dev-innboks-mside-blf80.pantheonsite.io Open in urlscan Pro
2620:12a:8001::4 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Personnummer/lagre-personnummer.php/
Effective URL:
https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/
Submission: On July 22 via automatic, source openphish (July 22nd 2023, 2:17:32 am UTC) — Scanned from DE

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 2620:12a:8001::4, located in United States and belongs to FASTLY, US. The main domain is dev-innboks-mside-blf80.pantheonsite.io.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on June 6th 2023. Valid for: a year.

This is the only time dev-innboks-mside-blf80.pantheonsite.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 4	2620:12a:8001::4 2620:12a:8001::4	54113 (FASTLY) (FASTLY)
1	193.26.146.6 193.26.146.6	207674 (VIPPS-AS) (VIPPS-AS)
4	3

4 2620:12a:8001::4 (United States) 1 redirects

ASN54113 (FASTLY, US)

dev-innboks-mside-blf80.pantheonsite.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.26.146.6 (Norway)

ASN207674 (VIPPS-AS, NO)

csfe-preprod.bankid.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	pantheonsite.io 1 redirects dev-innboks-mside-blf80.pantheonsite.io	34 KB
1	bankid.no csfe-preprod.bankid.no	509 B
4	2

	Domain	Requested by
4	dev-innboks-mside-blf80.pantheonsite.io	1 redirects dev-innboks-mside-blf80.pantheonsite.io
1	csfe-preprod.bankid.no	dev-innboks-mside-blf80.pantheonsite.io
4	2

This site contains no links.

Subject Issuer	Validity	Valid
pantheonsite.io Sectigo RSA Organization Validation Secure Server CA	`2023-06-06` - `2024-07-06`	a year	crt.sh
csfe-preprod.bankid.no GlobalSign RSA OV SSL CA 2018	`2023-02-21` - `2024-03-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/
Frame ID: 39C976FA315F2B1CE465D66D8E2B2E37
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Innlogging

Page URL History Show full URLs

https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Personnummer/lagre-personnummer.php/ HTTP 302
https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

34 kB
Transfer

189 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Personnummer/lagre-personnummer.php/ HTTP 302
https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/
Redirect Chain

https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Personnummer/lagre-personnummer.php/
https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/

27 KB
8 KB

212ms
211ms

Document
text/html

2620:12a:8001::4
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

a4fcd756ed93f91dc6a06de1bd50adfff3d9a8a65b73c875b3a3762ffde324c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 35
content-encoding: gzip
content-length: 7797
content-type: text/html
date: Sat, 22 Jul 2023 02:17:27 GMT
etag: W/"64b96202-6d66"
last-modified: Thu, 20 Jul 2023 16:34:10 GMT
server: nginx
strict-transport-security: max-age=300
vary: Accept-Encoding, Cookie, Cookie
via: 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT
x-cache-hits: 1017, 1
x-pantheon-styx-hostname: styx-fe3fe4-d-777cd49b6d-zvct5
x-robots-tag: noindex
x-served-by: cache-ams21042-AMS, cache-bom4744-BOM
x-styx-req-id: 77bcaa9f-2795-11ee-a9ca-4e59f0accf13
x-timer: S1689992248.634952,VS0,VE1

Redirect headers

accept-ranges: bytes
age: 0
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 22 Jul 2023 02:17:27 GMT
location: /Informasjon/Telefonnummer/
server: nginx
strict-transport-security: max-age=300
vary: Cookie, Cookie
via: 1.1 varnish, 1.1 varnish
x-cache: HIT, MISS
x-cache-hits: 1, 0
x-pantheon-styx-hostname: styx-fe3fe4-d-777cd49b6d-jsldb
x-robots-tag: noindex
x-served-by: cache-ams12778-AMS, cache-bom4744-BOM
x-styx-req-id: dcc2c93a-2835-11ee-8347-b6c93ccf66d1
x-timer: S1689992247.295664,VS0,VE129

GET
H2 200 style.css
dev-innboks-mside-blf80.pantheonsite.io/Files/ 157 KB
25 KB 597ms
596ms Stylesheet
text/css 2620:12a:8001::4
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://dev-innboks-mside-blf80.pantheonsite.io/Files/style.css

Requested by

Host: dev-innboks-mside-blf80.pantheonsite.io
URL: https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

6b7472b557537425bd71caa89aa431608b46949dab18ee048724fb721ec10e1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe3fe4-c-56898fb65b-qq9hq
strict-transport-security: max-age=300
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
date: Sat, 22 Jul 2023 02:17:28 GMT
age: 0
x-cache: MISS, MISS
expires: Sat, 22 Jul 2023 02:17:27 GMT
x-served-by: cache-ams12750-AMS, cache-bom4744-BOM
last-modified: Thu, 20 Jul 2023 16:34:10 GMT
server: nginx
x-timer: S1689992248.850918,VS0,VE388
etag: W/"64b96202-27430"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: e7c240c6-2835-11ee-96a8-7282765d4e8d
cache-control: no-cache, must-revalidate
accept-ranges: bytes
x-robots-tag: noindex
x-cache-hits: 0, 0

GET
H2 200 javascript.js Show response
dev-innboks-mside-blf80.pantheonsite.io/Files/ 296 B
460 B 340ms
339ms Script
application/x-javascript 2620:12a:8001::4
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://dev-innboks-mside-blf80.pantheonsite.io/Files/javascript.js

