  1. http://609249.kikiwongo.com/ HTTP 302
    https://novoportal.hu/lnmk?cs=2 HTTP 301
    https://novoportal.hu/lnmk/?cs=2 HTTP 302
    https://novoportal.hu/lnmk/webauth/index HTTP 302
    https://novoportal.hu/lnmk/webauth/signin Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \bangular.{0,32}\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

1434 kB
Transfer

1426 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://609249.kikiwongo.com/ HTTP 302
    https://novoportal.hu/lnmk?cs=2 HTTP 301
    https://novoportal.hu/lnmk/?cs=2 HTTP 302
    https://novoportal.hu/lnmk/webauth/index HTTP 302
    https://novoportal.hu/lnmk/webauth/signin Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request signin
novoportal.hu/lnmk/webauth/
Redirect Chain
  • http://609249.kikiwongo.com/
  • https://novoportal.hu/lnmk?cs=2
  • https://novoportal.hu/lnmk/?cs=2
  • https://novoportal.hu/lnmk/webauth/index
  • https://novoportal.hu/lnmk/webauth/signin
18 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://novoportal.hu/lnmk/webauth/signin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.172.201.222 , Hungary, ASN29278 (DENINET-HU-AS, HU),
Reverse DNS
s2.tarhely.com
Software
Apache / PHP/7.4.27
Resource Hash
99d0f690209fd25e3780e7478b5fa78ed7ebb957d57c656a95dfcc7099f0da53

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

x-powered-by
PHP/7.4.27
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
content-type
text/html; charset=UTF-8
date
Thu, 03 Feb 2022 16:11:24 GMT
server
Apache

Redirect headers

x-powered-by
PHP/7.4.27
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
location
signin
content-length
0
content-type
text/html; charset=UTF-8
date
Thu, 03 Feb 2022 16:11:24 GMT
server
Apache
blue-ui.css
novoportal.hu/lnmk/webauth/style/css/ 		396 KB
398 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://novoportal.hu/lnmk/webauth/style/css/blue-ui.css
Requested by
Host: novoportal.hu
URL: https://novoportal.hu/lnmk/webauth/signin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.172.201.222 , Hungary, ASN29278 (DENINET-HU-AS, HU),
Reverse DNS
s2.tarhely.com
Software
Apache /
Resource Hash
a054554812c09bcd6e28618753061066ae6273f3af38e7cba62adeb7f1a5c348

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://novoportal.hu/lnmk/webauth/signin
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Thu, 03 Feb 2022 16:11:24 GMT
last-modified
Tue, 04 Feb 2020 14:44:06 GMT
server
Apache
accept-ranges
bytes
content-length
405034
content-type
text/css
logon.css
novoportal.hu/lnmk/webauth/style/css/ 		128 KB
129 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://novoportal.hu/lnmk/webauth/style/css/logon.css
Requested by
Host: novoportal.hu
URL: https://novoportal.hu/lnmk/webauth/signin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.172.201.222 , Hungary, ASN29278 (DENINET-HU-AS, HU),
Reverse DNS
s2.tarhely.com
Software
Apache /
Resource Hash
beaf04b1508ee134c7053a40e11f0a70faad6ac2dabad8cf8d288a77193f10df