Requested by

Host: dev-innboks-mside-blf80.pantheonsite.io
URL: https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:12a:8001::4 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cad2c46221160c14f18f62d8aaaefe76e073596e0c2d814d4bcc4646422d25ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe3fe4-c-56898fb65b-qq9hq
strict-transport-security: max-age=300
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
date: Sat, 22 Jul 2023 02:17:27 GMT
age: 0
x-cache: MISS, MISS
expires: Sat, 22 Jul 2023 02:17:26 GMT
content-length: 202
x-served-by: cache-ams21039-AMS, cache-bom4744-BOM
last-modified: Thu, 20 Jul 2023 16:34:10 GMT
server: nginx
x-timer: S1689992248.851145,VS0,VE131
etag: W/"64b96202-128"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: e79aff5c-2835-11ee-96a8-7282765d4e8d
cache-control: no-cache, must-revalidate
accept-ranges: bytes
x-robots-tag: noindex
x-cache-hits: 0, 0

GET
H/1.1 200
OK KgAAAIYzxN3WxmOfAxVMQDId9-aIAfs9SiOqQVr7NscP8MMOdILwhEk9TFt__yb6JSxDp0e3SvMe3nkhfgbTYyPr5PLb9yrlibw Show response
csfe-preprod.bankid.no/CentralServerFEJS/b/ 108 B
509 B 269ms
70ms Script
application/javascript 193.26.146.6
VIPPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://csfe-preprod.bankid.no/CentralServerFEJS/b/KgAAAIYzxN3WxmOfAxVMQDId9-aIAfs9SiOqQVr7NscP8MMOdILwhEk9TFt__yb6JSxDp0e3SvMe3nkhfgbTYyPr5PLb9yrlibw

Requested by

Host: dev-innboks-mside-blf80.pantheonsite.io
URL: https://dev-innboks-mside-blf80.pantheonsite.io/Informasjon/Telefonnummer/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

193.26.146.6 , Norway, ASN207674 (VIPPS-AS, NO),

Reverse DNS

Software

Apache /

Resource Hash

a1f96af0ff80beee233dd05a75843e48337554f85d93f5c533cb42bc8045220e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dev-innboks-mside-blf80.pantheonsite.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Sat, 22 Jul 2023 02:17:27 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Content-Type: application/javascript;charset=UTF-8
Cache-control: no-cache, no-store, must-revalidate, max-age=0
Connection: close
Content-Length: 108
X-XSS-Protection: 1; mode=block
Expires: Sat, 22 Jul 2023 02:17:27 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2fbbbda646f6c6004b2f3670d40a1ad4d5df6c8a0089943845aa5fe55a749e92

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 172 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6a191c4d1f4adbef09018df519205cc8696e1f0f00a67196f0677e8484d949f2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 167 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cbee76f080a3f8638f8d1cc0e1457adf5588a5ca44b56c5bf719bb5f57f0f2de

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 192 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 347026e609df7b4c783cbb5af4b7e65d899b71bdfd9b99de75fbf63a033ea74f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 760 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 207 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 74d9f62c29cb35ce1ab07d9e61e05c31d7533bc43e756d6b849de1eddec2b8ce

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 172 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 296 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 296d8f67dcf848a35385d138a46404f00c21f1a8eb22249473ddd9aab1f411ab

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 310 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c575ff79d199955e3aba19296142cf49cd7bcdcf7317f8a17bed8d349f9a7388

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 200 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc197b30cca0477fd82b1c175af0ed1008687e12d9dff7f75c417f959c1830ae

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| eb boolean| vhfXfBJjSohsCgBBQFxg_1

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=300

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

csfe-preprod.bankid.no
dev-innboks-mside-blf80.pantheonsite.io
193.26.146.6
2620:12a:8001::4
296d8f67dcf848a35385d138a46404f00c21f1a8eb22249473ddd9aab1f411ab
2fbbbda646f6c6004b2f3670d40a1ad4d5df6c8a0089943845aa5fe55a749e92
347026e609df7b4c783cbb5af4b7e65d899b71bdfd9b99de75fbf63a033ea74f
4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766
6a191c4d1f4adbef09018df519205cc8696e1f0f00a67196f0677e8484d949f2
6b7472b557537425bd71caa89aa431608b46949dab18ee048724fb721ec10e1c
74d9f62c29cb35ce1ab07d9e61e05c31d7533bc43e756d6b849de1eddec2b8ce
7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1
a1f96af0ff80beee233dd05a75843e48337554f85d93f5c533cb42bc8045220e
a4fcd756ed93f91dc6a06de1bd50adfff3d9a8a65b73c875b3a3762ffde324c4
c575ff79d199955e3aba19296142cf49cd7bcdcf7317f8a17bed8d349f9a7388
cad2c46221160c14f18f62d8aaaefe76e073596e0c2d814d4bcc4646422d25ea
cbee76f080a3f8638f8d1cc0e1457adf5588a5ca44b56c5bf719bb5f57f0f2de
dc197b30cca0477fd82b1c175af0ed1008687e12d9dff7f75c417f959c1830ae

dev-innboks-mside-blf80.pantheonsite.io Open in urlscan Pro 2620:12a:8001::4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

34 kBTransfer

189 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

dev-innboks-mside-blf80.pantheonsite.io Open in urlscan Pro
2620:12a:8001::4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

34 kB
Transfer

189 kB
Size

0
Cookies

4 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!