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://novoportal.hu/lnmk/webauth/signin
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Thu, 03 Feb 2022 16:11:24 GMT
last-modified
Tue, 04 Feb 2020 14:44:06 GMT
server
Apache
accept-ranges
bytes
content-length
131144
content-type
text/css
angular.min.js
novoportal.hu/lnmk/webauth/style/js/ 		163 KB
164 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://novoportal.hu/lnmk/webauth/style/js/angular.min.js
Requested by
Host: novoportal.hu
URL: https://novoportal.hu/lnmk/webauth/signin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.172.201.222 , Hungary, ASN29278 (DENINET-HU-AS, HU),
Reverse DNS
s2.tarhely.com
Software
Apache /
Resource Hash
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://novoportal.hu/lnmk/webauth/signin
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Thu, 03 Feb 2022 16:11:24 GMT
last-modified
Tue, 04 Feb 2020 14:44:06 GMT
server
Apache
accept-ranges
bytes
content-length
167131
content-type
application/javascript
jquery.min.js
novoportal.hu/lnmk/webauth/style/js/ 		286 KB
288 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://novoportal.hu/lnmk/webauth/style/js/jquery.min.js
Requested by
Host: novoportal.hu
URL: https://novoportal.hu/lnmk/webauth/signin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.172.201.222 , Hungary, ASN29278 (DENINET-HU-AS, HU),
Reverse DNS
s2.tarhely.com
Software
Apache /
Resource Hash
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://novoportal.hu/lnmk/webauth/signin
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Thu, 03 Feb 2022 16:11:24 GMT
last-modified
Tue, 04 Feb 2020 14:44:06 GMT
server
Apache
accept-ranges
bytes
content-length
293072
content-type
application/javascript
jquery.validate.min.js
novoportal.hu/lnmk/webauth/style/js/ 		49 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://novoportal.hu/lnmk/webauth/style/js/jquery.validate.min.js
Requested by
Host: novoportal.hu
URL: https://novoportal.hu/lnmk/webauth/signin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.172.201.222 , Hungary, ASN29278 (DENINET-HU-AS, HU),
Reverse DNS
s2.tarhely.com
Software
Apache /
Resource Hash
ac2faaa0365cb4fa0389ddffc2957571ab541b85f0113ffdb519dc075c6b3f33

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://novoportal.hu/lnmk/webauth/signin
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Thu, 03 Feb 2022 16:11:24 GMT
last-modified
Tue, 04 Feb 2020 14:44:06 GMT
server
Apache
accept-ranges
bytes
content-length
50234
content-type
application/javascript
wordmark-white.svg
novoportal.hu/lnmk/webauth/style/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://novoportal.hu/lnmk/webauth/style/img/wordmark-white.svg
Requested by
Host: novoportal.hu
URL: https://novoportal.hu/lnmk/webauth/style/css/logon.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.172.201.222 , Hungary, ASN29278 (DENINET-HU-AS, HU),
Reverse DNS
s2.tarhely.com
Software
Apache /
Resource Hash
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://novoportal.hu/lnmk/webauth/style/css/logon.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Thu, 03 Feb 2022 16:11:24 GMT
last-modified
Tue, 04 Feb 2020 14:44:06 GMT
server
Apache
accept-ranges
bytes
content-length
1409
content-type
image/svg+xml
default.jpeg
novoportal.hu/lnmk/webauth/style/img/ 		331 KB
332 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://novoportal.hu/lnmk/webauth/style/img/default.jpeg
Requested by
Host: novoportal.hu
URL: https://novoportal.hu/lnmk/webauth/signin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.172.201.222 , Hungary, ASN29278 (DENINET-HU-AS, HU),
Reverse DNS
s2.tarhely.com
Software
Apache /
Resource Hash
cad98375860d70adb249fcae8eaa431c925e92045c90be92217553ec6351332f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://novoportal.hu/lnmk/webauth/signin
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Thu, 03 Feb 2022 16:11:24 GMT
last-modified
Tue, 04 Feb 2020 14:44:06 GMT
server
Apache
accept-ranges
bytes
content-length
339450
content-type
image/jpeg
dcefont.woff
novoportal.hu/lnmk/webauth/style/img/ 		53 KB
53 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://novoportal.hu/lnmk/webauth/style/img/dcefont.woff
Requested by
Host: novoportal.hu
URL: https://novoportal.hu/lnmk/webauth/style/css/blue-ui.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.172.201.222 , Hungary, ASN29278 (DENINET-HU-AS, HU),
Reverse DNS
s2.tarhely.com
Software
Apache /
Resource Hash
d75bef30599959292f501c97f1c3bbe31dbba72560b4602b9332a83a7794ba37

Request headers

Referer
https://novoportal.hu/lnmk/webauth/style/css/blue-ui.css
Origin
https://novoportal.hu
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Thu, 03 Feb 2022 16:11:24 GMT
last-modified
Tue, 04 Feb 2020 14:44:06 GMT
server
Apache
accept-ranges
bytes
content-length
53792
content-type
font/woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| myFunction function| isNumberKey object| angular function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
novoportal.hu/ Name: PHPSESSID
Value: 03e6970847d0110d124e25b865b13cd8